Sensitive data decryption method and device, sensitive data encryption method and device, storage medium and electronic equipment

Abstract

The invention discloses a sensitive data decryption method, which is applied to first electronic equipment, and comprises the following steps: obtaining a ciphertext of sensitive data of an application program and a first public key of the application program, the ciphertext of the sensitive data being obtained by encrypting the sensitive data of the application program by using a first target key, the first target key is obtained by calculating a second public key of the first electronic equipment and first private keys of application programs based on a preset key algorithm, and each application program comprises different first private keys and corresponding first public keys; according to a second private key preset by the first electronic equipment and a first public key of the application program, a second target key is obtained through calculation based on a preset key algorithm; and decrypting the ciphertext of the sensitive data by using the second target key to obtain a plaintext of the sensitive data. According to the embodiment of the invention, the security of the sensitive data can be improved.

Description

Technical Field

[0001] The present application belongs to the field of data technology, and in particular, relates to a method, device, storage medium and electronic device for decrypting and encrypting sensitive data. Background Art

[0002] When an application is launched, there may be some sensitive data, such as private algorithm models, authentication passwords of remote service interfaces, etc. In order to protect these sensitive data, a preset group key is generally used to encrypt the sensitive data, and the ciphertext of the sensitive data is obtained and stored in the application's installation package. The electronic device downloads the application's installation package, obtains the ciphertext of the sensitive data, and uses the preset group key to decrypt the encrypted sensitive data to obtain the decrypted sensitive data. In related technologies, if the group key of the electronic device is leaked, the attacker can obtain the application's installation package and decrypt the ciphertext of the sensitive data using the group key, resulting in the leakage of sensitive data. Therefore, the security of sensitive data is relatively low. Summary of the invention

[0003] The embodiments of the present application provide a method, device, storage medium, and electronic device for decrypting sensitive data, which can improve the security of sensitive data.

[0004] In a first aspect, an embodiment of the present application provides a method for decrypting sensitive data, which is applied to a first electronic device, and the method includes:

[0005] Obtaining a ciphertext of sensitive data of an application and a first public key of the application, wherein the ciphertext of the sensitive data is obtained by encrypting the sensitive data of the application using a first target key, wherein the first target key is calculated based on a preset key algorithm using a second public key of the first electronic device and a first private key of the application, wherein each application includes a different first private key and a corresponding first public key;

[0006] Obtaining a second target key by calculating based on the preset key algorithm according to the second private key preset by the first electronic device and the first public key of the application;

[0007] The second target key is used to decrypt the ciphertext of the sensitive data to obtain the plaintext of the sensitive data.

[0008] In a second aspect, an embodiment of the present application provides a method for encrypting sensitive data, which is applied to a second electronic device, and an application is developed on the second electronic device, the method comprising:

[0009] Generate a first private key and a corresponding first public key based on the application, where different applications include different first private keys and corresponding first public keys;

[0010] Obtaining a second public key of the first electronic device;

[0011] Obtaining a first target key by calculating based on a preset key algorithm according to the first private key of the application and the second public key of the first electronic device;

[0012] The sensitive data is encrypted using the first target key to obtain the ciphertext of the sensitive data, so that the first electronic device obtains the ciphertext of the sensitive data of the application and the first public key of the application. The second target key is calculated based on the preset key algorithm according to the second private key preset by the first electronic device and the first public key of the application, and the ciphertext of the sensitive data is decrypted using the second target key to obtain the plaintext of the sensitive data.

[0013] In a third aspect, an embodiment of the present application further provides a sensitive data decryption device, which is applied to a first electronic device, and the device includes:

[0014] a first acquisition module, configured to acquire a ciphertext of sensitive data of an application and a first public key of the application, wherein the ciphertext of the sensitive data is obtained by encrypting the sensitive data of the application using a first target key, wherein the first target key is calculated based on a preset key algorithm using a second public key of the first electronic device and a first private key of the application, wherein each application includes a different first private key and a corresponding first public key;

[0015] A first calculation module, configured to calculate a second target key based on the preset key algorithm according to a second private key preset by the first electronic device and a first public key of the application;

[0016] A decryption module is used to use the second target key to decrypt the ciphertext of the sensitive data to obtain the plaintext of the sensitive data.

[0017] In a fourth aspect, an embodiment of the present application further provides a sensitive data encryption device, which is applied to a second electronic device, and encrypts the sensitive data of the application program in the second electronic device, the device comprising:

[0018] A generating module, configured to generate a first private key and a corresponding first public key based on the application, wherein different applications include different first private keys and corresponding first public keys;

[0019] A second acquisition module, used to acquire a second public key of the first electronic device;

[0020] A second calculation module, configured to calculate a first target key based on a preset key algorithm according to the first private key of the application and the second public key of the first electronic device;

[0021] An encryption module is used to encrypt sensitive data using the first target key to obtain ciphertext of the sensitive data, so that the first electronic device obtains the ciphertext of the sensitive data of the application and the first public key of the application, calculates the second target key based on the preset key algorithm according to the second private key preset by the first electronic device and the first public key of the application, and uses the second target key to decrypt the ciphertext of the sensitive data to obtain the plaintext of the sensitive data.

[0022] In a fifth aspect, an embodiment of the present application further provides a computer-readable storage medium on which a computer program is stored. When the computer program runs on a computer, the computer executes a sensitive data decryption method or a sensitive data encryption method as provided in any embodiment of the present application.

[0023] In a sixth aspect, an embodiment of the present application further provides an electronic device, comprising a processor and a memory, wherein the memory has a computer program, and the processor calls the computer program to execute a method for decrypting sensitive data as provided in any embodiment of the present application or a method for encrypting sensitive data as provided in any embodiment.

[0024] In the seventh aspect, the sensitive data encryption and decryption system provided in the embodiment of the present application includes a first electronic device and a second electronic device, the first electronic device includes the sensitive data decryption device described in the third aspect; the second electronic device includes the sensitive data encryption device described in the fourth aspect.

[0025] In the embodiment of the present application, since the first target key used to encrypt the sensitive data is calculated based on the pre-negotiated preset key algorithm by the second public key of the first electronic device and the first public key of the application, rather than being obtained only based on the second public key of the first electronic device, even if the first private key of the first electronic device is accidentally leaked, since the attacker has not obtained the second public key and / or the preset key algorithm of the application, it is impossible to reversely analyze the installation package of the application by using the first private key of the electronic device to decrypt the ciphertext of the sensitive data and obtain the plaintext of the sensitive data, thereby improving the security of the sensitive data. Moreover, each application has its own dedicated first public key and first private key, and each application uses its own first private key and the second public key of the first electronic device to calculate the first target key based on the preset key algorithm to encrypt the sensitive data. When the first electronic device initializes the application, it needs to use the first public key corresponding to the application and the second private key of the first electronic device, and calculate the second target key based on the preset key algorithm. Therefore, even if the attacker steals the first public key of an application on the first electronic device, it cannot use the first public key of this application to decrypt the ciphertext of sensitive data of other applications, thereby further reducing the risk of sensitive data leakage and improving the security of sensitive data. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The technical solution and beneficial effects of the present application will be made apparent by describing in detail the specific implementation methods of the present application in conjunction with the accompanying drawings.

[0027] Figure 1 This is a first flow chart of the sensitive data decryption method provided in an embodiment of the present application.

[0028] Figure 2 This is a second flow chart of the sensitive data decryption method provided in an embodiment of the present application.

[0029] Figure 3 A flowchart of a method for encrypting sensitive data provided in an embodiment of the present application.

[0030] Figure 4 A schematic diagram of an interaction scenario between a first electronic device and a second electronic device provided in an embodiment of the present application.

[0031] Figure 5 A schematic diagram of the structure of a sensitive data decryption device provided in an embodiment of the present application.

[0032] Figure 6 A schematic diagram of the structure of a sensitive data encryption device provided in an embodiment of the present application.

[0033] Figure 7A first structural schematic diagram of an electronic device provided in an embodiment of the present application.

[0034] Figure 8 A second structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0035] Please refer to the drawings, where the same component symbols represent the same components. The principle of the present application is illustrated by implementing it in an appropriate computing environment. The following description is based on the illustrated specific embodiments of the present application, which should not be considered as limiting other specific embodiments of the present application that are not described in detail herein.

[0036] See also Figure 1 , Figure 1 This is a first flow chart of a sensitive data decryption method provided in an embodiment of the present application. This embodiment of the present application provides a sensitive data decryption method, which is applied to a first electronic device, such as a smart phone, a tablet computer, a PDA, a laptop computer, or a desktop computer. The sensitive data decryption method may include the following steps:

[0037] In 101, a ciphertext of sensitive data of an application and a first public key of the application are obtained, wherein the ciphertext of the sensitive data is obtained by encrypting the sensitive data of the application using a first target key, and the target key is calculated based on a preset key algorithm using a second public key of the first electronic device and a first private key of the application, wherein each application includes a different first private key and a corresponding first public key;

[0038] In 102, a second target key is calculated based on a preset key algorithm according to a second private key preset in the first electronic device and a first public key of the application program;

[0039] In 103, the ciphertext of the sensitive data is decrypted using the second target key to obtain the plaintext of the sensitive data.

[0040] The first electronic device is pre-installed with a group key when leaving the factory, and one or more models of electronic devices can share the same group key, wherein the group key can be a symmetric key or a public-private key pair. The following embodiments are described using the group key being a public-private key pair as an example, that is, the first electronic device is pre-installed with a second private key and a corresponding second public key when leaving the factory, and the second private key and the second public key are used in pairs, wherein the first electronic device stores the second private key, and the manufacturer of the first electronic device can record the corresponding second public key.

[0041] During the development process of an application, there may be some sensitive data, such as private algorithm models, authentication passwords for remote service interfaces, etc. To protect these sensitive data, the application developer can obtain the second public key in the first electronic device group key. For example, the application developer can obtain the second public key from the manufacturer of the first electronic device, use the second public key to encrypt the sensitive data, obtain the ciphertext of the sensitive data, and store it in the installation package of the application. The first electronic device downloads the installation package of the application, and can use the preset second private key to decrypt the ciphertext of the sensitive data in the installation package to obtain the plaintext of the sensitive data, so as to use the plaintext of the sensitive data to complete the initialization operation of the application. However, in the related art, if the second private key of the first electronic device is leaked, the attacker can obtain the installation package of the application and use the second private key to decrypt the ciphertext of the sensitive data, which makes the sensitive data easy to leak, so the security of the sensitive data is low.

[0042] In an embodiment of the present application, the ciphertext of the sensitive data of the application and the first public key of the application are obtained, the ciphertext of the sensitive data is encrypted by the first target key, and the first target key is calculated by the second public key of the first electronic device and the first private key of the application based on a preset key algorithm, wherein each application includes a different first private key and a corresponding first public key, that is, in an embodiment of the present application, during the development of the application, a special first public key and a corresponding first private key can be randomly generated for each application. Each application includes a different first private key and a corresponding first public key.

[0043] When the developer of an application needs to encrypt sensitive data, it can obtain the second public key of the first electronic device from the manufacturer of the first electronic device, and calculate the first target key based on the second public key of the first electronic device and the first private key of the application based on a preset key algorithm, and then use the first target key to encrypt the sensitive data of the application to obtain the ciphertext of the sensitive data.

[0044] After the application is developed, a corresponding installation package will be generated, and the ciphertext of the sensitive data of the application and the first public key of the application can be stored in the installation package.

[0045] The first electronic device obtains the installation package of the application and installs the application. When initializing the application, the ciphertext of the sensitive data needs to be decrypted. The embodiment of the present application can calculate the second target key based on the preset key algorithm according to the second private key preset by the first electronic device and the first public key of the application, and use the second target key to decrypt the encrypted sensitive data to obtain the decrypted sensitive data. The first target key and the second target key can be symmetric keys.

[0046] In an embodiment of the present application, when encrypting sensitive data, the developer of the application does not use only the second public key of the electronic device for encryption, but uses the target key calculated by the second public key of the electronic device and the first private key of the application to encrypt the sensitive data, and when calculating the first target key, the developer of the application and the manufacturer of the first electronic device can determine different preset key algorithms through negotiation, and different preset key algorithms can generate different first target keys. Exemplarily, the preset key algorithm may include a key negotiation algorithm and a key derivation algorithm, and obtain a shared secret value based on the key negotiation algorithm according to the second public key of the first electronic device and the first private key of the application, and derive the shared secret value based on the key derivation algorithm to obtain the target key. Among them, the key negotiation algorithm can be flexibly selected, such as using the international standard ECDH, and the key derivation function can be flexibly selected, such as using the international standard HKDF, which is not limited in this application.

[0047] Correspondingly, when the first electronic device decrypts the ciphertext of sensitive data, it cannot decrypt only through the second private key of the first electronic device, but needs to use the second private key and the first public key of the application, based on a preset key algorithm, to jointly calculate to obtain the second target key, and then use the second target key to decrypt the ciphertext of the sensitive data.

[0048] It can be understood that when the first electronic device decrypts the ciphertext of sensitive data, the second target key used is calculated based on the first private key of the first electronic device and the second public key of the application program based on a pre-negotiated preset key algorithm, rather than being obtained solely based on the first private key of the first electronic device. Therefore, even if the first private key of the first electronic device is accidentally leaked, the attacker cannot simultaneously obtain the second public key and / or the preset key algorithm of the application program, and therefore cannot decrypt the ciphertext of the sensitive data through the first private key, and cannot obtain the plaintext of the sensitive data, thereby improving the security of the sensitive data.

[0049] Moreover, since each application includes a different first private key and a corresponding first public key, that is, each application has its own dedicated first public key and first private key, each application uses its own first private key and the second public key of the first electronic device to calculate the first target key based on the preset key algorithm to encrypt sensitive data. When the first electronic device initializes the application, it needs to use the first public key corresponding to the application and the second private key of the first electronic device, and calculate the target key based on the preset key algorithm. Therefore, even if an attacker steals the first public key of an application on the first electronic device, he cannot use the first public key of this application to decrypt the ciphertext of sensitive data of other applications, thereby further reducing the risk of sensitive data leakage and improving the security of sensitive data.

[0050] See also Figure 2 , Figure 2 This is a second flow chart of the sensitive data decryption method provided in the embodiment of the present application. The embodiment of the present application provides a sensitive data decryption method, which is applied to an electronic device. The method may include the following steps:

[0051] In 201, the ciphertext of the sensitive data of the application and the first public key of the application are obtained, the ciphertext of the sensitive data is obtained by encrypting the sensitive data of the application using the first target key, and the first target key is calculated by the second public key of the first electronic device and the first private key of the application based on a preset key algorithm, wherein each application includes a different first private key and a corresponding first public key.

[0052] The first electronic device is pre-installed with a group key, namely, a second private key and a corresponding second public key when leaving the factory. The second private key and the second public key are used in pairs. The first electronic device stores the second private key, and the manufacturer of the first electronic device can record the corresponding second public key.

[0053] In the embodiment of the present application, during the development of the application, a dedicated first public key and a corresponding first private key may be randomly generated for each application. Each application includes a different first private key and a corresponding first public key.

[0054] During the development of an application, there may be some sensitive data, such as private algorithm models, authentication passwords for remote service interfaces, etc. To protect these sensitive data, the application developer needs to encrypt the sensitive data. Specifically, the application developer can obtain the second public key of the electronic device. For example, the application developer can obtain the second public key from the manufacturer of the first electronic device, and calculate the first target key based on the second public key and the first private key of the application based on the preset key algorithm, and use the first target key to encrypt the sensitive data to obtain the ciphertext of the sensitive data.

[0055] After the application is developed, an installation package will be generated. The first electronic device can download the installation package of the application. In one embodiment, the installation package includes the ciphertext of the application's sensitive data, the first public key of the application, the first package name of the application, and the application developer certificate. Among them, the first package name of the application and the developer certificate can be considered as the identity information of the application. In the embodiment of the present application, the first electronic device can obtain the ciphertext of the application's sensitive data and the second public key of the application from the installation package.

[0056] In one embodiment, when installing an application, the first electronic device may first perform an integrity check on the installation package to confirm whether the contents of the application installation package have not been tampered with by an attacker. If the integrity check passes, it can be explained that the ciphertext of the sensitive data corresponding to the application in the installation package, the first public key, the first package name, and the developer certificate have not been tampered with, and the developer certificate, the ciphertext of the sensitive data, and the first package name in the installation package are all interrelated and have not been tampered with or replaced.

[0057] After the installation package of the application passes the integrity check, the first electronic device can execute the installation process of the installation package, and the application management module of the first electronic device will record and maintain the first package names corresponding to all installed applications, and the first certificate hash value of the developer certificate; it should be noted that although the installation package contains the developer certificate, after the installation is complete, the first certificate hash value of the developer certificate can be calculated based on the developer certificate and stored in the application management module. If the installation package of the application does not pass the integrity check, it means that the installation package has been tampered with, and the application will not be installed.

[0058] In 202, a first package name of the application and a first certificate hash value of the application developer certificate are obtained;

[0059] In 203, it is determined whether the first package name and the first certificate hash value corresponding to the application are recorded in the whitelist of the first electronic device;

[0060] In 204, if the first package name and the first certificate hash value corresponding to the application are recorded in the whitelist, a public key hash value of the first public key is calculated based on a preset hash algorithm according to the first public key of the application;

[0061] In 205, it is determined whether the first public key hash value matches the public key hash value of the application recorded in the whitelist;

[0062] In 206, if the first public key hash value matches the public key hash value of the application recorded in the whitelist, the encryption and decryption interface of the first electronic device is called to calculate the second target key based on the preset key algorithm according to the second private key of the first electronic device and the first public key of the application;

[0063] In 207, the ciphertext of the sensitive data is decrypted using the second target key to obtain the plaintext of the sensitive data.

[0064] Exemplarily, during the development stage, each application will obtain the calling permission of the encryption and decryption interface of the first electronic device from the manufacturer of the first electronic device, and submit the package name (APP_pkg) of the application and the certificate hash value (APP_cert_hash) of the application developer certificate. The electronic device will set a whitelist in the group key management module, which records the package name (APP_pkg) and certificate hash value (APP_cert_hash) corresponding to the application that has obtained the calling permission of the encryption and decryption interface encFunction2(). It should be noted that the package name (APP_pkg) and certificate hash value (APP_cert_hash) of the application recorded in the whitelist are related to each other.

[0065] When an application is installed on the first electronic device and initialized, it is necessary to decrypt the ciphertext of sensitive data. The encryption and decryption interface encFunction2() of the first electronic device needs to be called, and the corresponding ciphertext of the sensitive data (data_cipher) and the first public key (APP_pubKey_1) are passed as parameters to the encryption and decryption interface encFunction2(), requesting the encryption and decryption interface to decrypt the ciphertext of the sensitive data, for example: encFunction2(data_cipher, APP_pubKey_1).

[0066] In response to the calling behavior of the application calling the encryption and decryption interface, the first electronic device can obtain the first package name of the application and the first certificate hash value of the application developer certificate. Exemplarily, when application 1 calls the encryption and decryption interface, the group key management module of the first electronic device can obtain the first package name of application 1 that currently calls the encryption and decryption interface. The first package name is, for example, APP_pkg_1. Since the application management module records the first package names of all installed applications and the corresponding first certificate hash values, the group key management module can query the application management module for the first hash value of the developer's certificate corresponding to APP_pkg_1, such as: APP_cert_hash_1.

[0067] The embodiment of the present application will determine whether the first package name and the first certificate hash value corresponding to the application are recorded in the whitelist of the first electronic device. Exemplarily, the first package name of application 1 and the corresponding first certificate hash value can be matched with the whitelist to determine whether the first package name and the first certificate hash value corresponding to application 1 are recorded in the whitelist of the first electronic device. It can be understood that the combination of the first package name and the first certificate hash value corresponding to application 1 can be considered as the identity information of application 1. If the first package name of application 1 and the corresponding first certificate hash value are recorded in the whitelist, it means that application 1 has the authority to call the encryption and decryption interface.

[0068] Furthermore, if the first package name and the first certificate hash value corresponding to the application are recorded in the whitelist, the public key hash value of the first public key is calculated based on the first public key of the application and based on a preset hash algorithm; it is determined whether the first public key hash value matches the public key hash value of the application recorded in the whitelist; if the first public key hash value matches the public key hash value of the application recorded in the whitelist, the encryption and decryption interface of the first electronic device is called.

[0069] For example, during the development stage of an application, when the application developer negotiates with the first electronic device manufacturer on a preset key algorithm, it can also negotiate on a preset hash algorithm for the first public key, and calculate the public key hash value of the first public key based on the preset hash algorithm, submit the public key hash value of the application, and save it in the whitelist of the group key management module. Therefore, the whitelist records multiple applications with encryption and decryption call permissions, as well as the package name, certificate hash value, and public key hash value corresponding to each application, and the three parameters of each application's package name, certificate hash value, and public key hash value are interrelated, and these three parameters are different for each application.

[0070] Exemplarily, when application 1 calls the encryption and decryption interface, it will also pass the first public key (APP_pubKey_1) of application 1 to the encryption and decryption interface. The encryption and decryption interface obtains the first public key hash value (APP_pubKey_hash_1) of the first public key (APP_pubKey_1) based on a preset hash algorithm.

[0071] In the embodiment of the present application, after judging that the application 1 has the authority to call the encryption and decryption interface of the first electronic device according to the identity information of the application 1, the first public key hash value (APP_pubKey_hash_1) of the application 1 can be further matched with the whitelist to determine whether the first public key hash value (APP_pubKey_hash_1) matches the public key hash value (APP_pubKey_hash) of the application 1 recorded in the whitelist. If they match, it means that the application 1 calling the encryption and decryption interface is using its corresponding first public key to request the decryption of the ciphertext of the sensitive data, so the encryption and decryption interface of the first electronic device can be successfully called to calculate the second target key based on the preset key algorithm according to the second private key of the first electronic device and the first public key of the application, and use the second target key to decrypt the ciphertext of the sensitive data to obtain the plaintext of the sensitive data and complete the initialization operation of the application. Among them, the first target key and the second target key can be symmetric keys.

[0072] If there is no match, it means that the application 1 that calls the encryption and decryption interface is not using its corresponding first public key to request decryption of the ciphertext of the sensitive data corresponding to application 1. The application may try to use the first public key of other applications to decrypt the ciphertext of sensitive data of other applications. In this case, a log is recorded and a security analysis is performed later. The encryption and decryption interface cannot be called to decrypt the ciphertext of the sensitive data, and the plaintext of the sensitive data cannot be obtained, thereby improving the security of the sensitive data.

[0073] It can be understood that in the embodiment of the present application, when encrypting sensitive data, the developer of the application does not use only the second public key of the electronic device for encryption, but uses the second public key of the electronic device and the first private key of the application to encrypt the sensitive data based on the first target key calculated by the preset key algorithm. Correspondingly, when the first electronic device decrypts the ciphertext of the sensitive data, the second target key used is calculated by the first private key of the first electronic device and the second public key of the application based on the pre-negotiated preset key algorithm, rather than being obtained solely based on the first private key of the first electronic device. Therefore, even if the first private key of the first electronic device is accidentally leaked, since the attacker does not obtain the second public key and / or the preset key algorithm of the application at the same time, he cannot use the first private key of the electronic device to reverse analyze the installation package of the application, decrypt the ciphertext of the sensitive data, and cannot obtain the plaintext of the sensitive data, thereby improving the security of the sensitive data.

[0074] Moreover, in the embodiment of the present application, since each application includes a different first private key and a corresponding first public key, that is, each application has its own dedicated first public key and first private key, each application uses its own first private key and the second public key of the first electronic device to calculate the target key based on a preset key algorithm to encrypt the sensitive data and obtain the ciphertext of the sensitive data corresponding to the application. When the first electronic device decrypts the ciphertext of the sensitive data of an application, it also needs to use the first public key corresponding to the application and the second private key of the first electronic device, and calculate the second target key based on the preset key algorithm. Therefore, the application cannot use its own first public key to call the encryption and decryption interface to decrypt the ciphertext of sensitive data of other applications, which reduces the risk of sensitive data leakage and improves the security of sensitive data.

[0075] Further, in the embodiment of the present application, the whitelist of the first electronic device records multiple applications with encryption and decryption calling authority, as well as the package name, certificate hash value and public key hash value corresponding to each application, and these three parameters are different for each application. When the application calls the encryption and decryption interface of the first electronic device, the encryption and decryption interface will be successfully called only if the package name, certificate hash value and public key hash value of the application match the whitelist. For example, when application 1 calls the encryption and decryption interface to decrypt sensitive data, only the first package name and the first certificate hash value of application 1 match the whitelist, indicating that application 1 has the authority to call the encryption and decryption interface. Further, the first public key hash value of application 1 also needs to match the whitelist, indicating that application 1 uses its own corresponding first public key to request to decrypt the ciphertext of sensitive data. The encryption and decryption interface will calculate the second target key based on the preset key algorithm according to the second private key of the first electronic device and the first public key of the application, and decrypt the ciphertext of the sensitive data of application 1.

[0076] It should be noted that the whitelist records multiple applications with encryption and decryption calling permissions. For example, application 1 and application 2 both have encryption and decryption calling permissions, then the first package name and the first certificate hash value corresponding to application 1 and application 2 both match the whitelist. However, since the embodiment of the present application will also verify the first public key hash value of the application according to the whitelist, and the first public key hash value of the application is interrelated with the package name and the certificate hash value, application 2 can only use its corresponding first public key hash value to call the encryption and decryption interface to decrypt the ciphertext of the sensitive data of application 2, but cannot use its corresponding first public key hash value to call the encryption and decryption interface to decrypt the ciphertext of the sensitive data of application 1, thereby avoiding the situation where the application on the same first electronic device cannot successfully call the encryption and decryption interface to decrypt the ciphertext of the sensitive data of other applications even if it has the calling permission of the encryption and decryption interface; moreover, even if the application obtains the first public key hash value of other applications through reverse analysis or the like, it cannot impersonate the package name and certificate hash value of other applications, and therefore cannot successfully call the encryption and decryption interface to decrypt the ciphertext of the sensitive data of other applications, thereby further reducing the risk of sensitive data leakage and improving the security of sensitive data.

[0077] See also Figure 3 , Figure 3 A flow chart of a method for encrypting sensitive data provided in an embodiment of the present application, wherein the method for decrypting sensitive data can be applied to a second electronic device, wherein an application is developed on the second electronic device, that is, the second electronic device can be a development end of the application, and the second electronic device can be a server, computer, mobile phone or other device, which is not limited in the present application.

[0078] In 301, a first private key and a corresponding first public key are generated based on an application, and different applications include different first private keys and corresponding first public keys;

[0079] In 302, a second public key of the first electronic device is obtained;

[0080] In 303, a first target key is calculated based on a preset key algorithm according to the first private key of the application and the second public key of the first electronic device;

[0081] In 304, the sensitive data is encrypted using the first target key to obtain the ciphertext of the sensitive data, so that the first electronic device obtains the ciphertext of the sensitive data of the application and the first public key of the application, and the second target key is calculated based on the preset key algorithm according to the second private key preset by the first electronic device and the first public key of the application, and the ciphertext of the sensitive data is decrypted using the second target key to obtain the plaintext of the sensitive data. The first target key and the second target key may be symmetric keys.

[0082] In the embodiment of the present application, during the development of the application, a dedicated first public key and a corresponding first private key may be randomly generated for each application. Each application includes a different first private key and a corresponding first public key.

[0083] The first electronic device will be pre-installed with a group key when leaving the factory. The following embodiments are described using a public-private key pair as an example. That is, the first electronic device is pre-installed with a second private key and a corresponding second public key when leaving the factory. The second private key and the second public key are used in pairs, wherein the first electronic device stores the second private key, and the manufacturer of the first electronic device can record the corresponding second public key.

[0084] There may be some sensitive data in the process of application development, such as private algorithm models, authentication passwords of remote service interfaces, etc. To protect these sensitive data, the development end of the application can encrypt the sensitive data. Specifically, the development end of the application can obtain the second public key of the electronic device. For example, the development end of the application can obtain the second public key from the manufacturer of the first electronic device, and use the second public key and the first private key of the application to calculate the first target key based on the preset key algorithm, and use the first target key to encrypt the sensitive data to obtain the ciphertext of the sensitive data.

[0085] In one implementation, the second electronic device, as the development end of the application, obtains permission to call the encryption and decryption interface of the first electronic device so that the first package name, first certificate hash value, and first public key hash value corresponding to the application are recorded in the whitelist.

[0086] Exemplarily, when an application is in the development stage, the developer of the application will obtain the permission to call the encryption and decryption interface of the first electronic device from the manufacturer of the first electronic device, and submit the package name of the application, the certificate hash value of the application developer certificate, and the hash value of the first public key of the application. The electronic device will set up a whitelist in the group key management module, which records multiple applications that have obtained the permission to call the encryption and decryption interface, as well as the package name, certificate hash value, and first public key hash value corresponding to each application. It should be noted that the package name, certificate hash value, and first public key hash value of the application recorded in the whitelist are interrelated, and these three parameters are different for each application.

[0087] After the application development is completed, an installation package will be generated, and the first electronic device can download the installation package of the application. In one embodiment, the application development end can store the encrypted sensitive data, the first public key of the application, the first package name of the application, and the application developer certificate in the installation package of the corresponding application, so that the first electronic device can obtain the installation package to install the application according to the installation package.

[0088] It can be understood that since the first target key used to encrypt the sensitive data is calculated by the second public key of the first electronic device and the first public key of the application based on a pre-negotiated preset key algorithm, rather than being obtained solely based on the second public key of the first electronic device, even if the first private key of the first electronic device is accidentally leaked, since the attacker cannot simultaneously obtain the second public key and / or preset key algorithm of the application, he cannot use the first private key of the electronic device to reverse analyze the installation package of the application and decrypt the ciphertext of the sensitive data, and cannot obtain the plaintext of the sensitive data, thereby improving the security of the sensitive data.

[0089] Moreover, in the embodiment of the present application, during the development process of the application, the preset key algorithm will be negotiated with the manufacturer of the electronic device, and an application will be made to obtain the second public key of the first electronic device. Therefore, at the application development end, the sensitive data can be encrypted according to the second public key and the first private key of the application to obtain the ciphertext of the sensitive data, and then the ciphertext of the sensitive data is stored in the installation package. The first electronic device can obtain the ciphertext of the sensitive data by downloading the installation package, without having to transmit the sensitive data directly to the manufacturer of the first electronic device for encryption, thereby avoiding the direct transmission of sensitive data, reducing the possibility of data leakage during data transmission, and improving the security of sensitive data.

[0090] See also Figure 4 , Figure 4 A schematic diagram of an interaction scenario between a first electronic device and a second electronic device provided in an embodiment of the present application.

[0091] During the development of the application, a dedicated first public key and a first private key are randomly generated for each application. The first electronic device is also preset with a second private key and a corresponding second public key when it leaves the factory, wherein the first electronic device stores the second private key, and the manufacturer of the first electronic device can record the corresponding second public key.

[0092] The second electronic device, as the development end of the application, needs to encrypt sensitive data of the application, such as private algorithm models, authentication passwords of remote service interfaces, etc., to protect these sensitive data.

[0093] The application developer can apply to the manufacturer of the first electronic device for permission to call the encryption and decryption interface of the first electronic device, and submit the package name of the application, the certificate hash value of the application developer certificate, and the hash value of the application public key. The whitelist of the first electronic device will record multiple applications that have obtained permission to call the encryption and decryption interface, as well as the package name, certificate hash value, and public key hash value corresponding to each application. It should be noted that the three parameters of the application package name, certificate hash value, and public key hash value recorded in the whitelist are interrelated, and these three parameters are different for each application.

[0094] The application development end can also apply to the manufacturer of the first electronic device to obtain the second public key of the first electronic device, and obtain the preset key algorithm and the preset hash algorithm for the second public key from the manufacturer of the first electronic device. According to the first private key of the application and the second public key of the electronic device, the first target key is calculated based on the preset key algorithm. Exemplarily, the preset key algorithm may include a key negotiation algorithm and a key derivation algorithm. Then, according to the second public key of the first electronic device and the first private key of the application, a shared secret value can be obtained based on the key negotiation algorithm, and the shared secret value is key-derived based on the key derivation algorithm to obtain the target key, wherein the key negotiation algorithm can be flexibly selected, such as using the international standard ECDH, and the key derivation function can also be flexibly selected, such as using the international standard HKDF. After obtaining the target key, the application development end can use the target key to encrypt sensitive data to obtain the ciphertext of the sensitive data, wherein the encryption algorithm can be flexibly selected, such as using the international standard RSA algorithm.

[0095] After the application is developed, an installation package will be generated. The application developer can store the ciphertext of the application's sensitive data, the application's first public key, the application's first package name, and the developer certificate in the installation package of the corresponding application.

[0096] The first electronic device can download the installation package of the application and obtain the ciphertext of the sensitive data of the application and the first public key of the application from the installation package. When installing the application, the first electronic device can first perform an integrity check on the installation package to confirm whether the content of the application installation package has not been tampered with by an attacker. If the integrity check passes, it can be shown that the ciphertext of the sensitive data corresponding to the application in the installation package, the first public key, the first package name, and the developer certificate have not been modified.

[0097] After the installation package of the application passes the integrity check, the first electronic device can execute the installation process of the installation package, and the application management module of the first electronic device will record and maintain the first package names of all installed applications and the first certificate hash values ​​corresponding to the developer certificate.

[0098] The first electronic device obtains the first package name of the application and the first certificate hash value of the application developer certificate, and determines whether the first package name and the first certificate hash value corresponding to the application are recorded in the whitelist of the first electronic device; if so, the first public key hash value of the first public key is calculated based on the preset hash algorithm according to the first public key of the application, and it is determined whether the first public key hash value matches the public key hash value of the application recorded in the whitelist; if so, the encryption and decryption interface of the first electronic device is successfully called to calculate the target key based on the preset key algorithm according to the second private key of the first electronic device and the first public key of the application.

[0099] It can be understood that in the embodiment of the present application, when encrypting sensitive data, the developer of the application does not use only the second public key of the electronic device for encryption, but uses the second public key of the electronic device and the first private key of the application to encrypt the sensitive data based on the first target key calculated by the preset key algorithm. Correspondingly, when the first electronic device decrypts the ciphertext of the sensitive data, the second target key used is calculated by the first private key of the first electronic device and the second public key of the application based on the pre-negotiated preset key algorithm, rather than being obtained solely based on the first private key of the first electronic device. Therefore, even if the first private key of the first electronic device is accidentally leaked, since the attacker does not obtain the second public key and / or the preset key algorithm of the application at the same time, he cannot use the first private key of the electronic device to reverse analyze the installation package of the application, decrypt the ciphertext of the sensitive data, and cannot obtain the plaintext of the sensitive data, thereby improving the security of the sensitive data.

[0100] Furthermore, in the embodiment of the present application, the whitelist of the first electronic device records multiple applications with encryption and decryption calling permissions, as well as the package name, certificate hash value and public key hash value corresponding to each application, and the first public key hash value of the application is interrelated with the package name and certificate hash value, and these three parameters are different for each application. When the application calls the encryption and decryption interface of the first electronic device, the encryption and decryption interface will be successfully called only if the package name, certificate hash value and public key hash value of the application match the whitelist. This avoids the situation where the application on the same first electronic device cannot successfully call the encryption and decryption interface to decrypt the ciphertext of sensitive data of other applications even if it has the calling permission of the encryption and decryption interface; and even if the application obtains the first public key hash value of other applications through reverse analysis or the like, it cannot successfully call the encryption and decryption interface to decrypt the ciphertext of sensitive data of other applications because it cannot forge the package name and certificate hash value of other applications, thereby further reducing the risk of sensitive data leakage and improving the security of sensitive data.

[0101] See also Figure 5 , Figure 5 The structure diagram of the sensitive data decryption device provided in the embodiment of the present application is as follows: wherein the sensitive data decryption device 400 is applied to a first electronic device, and the sensitive data decryption device 400 includes a first acquisition module 401, a first calculation module 402 and a decryption module 403, as follows:

[0102] A first acquisition module 401 is used to acquire a ciphertext of sensitive data of an application and a first public key of the application, wherein the ciphertext of the sensitive data is obtained by encrypting the sensitive data of the application using a first target key, and the first target key is calculated based on a preset key algorithm using a second public key of the first electronic device and a first private key of the application, wherein each application includes a different first private key and a corresponding first public key;

[0103] A first calculation module 402 is used to calculate a second target key based on a preset key algorithm according to a second private key preset in the first electronic device and a first public key of the application program;

[0104] The decryption module 403 is used to decrypt the ciphertext of the sensitive data using the second target key to obtain the plaintext of the sensitive data.

[0105] In one embodiment, the first computing module 402 can be used to: obtain the first package name of the application and the first certificate hash value of the application developer certificate; determine whether the first package name and the first certificate hash value corresponding to the application are recorded in the whitelist of the first electronic device; if the first package name and the first certificate hash value corresponding to the application are recorded in the whitelist, calling the encryption and decryption interface of the first electronic device to calculate the second target key based on a preset key algorithm according to the second private key of the first electronic device and the first public key of the application.

[0106] In one embodiment, the first calculation module 402 can be used to: calculate a first public key hash value of the first public key based on a preset hash algorithm according to the first public key of the application; determine whether the first public key hash value matches the public key hash value of the application recorded in the whitelist; if the first public key hash value matches the public key hash value of the application recorded in the whitelist, call the encryption and decryption interface of the first electronic device to calculate a second target key based on a preset key algorithm according to the second private key of the first electronic device and the first public key of the application.

[0107] In one implementation, the first acquisition module 401 may be used to: acquire an installation package of an application and install it, wherein the installation package includes ciphertext of sensitive data corresponding to the application, a first public key, a first package name, and an application developer certificate.

[0108] See also Figure 6 , Figure 6 A schematic diagram of the structure of a sensitive data encryption device provided in an embodiment of the present application, wherein the sensitive data decryption and encryption 500 is applied to a second electronic device, and an application is developed on the second electronic device. The sensitive data encryption device 500 includes a generation module 501, a second acquisition module 502, a second calculation module 503, and an encryption module 403, as follows:

[0109] A generating module 501, configured to generate a first private key and a corresponding first public key based on an application, wherein different applications include different first private keys and corresponding first public keys;

[0110] A second acquisition module 502, configured to acquire a second public key of the first electronic device;

[0111] A second calculation module 503 is used to calculate a first target key based on a preset key algorithm according to the first private key of the application and the second public key of the first electronic device;

[0112] The encryption module 504 is used to encrypt the sensitive data using the first target key to obtain the ciphertext of the sensitive data, so that the first electronic device obtains the ciphertext of the sensitive data of the application and the first public key of the application, and calculates the second target key based on the preset key algorithm according to the second private key preset by the first electronic device and the first public key of the application, and uses the second target key to decrypt the ciphertext of the sensitive data to obtain the plaintext of the sensitive data.

[0113] In one embodiment, the encryption module 504 can be used to store the ciphertext of the application's sensitive data, the application's first public key, the application's first package name, and the developer certificate in the installation package of the corresponding application, so that the first electronic device can obtain the installation package and install the application according to the installation package.

[0114] In one embodiment, the second acquisition module 502 can be used to obtain permission to call the encryption and decryption interface of the first electronic device, so that the first package name corresponding to the application, the first certificate hash value of the developer certificate, and the hash value of the first public key are recorded in the whitelist of the first electronic device.

[0115] An embodiment of the present application provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed on a computer, the computer executes the process in the sensitive data decryption method provided in this embodiment.

[0116] The present application also provides an electronic device. The electronic device may be a first electronic device or a second electronic device. Figure 7 , Figure 7The electronic device 600 includes a processor 601 and a memory 602. The processor 601 is electrically connected to the memory 602.

[0117] The processor 601 is the control center of the electronic device 600. It uses various interfaces and lines to connect various parts of the entire electronic device. It executes various functions of the electronic device and processes data by running or calling computer programs stored in the memory 602, and calling data stored in the memory 602, thereby monitoring the electronic device as a whole.

[0118] The memory 602 may be used to store computer programs and data. The computer programs stored in the memory 602 include instructions that can be executed in the processor. The computer programs may constitute various functional modules. The processor 601 executes various functional applications and data processing by calling the computer programs stored in the memory 602.

[0119] In this embodiment, when the electronic device 600 is a first electronic device, the processor 601 in the first electronic device will load instructions corresponding to one or more computer program processes into the memory 602 according to the following steps, and the processor 601 will run the computer program stored in the memory 602 to implement the function:

[0120] Obtaining a ciphertext of sensitive data of an application and a first public key of the application, wherein the ciphertext of the sensitive data is obtained by encrypting the sensitive data of the application using a first target key, and the first target key is calculated based on a preset key algorithm using a second public key of the first electronic device and a first private key of the application, wherein each application includes a different first private key and a corresponding first public key;

[0121] Obtaining a second target key by calculating based on a preset key algorithm according to a second private key preset in the first electronic device and a first public key of the application program;

[0122] The second target key is used to decrypt the ciphertext of the sensitive data to obtain the plaintext of the sensitive data.

[0123] In one implementation, the processor 601 may perform the following steps in obtaining the second target key by calculating the second private key of the first electronic device and the first public key of the application based on a preset key algorithm: obtaining the first package name of the application and the first certificate hash value of the application developer certificate;

[0124] Determine whether the first package name and the first certificate hash value corresponding to the application are recorded in the whitelist of the first electronic device;

[0125] If the first package name and the first certificate hash value corresponding to the application are recorded in the whitelist, the encryption and decryption interface of the first electronic device is called to calculate the second target key based on the preset key algorithm according to the second private key of the first electronic device and the first public key of the application.

[0126] In one embodiment, when calling the encryption and decryption interface of the first electronic device to calculate the second target key based on the second private key of the first electronic device and the first public key of the application program based on a preset key algorithm, the processor 601 can execute the following: calculating the first public key hash value of the first public key based on the preset hash algorithm based on the first public key of the application program; determining whether the first public key hash value matches the public key hash value of the application program recorded in the whitelist; if the first public key hash value matches the public key hash value of the application program recorded in the whitelist, calling the encryption and decryption interface of the first electronic device to calculate the second target key based on the preset key algorithm based on the second private key of the first electronic device and the first public key of the application program.

[0127] In one embodiment, before obtaining the encrypted sensitive data of the application and the first public key of the application, the processor 601 can execute: obtaining the installation package of the application and installing it, wherein the installation package includes the ciphertext of the sensitive data corresponding to the application, the first public key, the first package name, and the application developer certificate.

[0128] In this embodiment, when the electronic device 600 is a second electronic device, the processor 601 in the second electronic device will load instructions corresponding to one or more computer program processes into the memory 602 according to the following steps, and the processor 601 will run the computer program stored in the memory 602 to implement the function:

[0129] Generate a first private key and a corresponding first public key based on the application, where different applications include different first private keys and corresponding first public keys;

[0130] Obtaining a second public key of the first electronic device;

[0131] Obtaining a first target key by calculating based on a preset key algorithm according to a first private key of the application and a second public key of the first electronic device;

[0132] The sensitive data is encrypted using the first target key to obtain the ciphertext of the sensitive data, so that the first electronic device obtains the ciphertext of the sensitive data of the application and the first public key of the application. The second target key is calculated based on a preset key algorithm according to the second private key preset by the first electronic device and the first public key of the application, and the ciphertext of the sensitive data is decrypted using the second target key to obtain the plaintext of the sensitive data.

[0133] In one embodiment, after the processor 601 encrypts the sensitive data using the target key and obtains the ciphertext of the sensitive data, it can execute: storing the ciphertext of the sensitive data of the application, the first public key of the application, the first package name of the application, and the developer certificate in the installation package of the corresponding application, so that the first electronic device can obtain the installation package and install the application according to the installation package.

[0134] In one embodiment, before the processor 601 uses the first target key to encrypt the sensitive data and obtains the ciphertext of the sensitive data, it can execute the following: obtaining permission to call the encryption and decryption interface of the first electronic device, so that the first package name corresponding to the application, the first certificate hash value of the developer certificate, and the hash value of the first public key are recorded in the whitelist of the first electronic device.

[0135] See also Figure 8 , Figure 8 A second structural diagram of an electronic device provided in an embodiment of the present application. The electronic device 600 further includes: a radio frequency circuit 603, a display screen 604, a control circuit 605, an input unit 606, an audio circuit 607, a sensor 608, and a power supply 609. The processor 601 is electrically connected to the radio frequency circuit 603, the display screen 606, the control circuit 605, the input unit 606, the audio circuit 607, the sensor 608, and the power supply 609, respectively.

[0136] The radio frequency circuit 603 is used to send and receive radio frequency signals to communicate with network devices or other electronic devices through wireless communication.

[0137] The display screen 606 may be used to display information input by a user or information provided to a user and various graphical user interfaces of the electronic device. These graphical user interfaces may be composed of images, texts, icons, videos and any combination thereof.

[0138] The control circuit 605 is electrically connected to the display screen 604 and is used to control the display screen 604 to display information.

[0139] The input unit 606 can be used to receive input numbers, character information or user feature information (such as fingerprints), and generate keyboard, mouse, joystick, optical or trackball signal input related to user settings and function control. The input unit 606 can include a fingerprint recognition module.

[0140] The audio circuit 607 can provide an audio interface between the user and the electronic device through a speaker and a microphone. The audio circuit 607 includes a microphone. The microphone is electrically connected to the processor 601. The microphone is used to receive voice information input by the user.

[0141] The sensor 608 is used to collect external environment information. The sensor 608 may include one or more sensors such as an environment brightness sensor, an acceleration sensor, and a gyroscope.

[0142] The power supply 609 is used to supply power to various components of the electronic device 600. In some implementations, the power supply 609 may be logically connected to the processor 601 through a power management system, so that the power management system can manage charging, discharging, power consumption, and other functions.

[0143] Although not shown in the figure, the electronic device 600 may also include a camera, a Bluetooth module, etc., which will not be described in detail here.

[0144] An embodiment of the present application also provides a sensitive data encryption and decryption system, including: a first electronic device and a second electronic device.

[0145] The first electronic device is used to obtain the ciphertext of sensitive data of an application and the first public key of the application, the ciphertext of the sensitive data is obtained by encrypting the sensitive data of the application using a first target key, the first target key is calculated based on a preset key algorithm using a second public key of the first electronic device and a first private key of the application, wherein each application includes a different first private key and a corresponding first public key; a second target key is calculated based on a preset key algorithm according to a second private key preset in the first electronic device and the first public key of the application; and the ciphertext of the sensitive data is decrypted using the second target key to obtain a plaintext of the sensitive data.

[0146] The second electronic device develops an application on the second electronic device, which is used to generate a first private key and a corresponding first public key based on the application, and different applications include different first private keys and corresponding first public keys; obtain the second public key of the first electronic device; calculate a first target key based on a preset key algorithm according to the first private key of the application and the second public key of the first electronic device; use the first target key to encrypt sensitive data to obtain ciphertext of the sensitive data, so that the first electronic device obtains the ciphertext of the sensitive data of the application and the first public key of the application, calculate a second target key based on a preset key algorithm according to the second private key preset in the first electronic device and the first public key of the application, and use the second target key to decrypt the ciphertext of the sensitive data to obtain plaintext of the sensitive data.

[0147] Since the first electronic device can execute any of the sensitive data decryption methods provided in the embodiments of the present application, its specific implementation process is detailed in the above-mentioned sensitive data decryption method embodiments, which will not be repeated here. The second electronic device can execute any of the sensitive data encryption methods provided in the embodiments of the present application, and its specific implementation process is detailed in the above-mentioned sensitive data encryption method embodiments, which will not be repeated here.

[0148] It should be noted that a person skilled in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing related hardware through a computer program, and the computer program can be stored in a computer-readable storage medium, and the storage medium may include but is not limited to: a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, etc.

[0149] In addition, the terms "first", "second", and "third" in this application are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or device that includes a series of steps or modules is not limited to the listed steps or modules, but some embodiments also include steps or modules that are not listed, or some embodiments also include other steps or modules inherent to these processes, methods, products, or devices.

[0150] The above is a detailed introduction to the decryption method of sensitive data, the encryption method of sensitive data, the device, the storage medium and the electronic device provided in the embodiments of the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method and core idea of ​​the present application. At the same time, for those skilled in the art, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A method for decrypting sensitive data, applied to a first electronic device, characterized in that: The method comprises: Obtaining a ciphertext of sensitive data of an application and a first public key of the application, wherein the ciphertext of the sensitive data is obtained by encrypting the sensitive data of the application using a first target key, wherein the first target key is calculated using a second public key of the first electronic device and a first private key of the application based on a preset key algorithm, wherein each application includes a different first private key and a corresponding first public key; Obtaining a second target key by calculating based on the preset key algorithm according to the second private key preset by the first electronic device and the first public key of the application; The second target key is used to decrypt the ciphertext of the sensitive data to obtain the plaintext of the sensitive data.

2. The method for decrypting sensitive data according to claim 1, characterized in that: The step of calculating the second target key based on a preset key algorithm according to the second private key of the first electronic device and the first public key of the application program comprises: Get the first package name of the application and the first certificate hash value of the application developer certificate; Determine whether the first package name corresponding to the application and the first certificate hash value are recorded in the whitelist of the first electronic device; If the first package name corresponding to the application and the first certificate hash value are recorded in the whitelist, the encryption and decryption interface of the first electronic device is called to calculate the second target key based on the preset key algorithm according to the second private key of the first electronic device and the first public key of the application.

3. The method for decrypting sensitive data according to claim 2, characterized in that: The calling of the encryption and decryption interface of the first electronic device to calculate the second target key based on a preset key algorithm according to the second private key of the first electronic device and the first public key of the application program comprises: According to the first public key of the application, a first public key hash value of the first public key is calculated based on a preset hash algorithm; Determining whether the first public key hash value matches the public key hash value of the application recorded in the whitelist; If the first public key hash value matches the public key hash value of the application recorded in the whitelist, the encryption and decryption interface of the first electronic device is called to calculate the second target key based on the preset key algorithm according to the second private key of the first electronic device and the first public key of the application.

4. The method for decrypting sensitive data according to claim 1, characterized in that: Before obtaining the encrypted sensitive data of the application and the first public key of the application: Obtain an installation package of the application and install it, wherein the installation package includes a ciphertext of sensitive data corresponding to the application, a first public key, a first package name, and an application developer certificate.

5. A method for encrypting sensitive data, applied to a second electronic device, characterized in that: Developing an application program on the second electronic device, the method comprising: Generate a first private key and a corresponding first public key based on the application, where different applications include different first private keys and corresponding first public keys; Obtaining a second public key of the first electronic device; Obtaining a first target key by calculating based on a preset key algorithm according to the first private key of the application and the second public key of the first electronic device; The sensitive data is encrypted using the first target key to obtain the ciphertext of the sensitive data, so that the first electronic device obtains the ciphertext of the sensitive data of the application and the first public key of the application. The second target key is calculated based on the preset key algorithm according to the second private key preset by the first electronic device and the first public key of the application, and the ciphertext of the sensitive data is decrypted using the second target key to obtain the plaintext of the sensitive data.

6. The method for encrypting sensitive data according to claim 5, characterized in that: After the sensitive data is encrypted using the target key to obtain the ciphertext of the sensitive data, the method further includes: The ciphertext of the sensitive data of the application, the first public key of the application, the first package name of the application and the developer certificate are stored in an installation package corresponding to the application, so that the first electronic device can obtain the installation package and install the application according to the installation package.

7. The method for encrypting sensitive data according to claim 5, characterized in that: Before encrypting the sensitive data using the first target key to obtain the ciphertext of the sensitive data, the method further includes: The permission to call the encryption and decryption interface of the first electronic device is obtained, so that the first package name corresponding to the application, the first certificate hash value of the developer certificate, and the hash value of the first public key are recorded in the whitelist of the first electronic device.

8. A sensitive data decryption device, applied to a first electronic device, characterized in that: The device comprises: a first acquisition module, configured to acquire a ciphertext of sensitive data of an application and a first public key of the application, wherein the ciphertext of the sensitive data is obtained by encrypting the sensitive data of the application using a first target key, wherein the first target key is calculated based on a preset key algorithm using a second public key of the first electronic device and a first private key of the application, wherein each application includes a different first private key and a corresponding first public key; A first calculation module, configured to calculate a second target key based on the preset key algorithm according to a second private key preset by the first electronic device and a first public key of the application; A decryption module is used to use the second target key to decrypt the ciphertext of the sensitive data to obtain the plaintext of the sensitive data.

9. A sensitive data encryption device, applied to a second electronic device, characterized in that: The second electronic device encrypts the sensitive data of the application, and the device includes: A generating module, configured to generate a first private key and a corresponding first public key based on the application, wherein different applications include different first private keys and corresponding first public keys; A second acquisition module, used to acquire a second public key of the first electronic device; A second calculation module, configured to calculate a first target key based on a preset key algorithm according to the first private key of the application and the second public key of the first electronic device; An encryption module is used to encrypt sensitive data using the first target key to obtain ciphertext of the sensitive data, so that the first electronic device obtains the ciphertext of the sensitive data of the application and the first public key of the application, calculates the second target key based on the preset key algorithm according to the second private key preset by the first electronic device and the first public key of the application, and uses the second target key to decrypt the ciphertext of the sensitive data to obtain the plaintext of the sensitive data.

10. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, which executes the sensitive data decryption method described in any one of claims 1 to 4 when the computer program is loaded by the processor of the first electronic device, or executes the sensitive data encryption method described in any one of claims 5 to 7 when the computer program is loaded by the processor of the second electronic device.

11. An electronic device comprising a processor and a memory, wherein the memory has a computer program, characterized in that: The processor executes the method for decrypting sensitive data as described in any one of claims 1 to 4, or executes the method for encrypting sensitive data as described in any one of claims 5 to 7 by calling the computer program.

Images