Encrypted data decryption method and device, storage medium and electronic equipment

Abstract

The invention discloses an encrypted data decryption method and device, a storage medium and electronic equipment, and relates to the technical field of smart home. The encrypted data decryption method comprises the steps that analysis middleware is called to convert sensitive data of a target object into encrypted data based on a symmetric encryption mode, and the sensitive data are from a plurality of application platforms; calling the analysis middleware to convert the format of the encrypted data into a unified parameter format; and under the condition that the encrypted data in the unified parameter format needs to be decrypted, calling a key in a key management system to decrypt the encrypted data in the unified parameter format. By adopting the technical scheme, the problem of low encryption and decryption efficiency caused by the fact that diversified encryption and decryption modes are not supported for sensitive data of a plurality of application platforms in related technologies is solved, diversified configuration of the encryption and decryption modes is realized, and the encryption and decryption efficiency is effectively improved.

Description

Technical Field

[0001] The present application relates to the field of smart home technology, and more specifically, to a method and device for decrypting encrypted data, a storage medium, and an electronic device. Background Art

[0002] When the target object operates the application, some sensitive data will be generated. The encryption methods, parameters and environments of these sensitive data in different applications are diverse. In the existing related technologies, encryption and decryption technology only supports the use of corresponding encryption and decryption algorithms, but does not support diversified encryption and decryption methods, resulting in low encryption and decryption efficiency.

[0003] Regarding the problem that the related technologies do not support diversified encryption and decryption methods for sensitive data of multiple application platforms, resulting in low encryption and decryption efficiency, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present application provide a method and device for decrypting encrypted data, a storage medium, and an electronic device, so as to at least solve the problem in the related art that sensitive data of multiple application platforms do not support diversified encryption and decryption methods, resulting in low encryption and decryption efficiency.

[0005] According to an embodiment of the embodiments of the present application, a method for decrypting encrypted data is provided, including: calling a parsing middleware to convert sensitive data of a target object into encrypted data based on a symmetric encryption method, wherein the sensitive data comes from multiple application platforms; calling the parsing middleware to convert the format of the encrypted data into a unified parameter format; and when the encrypted data in the unified parameter format needs to be decrypted, calling a key in a key management system to decrypt the encrypted data in the unified parameter format.

[0006] In an optional embodiment, calling a parsing middleware to convert sensitive data of a target object into encrypted data based on a symmetric encryption method includes: obtaining the sensitive data of the target object; determining a target symmetric encryption algorithm corresponding to the symmetric encryption method of the parsing middleware; and encrypting the sensitive data by using the target symmetric encryption algorithm to generate encrypted data.

[0007] In an optional embodiment, calling the parsing middleware to convert the format of the encrypted data into a unified parameter format includes: when determining that the format of the encrypted data is a non-uniform parameter format, determining the conversion code corresponding to the format of the encrypted data in the parsing middleware; and converting the format of the encrypted data into the unified parameter format through the conversion code.

[0008] In an optional embodiment, calling a key in a key management system to decrypt the encrypted data in the unified parameter format includes: obtaining the key corresponding to the encrypted data in the key management system and obtaining the target parameters corresponding to the encrypted data, wherein the target parameters are all parameters required for decrypting the encrypted data except the key; decrypting the encrypted data according to the key, the target parameters and the encrypted data encrypted by the parsing middleware.

[0009] In an optional embodiment, after calling the key in the key management system to decrypt the encrypted data in the unified parameter format, the method further includes: when the target data after decryption is plain text data, synchronizing the target data to the data lake, and calling the software development kit in the data synchronization tool script to encrypt the target data, wherein the software development kit in the data synchronization tool script is used to encrypt and / or decrypt the data.

[0010] In an optional embodiment, after synchronizing the target data to the data lake, the method further includes: when the encrypted data flows into the data lake, decrypting the encrypted data through the decryption interface of the software development kit and storing it in the form of plaintext data; when the plaintext data flows out of the data lake, encrypting the plaintext data through the encryption interface of the software development kit and transmitting it in the form of encrypted data.

[0011] In an optional embodiment, after transmitting in the form of encrypted data, the method further includes: when each application platform integrates the software development kit, obtaining the key stored in the key management system through the calling interface of the software development kit; and transmitting the key and the encrypted data to each application platform.

[0012] According to another aspect of the present invention, there is also provided a decryption device for encrypted data, comprising: an encryption module, used to call the parsing middleware to convert the sensitive data of the target object into encrypted data based on a symmetric encryption method, wherein the sensitive data comes from multiple application platforms; a conversion module, used to call the parsing middleware to convert the format of the encrypted data into a unified parameter format; and a decryption module, used to call the key in the key management system to decrypt the encrypted data in the unified parameter format when the encrypted data in the unified parameter format needs to be decrypted.

[0013] According to another aspect of the embodiments of the present application, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the above-mentioned decryption method for encrypted data when running.

[0014] According to another aspect of an embodiment of the present application, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the method for decrypting encrypted data through the computer program.

[0015] According to another aspect of the embodiments of the present application, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the above-mentioned method for decrypting encrypted data is implemented.

[0016] In an embodiment of the present application, the parsing middleware is called to convert the sensitive data of the target object into encrypted data based on a symmetric encryption method, wherein the sensitive data comes from multiple application platforms; the parsing middleware is called to convert the format of the encrypted data into a unified parameter format; when the encrypted data in the unified parameter format needs to be decrypted, the key in the key management system is called to decrypt the encrypted data in the unified parameter format. The above technical solution solves the problem in the related art that for sensitive data of multiple application platforms, diversified encryption and decryption methods are not supported, resulting in low encryption and decryption efficiency, and diversified encryption and decryption methods are realized, effectively improving encryption and decryption efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0018] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0019] Figure 1 It is a hardware environment diagram of a method for decrypting encrypted data according to an embodiment of the present application;

[0020] Figure 2 is a flowchart of a method for decrypting encrypted data according to an embodiment of the present application;

[0021] Figure 3 is an overall architecture diagram of a method for decrypting encrypted data according to an embodiment of the present application;

[0022] Figure 4 An overall flow chart of a method for decrypting encrypted data according to an embodiment of the present application;

[0023] Figure 5 is a flow chart of a method for decrypting encrypted data according to an optional embodiment of the present application;

[0024] Figure 6 is a data source encryption configuration diagram of a method for decrypting encrypted data according to an optional embodiment of the present application;

[0025] Figure 7 is a flow diagram of a method for decrypting encrypted data according to an optional embodiment of the present application;

[0026] Figure 8 It is a structural block diagram of a decryption device for encrypted data according to an embodiment of the present application. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0028] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] According to one aspect of an embodiment of the present application, a method for decrypting encrypted data is provided. The method for decrypting encrypted data is widely used in smart home, smart home, smart home device ecology, smart residential (Intelligence House) ecology and other whole-house intelligent digital control application scenarios. Optionally, in this embodiment, the above-mentioned method for decrypting encrypted data can be applied to Figure 1 In the hardware environment composed of the first application platform 102 and the second application platform 104 shown in FIG. Figure 1 As shown, the first application platform 102 is connected to the second application platform 104 via a network, and can be used to provide services (such as application services, etc.) for the first application platform 102 or a client installed on the first application platform 102. A database can be set on the first application platform 102 or independently of the first application platform 102 to provide data storage services for the first application platform 102 and the second application platform 104. Cloud computing and / or edge computing services can be configured on the first application platform 102 or independently of the first application platform 102 to provide data computing services for the first application platform 102 and the second application platform 104.

[0030] The above network may include but is not limited to at least one of the following: wired network, wireless network. The above wired network may include but is not limited to at least one of the following: wide area network, metropolitan area network, local area network, and the above wireless network may include but is not limited to at least one of the following: WIFI (Wireless Fidelity), Bluetooth. The first application platform 102 and the second application platform 104 may be but are not limited to PC, mobile phone, tablet computer, smart air conditioner, smart range hood, smart refrigerator, smart oven, smart stove, smart washing machine, smart water heater, smart washing equipment, smart dishwasher, smart projection equipment, smart TV, smart clothes drying rack, smart curtain, smart audio and video, smart socket, smart audio, smart speaker, smart fresh air equipment, smart kitchen and bathroom equipment, smart bathroom equipment, smart sweeping robot, smart window cleaning robot, smart mopping robot, smart air purification equipment, smart steamer, smart microwave oven, smart kitchen treasure, smart purifier, smart water dispenser, system platform, etc.

[0031] In this embodiment, a method for decrypting encrypted data is provided, which is applied to the first application platform. Figure 2 : is a flowchart of a method for decrypting encrypted data according to an embodiment of the present application, the process comprising the following steps:

[0032] Step S202, calling the parsing middleware to convert the sensitive data of the target object into encrypted data based on the symmetric encryption method, wherein the sensitive data comes from multiple application platforms;

[0033] Step S204, calling the parsing middleware to convert the format of the encrypted data into a unified parameter format;

[0034] Step S206: When the encrypted data in the unified parameter format needs to be decrypted, the key in the key management system is called to decrypt the encrypted data in the unified parameter format.

[0035] In an embodiment of the present application, a parsing middleware is called to convert sensitive data of a target object into encrypted data based on a symmetric encryption method, wherein the sensitive data comes from multiple application platforms; the parsing middleware is called to convert the format of the encrypted data into a unified parameter format; when the encrypted data in the unified parameter format needs to be decrypted, the key in the key management system is called to decrypt the encrypted data in the unified parameter format.

[0036] In an optional embodiment, calling a parsing middleware to convert sensitive data of a target object into encrypted data based on a symmetric encryption method includes: obtaining the sensitive data of the target object; determining a target symmetric encryption algorithm corresponding to the symmetric encryption method of the parsing middleware; and encrypting the sensitive data by using the target symmetric encryption algorithm to generate encrypted data.

[0037] In the process of acquiring the sensitive data of the target object, the sensitive data includes the passwords of various application platforms of the target object, bank card numbers, ID card numbers and other sensitive information. After successfully acquiring the sensitive data, determine the target symmetric encryption algorithm corresponding to the symmetric encryption method of the parsing middleware used. In this embodiment, the AES symmetric encryption algorithm is used. The user's sensitive data is encrypted by the AES symmetric encryption algorithm to generate encrypted data. For example, if the user's password is "123456", it may become a string of garbled code "2f8d2e9a4bc3f5d6" after encryption by the AES symmetric encryption algorithm. This garbled code is the encrypted data of the user's password "123456".

[0038] In an optional embodiment, calling the parsing middleware to convert the format of the encrypted data into a unified parameter format includes: when determining that the format of the encrypted data is a non-uniform parameter format, determining the conversion code corresponding to the format of the encrypted data in the parsing middleware; and converting the format of the encrypted data into the unified parameter format through the conversion code.

[0039] Assume that the format of the encrypted data is XXXXXX-YYYYYY, where X and Y represent different characters. The format of the encrypted data is not a unified parameter format, so it needs to be converted. Find the conversion code corresponding to the encrypted data format in the parsing middleware. Assume that a function named "format_converter" is found, which can convert non-Base64 format data into Base64 format. Call the "format_converter" function and pass the encrypted data as an input parameter to the "format_converter" function. The "format_converter" function will perform corresponding conversion operations according to the format of the encrypted data. Return the converted Base64 format data.

[0040] In an optional embodiment, calling a key in a key management system to decrypt the encrypted data in the unified parameter format includes: obtaining the key corresponding to the encrypted data in the key management system and obtaining the target parameters corresponding to the encrypted data, wherein the target parameters are all parameters required for decrypting the encrypted data except the key; decrypting the encrypted data according to the key, the target parameters and the encrypted data encrypted by the parsing middleware.

[0041] After obtaining access rights to a key management system (in an optional embodiment, the key management system may be a KeyManagement System, referred to as KMS for short), obtain the key corresponding to the encrypted data stored in the KMS key management system and obtain the target parameters. The target parameters are all the parameters required in the decryption process except the key. For the decryption method in the AES symmetric encryption algorithm, the target parameters include the algorithm mode, the initial vector, and the padding mode. The decoded encrypted data is decrypted using the decryption method in the AES symmetric encryption algorithm using the obtained key and target parameters.

[0042] In an optional embodiment, after calling the key in the key management system to decrypt the encrypted data in the unified parameter format, the method further includes: when the target data after decryption is plain text data, synchronizing the target data to the data lake, and calling the software development kit in the data synchronization tool script to encrypt the target data, wherein the software development kit in the data synchronization tool script is used to encrypt and / or decrypt the data.

[0043] The data synchronization tool script (also called the dataX script) contains a first code and a second code. Among them, the first code includes the operation steps of calling the parsing middleware to encrypt and unify the parameter format, and the second code includes the operation steps of decrypting the encrypted data when decryption is required after the parameter format is unified. After executing the dataX script, a part of the encrypted data and a part of the plaintext data will be generated, and the plaintext data will be directly transferred to the data lake. The above plaintext data is encrypted through the encryption interface of the software development kit (Software Development Kit, referred to as SDK) integrated in dataX, and encrypted data is generated for data sharing. The above encrypted data is decrypted through the decryption interface of the SDK to obtain the plaintext data of the above encrypted data, and the plaintext data of these encrypted data are also transferred to the data lake.

[0044] In an optional embodiment, after synchronizing the target data to the data lake, the method further includes: when the encrypted data flows into the data lake, decrypting the encrypted data through the decryption interface of the software development kit and storing it in the form of plaintext data; when the plaintext data flows out of the data lake, encrypting the plaintext data through the encryption interface of the software development kit and transmitting it in the form of encrypted data.

[0045] The target data is the plaintext data obtained after decrypting the encrypted data. The data that does not need to be decrypted still exists in the form of encrypted data. When these encrypted data flow into the data lake, they need to be decrypted through the SDK's decryption interface and flow into the data lake in the form of plaintext data for storage. When the target data needs to flow out of the data lake, the target data is encrypted through the SDK's encryption interface and transmitted in the form of encrypted data.

[0046] For example, suppose there is an online medical record system that needs to process and store patients' medical record data. Before the patient data is transmitted to the data lake, it is encrypted using the encryption method in the AES symmetric encryption algorithm and a specific key, and the key is stored in the KMS key management system. When the medical record data needs to be synchronized to the data lake, the encrypted medical record data is decrypted into plain text by calling the SDK's decryption interface and stored in the data lake. When medical researchers need to share these medical record data, the plain text data stored in the data lake is encrypted by calling the SDK's encryption interface and transmitted in the form of encrypted data.

[0047] In an optional embodiment, after transmitting in the form of encrypted data, the method further includes: when each application platform integrates the software development kit, obtaining the key stored in the key management system through the calling interface of the software development kit; and transmitting the key and the encrypted data to each application platform.

[0048] Alternatively, assume that there is a multi-application platform collaborative medical information system that needs to securely share medical records between doctors, nurses, and patients. Integrate the SDK in the doctor's mobile application, the nurse's workstation application, and the patient's patient portal. When the medical record needs to be viewed or updated, the relevant application platform, such as the doctor's mobile application, obtains the key corresponding to the encrypted data stored in the KMS key management system through the SDK decryption interface. Use the obtained key to decrypt the encrypted medical record, and then the doctor can view the plaintext data in the mobile application. When the doctor updates the medical record, call the SDK again to encrypt the updated medical record, and synchronize the encrypted data and the corresponding key to the nurse and patient's application platform.

[0049] In order to better understand the process of the above-mentioned decryption method of encrypted data, the process of the above-mentioned decryption implementation method of encrypted data is described below in combination with an optional embodiment, but it is not used to limit the technical solution of the embodiment of the present application.

[0050] Figure 3 is an overall architecture diagram of a method for decrypting encrypted data according to an embodiment of the present application, such as Figure 3 As shown, the specific steps include:

[0051] The overall architecture diagram of the decryption method for encrypted data includes presentation layer, application layer, service layer, integration layer, and storage layer.

[0052] The presentation layer is the page that the target object can operate. The target object sets encryption properties through data source configuration, including key type, encryption method, and data source key. The data under the database is initialized through data source configuration so that subsequent data can be successfully entered into the lake. The sensitive data of the target object is obtained through the collection function, and the sensitive data is identified through data processing to determine whether encryption is required. The data is passed to the application layer through data sharing.

[0053] The application layer includes parsing middleware and dependent components. By calling the parsing middleware, sensitive data is encrypted with ASE and converted into a unified Base64 parameter format. When the encrypted data in the unified parameter format needs to be decrypted, the key in the KMS key management system is called to decrypt the encrypted data in the unified parameter format. Generate a dataX script with the code of the above steps, and integrate the SDK in the dataX script.

[0054] The service layer executes dataX. If the target data is plain text data, the plain text data is directly transferred to the data lake. If the target data is encrypted data, the encrypted data is decrypted through the SDK decryption interface to generate plain text data and transfer it to the data lake. When the data flows out of the data lake, the data in the lake is encrypted through the SDK and shared among various application platforms.

[0055] The integration layer includes dataX, Hive, flink and spark, which are integrated into various application platforms for data encryption and decryption, circulation and sharing. Finally, the data is stored in the database of the storage layer.

[0056] Figure 4 The overall flow chart of the method for decrypting encrypted data according to an embodiment of the present application is as follows: Figure 4 As shown, the specific steps include:

[0057] Define encryption properties through data source configuration, including key type, encryption method, and data source key. After configuration, the system will initialize the encrypted field properties in the database, collect sensitive data of the target object, and identify which fields need to be encrypted. Perform encryption operations on sensitive data using the ASE symmetric encryption algorithm by calling the parsing middleware and convert it into a unified Base64 parameter format. When the encrypted data in the unified parameter format needs to be decrypted, call the key in the KMS key management system to decrypt the encrypted data in the unified parameter format. Generate a dataX script with the code of the above steps and integrate the SDK in the dataX script.

[0058] Execute dataX. If the target data is plaintext data, directly transfer the plaintext data to the data lake. If the target data is encrypted data, decrypt the encrypted data through the SDK decryption interface to generate plaintext data and transfer it to the data lake.

[0059] Integrate SDK in each application platform, obtain the key from the KMS key management system by calling the SDK decryption interface, decrypt the encrypted data flowing out of the data lake, and obtain the plaintext data for subsequent operations. After the operation is completed, encrypt the data through the SDK and transmit it to each application platform. Each application platform can obtain the plaintext data of the required encrypted data through the SDK decryption operation.

[0060] Figure 5 is a flowchart of a method for decrypting encrypted data according to an optional embodiment of the present application. Figure 5 As shown, the specific steps include:

[0061] The target object configures the data source in the platform and defines encryption properties, including key type, encryption method, and data source key. After the configuration is completed, the system will initialize the encrypted field properties in the database, collect sensitive data of the target object, and identify which fields need to be encrypted and which fields need to be decrypted under specific conditions.

[0062] By calling the parsing middleware, the sensitive data is encrypted using the ASE symmetric encryption algorithm, and the encrypted data is converted into a unified Base64 parameter format. When the encrypted data in the unified parameter format needs to be decrypted, the key in the KMS key management system is called to decrypt the encrypted data in the unified parameter format. Generate a dataX script with the code of the above steps, and integrate the SDK into the dataX script.

[0063] Execute dataX. If the target data is plaintext data, directly transfer the plaintext data to the data lake. If the target data is encrypted data, decrypt the encrypted data through the SDK decryption interface to generate plaintext data and transfer it to the data lake.

[0064] For example, suppose there is an online medical record system that needs to process and store sensitive medical information of patients. Configure the data source in the platform and define the use of the AES symmetric encryption algorithm and the generated key. The system initializes the database and marks the patient's name, ID number, and medical record fields as encrypted fields. When the patient data is collected, the parsing middleware encrypts the sensitive fields and converts them to Base64 format. If plaintext data is required for data analysis or presentation, call the key in the KMS key management system to decrypt the encrypted data in Base64 format, and pass the decrypted plaintext data to the data lake. If decryption is not required, call the decryption interface of the SDK, obtain the key corresponding to the encrypted data from the KMS key management system, decrypt it through the SDK, and pass the decrypted plaintext data to the data lake.

[0065] Figure 6 is a data source encryption configuration diagram of a method for decrypting encrypted data according to an optional embodiment of the present application, such as Figure 6 As shown, the specific steps include:

[0066] Data source encryption configuration includes data source key type, data source encryption mode, data source key, ciphertext prefix, ciphertext Base64 mode, Padding, MODE, and IV.

[0067] Define encryption properties according to the data source configuration. After the configuration is completed, the system will initialize the encrypted field properties in the database, collect sensitive data of the target object, and identify which fields need to be encrypted and which fields need to be decrypted under specific conditions.

[0068] Alternatively, assume that there is a banking system that stores and manages customer transaction records. It is necessary to ensure that sensitive information in the transaction records, such as card number and transaction amount, is properly encrypted. Select "Symmetric Encryption" for the data source key type, select "AES Symmetric Encryption Algorithm" for the data source encryption method, generate a 256-bit data source key, and define a key prefix, such as "ENC", to mark encrypted data. Select a padding mode, such as PKCS#5 / PKCS#7, to ensure that the data block size meets the requirements of the encryption algorithm. Select an encryption mode, such as Cipher Block Chaining CBC, which provides additional security for the data. The initialization vector IV is used in CBC mode to generate a random IV for each encryption operation.

[0069] During the system initialization phase, the system automatically scans the database structure, identifies fields that need to be encrypted, such as card number and transaction amount, and sets encryption attributes for these fields. When a new transaction record is received, the relevant data is automatically collected and sensitive data is encrypted using the defined encryption attributes. The encrypted data is stored in Base64 format with an "ENC" prefix to distinguish between encrypted and non-encrypted data. Based on the configuration, the system identifies fields that need to be decrypted under certain conditions, such as when performing transaction analysis.

[0070] Figure 7 is a flow diagram of a method for decrypting encrypted data according to an optional embodiment of the present application, such as Figure 7 As shown, the specific steps include:

[0071] When encrypted data flows into the data lake, the encrypted data is decrypted through the SDK's decryption interface and stored in the form of plaintext data; when plaintext data flows out of the data lake, the plaintext data is encrypted through the SDK's encryption interface and transmitted in the form of encrypted data.

[0072] At the same time, SDK is integrated into each application platform. By calling the decryption interface, the key stored in the KMS key management system is obtained to decrypt the encrypted data and generate the plaintext data of the encrypted data. When subsequent operations are performed on the plaintext data, the encryption interface is called by the SDK to encrypt the plaintext data after the operation is performed and transmit it to each application platform.

[0073] Alternatively, assume that there is a multi-application platform collaborative medical record system that needs to process and store patients' medical record data and share medical records between doctors, nurses, and patients. First, ensure that the SDK is integrated in the doctor's mobile application, the nurse's workstation application, and the patient's patient portal. Before the medical record data is transmitted to the data lake, it is encrypted using the encryption method in the AES symmetric encryption algorithm and a specific key, and the key is stored in the KMS key management system.

[0074] In the case where medical record data needs to be transferred to the data lake, the encrypted medical record data is decrypted into plain text by calling the SDK's decryption interface and stored in the data lake. When the doctor needs to view and update these medical record data, the plain text data stored in the data lake is encrypted by calling the SDK's encryption interface, and transmitted in the form of encrypted data to the doctor's mobile application. The key corresponding to the encrypted data stored in the KMS key management system is obtained through the SDK decryption interface. The encrypted medical record data is decrypted using the obtained key, and then the doctor can view the plain text data in the mobile application. When the doctor updates the medical record, the SDK is called again to encrypt the updated medical record data, and the encrypted data and the corresponding key are synchronized to the application platform of the nurse and the patient.

[0075] Figure 8 is a structural block diagram of a decryption device for encrypted data according to an embodiment of the present application; Figure 8 As shown, including:

[0076] An encryption module 80, used to call the parsing middleware to convert the sensitive data of the target object into encrypted data based on a symmetric encryption method, wherein the sensitive data comes from multiple application platforms;

[0077] A conversion module 82, used for calling the parsing middleware to convert the format of the encrypted data into a unified parameter format;

[0078] The decryption module 84 is used to call the key in the key management system to decrypt the encrypted data in the unified parameter format when the encrypted data in the unified parameter format needs to be decrypted.

[0079] In an embodiment of the present application, the parsing middleware is called to convert the sensitive data of the target object into encrypted data based on a symmetric encryption method, wherein the sensitive data comes from multiple application platforms; the parsing middleware is called to convert the format of the encrypted data into a unified parameter format; when the encrypted data in the unified parameter format needs to be decrypted, the key in the key management system is called to decrypt the encrypted data in the unified parameter format. The above technical solution solves the problem in the related technology that the encryption and decryption technology does not support the diversified configuration of the encryption and decryption method, resulting in low encryption and decryption efficiency, realizes the diversified configuration of the encryption and decryption method, and effectively improves the encryption and decryption efficiency.

[0080] In an optional embodiment, the encryption module 80 is also used to obtain sensitive data of the target object; determine the target symmetric encryption algorithm corresponding to the symmetric encryption method of the parsing middleware; encrypt the sensitive data by using the target symmetric encryption algorithm to generate encrypted data.

[0081] In an optional embodiment, the conversion module 82 is also used to determine the conversion code corresponding to the format of the encrypted data in the parsing middleware when it is determined that the format of the encrypted data is a non-uniform parameter format; and convert the format of the encrypted data into the unified parameter format through the conversion code.

[0082] In an optional embodiment, the decryption module 84 is also used to obtain the key corresponding to the encrypted data in the key management system and obtain the target parameters corresponding to the encrypted data, when the access right to the key management system has been obtained, wherein the target parameters are all the parameters required for decrypting the encrypted data except the key; the encrypted data is decrypted according to the key, the target parameters and the encrypted data encrypted by the parsing middleware.

[0083] In an optional embodiment, the decryption module 84 is also used to synchronize the target data to the data lake when the target data after decryption is plain text data, and call the software development kit in the data synchronization tool script to encrypt the target data, wherein the software development kit in the data synchronization tool script is used to encrypt and / or decrypt the data.

[0084] In an optional embodiment, the decryption module 84 is further used to decrypt the encrypted data through the decryption interface of the software development kit and store it in the form of plaintext data when the encrypted data flows into the data lake; and to encrypt the plaintext data through the encryption interface of the software development kit and transmit it in the form of encrypted data when the plaintext data flows out of the data lake.

[0085] In an optional embodiment, the decryption module 84 is also used to obtain the key stored in the key management system through the calling interface of the software development kit when each application platform is integrated with the software development kit; and transmit the key and the encrypted data to each application platform.

[0086] An embodiment of the present application further provides a storage medium, which includes a stored program, wherein the program executes any of the above methods when it is run.

[0087] Optionally, in this embodiment, the storage medium may be configured to store program codes for executing the following steps:

[0088] S1, calling the parsing middleware to convert the sensitive data of the target object into encrypted data based on the symmetric encryption method, wherein the sensitive data comes from multiple application platforms;

[0089] S2, calling the parsing middleware to convert the format of the encrypted data into a unified parameter format;

[0090] S3, when the encrypted data in the unified parameter format needs to be decrypted, calling the key in the key management system to decrypt the encrypted data in the unified parameter format.

[0091] An embodiment of the present application further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0092] Optionally, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0093] Optionally, in this embodiment, the processor may be configured to perform the following steps through a computer program:

[0094] S1, calling the parsing middleware to convert the sensitive data of the target object into encrypted data based on the symmetric encryption method, wherein the sensitive data comes from multiple application platforms;

[0095] S2, calling the parsing middleware to convert the format of the encrypted data into a unified parameter format;

[0096] S3, when the encrypted data in the unified parameter format needs to be decrypted, calling the key in the key management system to decrypt the encrypted data in the unified parameter format.

[0097] Optionally, in this embodiment, the above-mentioned storage medium may include but is not limited to: a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and other media that can store program codes.

[0098] An embodiment of the present application further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the steps in any one of the above method embodiments are implemented.

[0099] An embodiment of the present application further provides another computer program product, including a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in any of the above method embodiments are implemented.

[0100] The embodiments of the present application also provide a computer program, which includes computer instructions, which are stored in a computer-readable storage medium; a processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the steps in any one of the above method embodiments.

[0101] Optionally, the specific examples in this embodiment may refer to the examples described in the above embodiments and optional implementation modes, and this embodiment will not be described in detail here.

[0102] Obviously, those skilled in the art should understand that the above modules or steps of the present application can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, and optionally, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order from that herein, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present application is not limited to any specific combination of hardware and software.

[0103] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for decrypting encrypted data, characterized in that: include: Calling the parsing middleware to convert the sensitive data of the target object into encrypted data based on a symmetric encryption method, wherein the sensitive data comes from multiple application platforms; Calling the parsing middleware to convert the format of the encrypted data into a unified parameter format; When the encrypted data in the unified parameter format needs to be decrypted, the key in the key management system is called to decrypt the encrypted data in the unified parameter format.

2. The method for decrypting encrypted data according to claim 1, characterized in that: Call the parsing middleware to convert the sensitive data of the target object into encrypted data based on symmetric encryption, including: Obtaining sensitive data of the target object; Determine the target symmetric encryption algorithm corresponding to the symmetric encryption method of the parsing middleware; The sensitive data is encrypted using the target symmetric encryption algorithm to generate encrypted data.

3. The method for decrypting encrypted data according to claim 1, characterized in that: Calling the parsing middleware to convert the format of the encrypted data into a unified parameter format includes: In the case where it is determined that the format of the encrypted data is a non-uniform parameter format, determining a conversion code corresponding to the format of the encrypted data in the parsing middleware; The format of the encrypted data is converted into the unified parameter format by the conversion code.

4. The method for decrypting encrypted data according to claim 1, characterized in that: Calling the key in the key management system to decrypt the encrypted data in the unified parameter format includes: In the case where the access right to the key management system has been obtained, obtaining the key corresponding to the encrypted data in the key management system, and obtaining the target parameter corresponding to the encrypted data, wherein the target parameter is other parameters except the key among all the parameters required in the process of decrypting the encrypted data; The encrypted data is decrypted according to the key, the target parameter and the encrypted data encrypted by the parsing middleware.

5. The method for decrypting encrypted data according to claim 1, characterized in that: After calling the key in the key management system to decrypt the encrypted data in the unified parameter format, the method also includes: when the target data after decryption is plain text data, synchronizing the target data to the data lake, and calling the software development kit in the data synchronization tool script to encrypt the target data, wherein the software development kit in the data synchronization tool script is used to encrypt and / or decrypt the data.

6. The method for decrypting encrypted data according to claim 5, characterized in that: After synchronizing the target data to the data lake, the method further includes: When the encrypted data flows into the data lake, the encrypted data is decrypted through the decryption interface of the software development kit and stored in the form of plain text data; When the target data flows out of the data lake, the plaintext data is encrypted through the encryption interface of the software development kit and transmitted in the form of encrypted data.

7. The method for decrypting encrypted data according to claim 6, characterized in that: After transmitting in the form of encrypted data, the method further comprises: In the case where each application platform integrates the software development kit, obtaining the key stored in the key management system through the calling interface of the software development kit; The key and the encrypted data are transmitted to each application platform.

8. A decryption device for encrypted data, characterized in that: include: The encryption module is used to call the parsing middleware to convert the sensitive data of the target object into encrypted data based on the symmetric encryption method; A conversion module, used for calling the parsing middleware to convert the format of the encrypted data into a unified parameter format; The decryption module is used to call the key in the key management system to decrypt the encrypted data in the unified parameter format when the encrypted data in the unified parameter format needs to be decrypted.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored program, wherein the program executes the method described in any one of claims 1 to 7 when executed.

10. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to execute the method according to any one of claims 1 to 7 through the computer program.

Images