Data encryption and decryption method, related device and computer program product

Abstract

The invention provides a data encryption and decryption method, a related device and a computer program product. According to the application, a communication request end does not directly record an adopted encryption and decryption algorithm in a handshake request initiated by the communication request end; the description information that the actually adopted encryption and decryption algorithm can be correctly positioned due to the common agreement between the encryption and decryption algorithm and the communication receiving end in advance is recorded, and the description information describes the arrangement position of the actually adopted encryption and decryption algorithm in the preset encryption and decryption algorithm library; therefore, the actually adopted encryption and decryption algorithm can be correctly positioned only through the two ends where the encryption and decryption algorithms are arranged in the same arrangement mode in advance, and the security of data transmission is effectively guaranteed.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a data encryption and decryption method, device, electronic device, computer-readable medium and computer program product. Background Art

[0002] With the development of society, computer technology is also improving day by day. In the process of data communication between multiple devices, for example, when data is communicated between any two ends (for example, it can be simply divided into: request end and receiving end), in order to prevent the communicated data from being leaked and obtained by a third party for malicious use, it is often necessary to adopt certain security strategies to protect data security.

[0003] For example, during the communication process, you can choose to encrypt the communication data, that is, the two communicating parties transmit data in ciphertext, thereby ensuring the security of data transmission. During the data transmission process, the other end cannot see the data, or even if it is maliciously obtained by the other end, the other end cannot actually read the real content of the data. Accordingly, in this context, how to improve the reliability of encryption and the protection capability of "encryption" is worthy of attention and urgent need. Summary of the invention

[0004] Multiple aspects of the present application provide a data encryption and decryption method, device, electronic device, computer-readable storage medium and computer program product, by making the communication request end not directly record the encryption and decryption algorithm used in the handshake request it initiates, but only record the description information of the encryption and decryption algorithm actually used that can be correctly located due to the prior common agreement between it and the communication receiving end, and the description information describes the arrangement position of the encryption and decryption algorithm actually used in a preset encryption and decryption algorithm library. Therefore, only the two ends that have arranged the encryption and decryption algorithms in the same arrangement in advance can correctly locate the encryption and decryption algorithm actually used, thereby effectively ensuring the security of data transmission.

[0005] On the one hand, the present application provides a data encryption and decryption method, including: extracting encryption and decryption algorithm description information from a handshake request initiated by a requesting end; determining algorithm arrangement information based on the encryption and decryption algorithm description information; determining the encryption and decryption algorithm corresponding to the arrangement position described by the algorithm arrangement information in a preset encryption and decryption algorithm library as a target encryption and decryption algorithm; using the target encryption and decryption algorithm to decrypt the ciphertext data sent by the requesting end, and sending the ciphertext encrypted by the target encryption and decryption algorithm to the requesting end.

[0006] On the other hand, the present application provides a device for data encryption and decryption, including: an encryption and decryption algorithm description information extraction unit, configured to extract encryption and decryption algorithm description information from a handshake request initiated by a requesting end; an algorithm arrangement information determination unit, configured to determine algorithm arrangement information based on the encryption and decryption algorithm description information; a target encryption and decryption algorithm determination unit, configured to determine the encryption and decryption algorithm corresponding to the arrangement position described by the algorithm arrangement information in a preset encryption and decryption algorithm library as the target encryption and decryption algorithm; an encryption and decryption unit, configured to use the target encryption and decryption algorithm to decrypt the ciphertext data sent by the requesting end, and send the ciphertext encrypted by the target encryption and decryption algorithm to the requesting end.

[0007] Another aspect of the present application provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the data encryption and decryption method provided above.

[0008] In another aspect of the present application, a computer-readable storage medium is provided, on which computer program instructions are stored. The computer program instructions can be executed by a processor to implement the data encryption and decryption method provided above.

[0009] In another aspect of the present application, a computer program product includes a computer program having computer program instructions stored thereon, and the computer program can implement the data encryption and decryption method provided above when executed by a processor.

[0010] In the scheme provided by the embodiment of the present application, the encryption and decryption algorithm description information is first extracted from the handshake request initiated by the requesting end, and then the algorithm arrangement information is determined according to the encryption and decryption algorithm description information, and then the encryption and decryption algorithm corresponding to the arrangement position described by the algorithm arrangement information in the preset encryption and decryption algorithm library is determined as the target encryption and decryption algorithm; finally, the target encryption and decryption algorithm can be used to decrypt the ciphertext data sent by the requesting end, and the ciphertext encrypted by the target encryption and decryption algorithm is sent to the requesting end. That is, this scheme enables the communication requesting end to not directly record the encryption and decryption algorithm used in the handshake request it initiates, but only records the description information of the encryption and decryption algorithm actually used that can be correctly located due to the prior mutual agreement between it and the communication receiving end, and the description information describes the arrangement position of the encryption and decryption algorithm actually used in the preset encryption and decryption algorithm library. Therefore, only the two ends that have arranged the encryption and decryption algorithms in the same arrangement in advance can correctly locate the encryption and decryption algorithm actually used, thereby effectively ensuring the security of data transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate the technical solutions in the embodiments of the present application, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0012] Other features, objects and advantages of the present application will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings:

[0013] Figure 1 A schematic diagram of a data encryption and decryption process provided in an embodiment of the present application;

[0014] Figure 2 A schematic diagram of a process for determining a target encryption and decryption algorithm library provided in an embodiment of the present application;

[0015] Figure 3 A schematic diagram of another process of determining a target encryption and decryption algorithm library provided by an embodiment of the present application;

[0016] Figure 4 A schematic diagram of a process of adjusting arrangement information according to a received synchronization instruction provided in an embodiment of the present application;

[0017] Figure 5 A schematic diagram of the structure of a device for data encryption and decryption provided in an embodiment of the present application;

[0018] Figure 6 The present invention is a schematic diagram of the structure of an electronic device suitable for implementing the solution in the embodiment of the present application.

[0019] The same or similar reference numerals in the drawings represent the same or similar components. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0021] In a typical configuration of the present application, the terminal and the equipment of the service network each include one or more processors (CPU), input / output interface, network interface and memory.

[0022] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0023] Computer readable media include permanent and non-permanent, removable and non-removable media, and can be implemented by any method or technology to store information. Information can be computer program instructions, data structures, modules of programs or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0024] As mentioned in the background technology section, there is a need to ensure the security of data transmission between the two ends of data communication. Therefore, how to ensure that the data encryption method adopted by any communication end can only be known by the communication end and not by other ends is worthy of attention and urgent to be solved by those skilled in the art. That is, as discussed above, how to improve the reliability of encryption and improve the protection capability of "encryption" is worthy of attention and urgent.

[0025] In some related schemes, it is often required that the communication requesting end directly record the encryption and decryption algorithm used in its request information when initiating a handshake request to the communication receiving end. For example, it may directly state that DES (Data Encryption Standard, symmetric encryption algorithm), 3DES (Triple DES, a symmetric encryption algorithm based on DES, encrypting a block of data three times with three different keys), IDEA (International Data Encryption Algorithm, international data encryption algorithm) or AES (Advanced Encryption Standard, also a symmetric encryption algorithm), etc.

[0026] However, among these methods, directly stating the encryption and decryption algorithm used in the request information can certainly inform the communication partner of the correct encryption and decryption algorithm used by the party. However, it also means that if a third party intercepts or mirrors the request information, it can also obtain the correct encryption and decryption algorithm from the plain text content with the help of targeted information extraction and identification methods, resulting in the possibility that the ciphertext information can also be decrypted by the third party using the correct encryption and decryption algorithm, thereby causing information leakage and reducing data security.

[0027] In this regard, an embodiment of the present application provides a data encryption and decryption method, which first extracts encryption and decryption algorithm description information from a handshake request initiated by a requesting end, then determines the algorithm arrangement information based on the encryption and decryption algorithm description information, and then determines the encryption and decryption algorithm corresponding to the arrangement position described by the algorithm arrangement information in a preset encryption and decryption algorithm library as the target encryption and decryption algorithm; finally, the target encryption and decryption algorithm can be used to decrypt the ciphertext data sent by the requesting end and send the ciphertext encrypted by the target encryption and decryption algorithm to the requesting end.

[0028] That is, this solution enables the communication requesting end not to directly record the encryption and decryption algorithm used in the handshake request it initiates, but only to record the description information of the encryption and decryption algorithm actually used, which can be correctly located due to the prior mutual agreement between it and the communication receiving end. Moreover, the description information describes the arrangement position of the encryption and decryption algorithm actually used in the preset encryption and decryption algorithm library. Therefore, only the two ends that have arranged the encryption and decryption algorithms in the same arrangement in advance can correctly locate the encryption and decryption algorithm actually used, thereby effectively ensuring the security of data transmission.

[0029] In actual scenarios, the execution subject of the method can be a user device, or a device formed by integrating a user device and a network device through a network, or an application running on the above device. The user device includes but is not limited to various terminal devices such as computers, mobile phones, tablet computers, smart watches, and bracelets. The network device includes but is not limited to network hosts, single network servers, multiple network server sets, or cloud computing-based computer sets. Here, the cloud is composed of a large number of hosts or network servers based on cloud computing (Cloud Computing), where cloud computing is a type of distributed computing, a virtual computer composed of a group of loosely coupled computer sets.

[0030] When the execution subject is software, it can be installed in the electronic devices listed above. It can be implemented as multiple software or software modules, or as a single software or software module, and no specific limitation is made here.

[0031] Figure 1 A data encryption and decryption process 100 provided in an embodiment of the present application is shown. The process 100 includes at least the following processing steps:

[0032] (Step) S101, extracting encryption and decryption algorithm description information from the handshake request initiated by the requesting end.

[0033] In an embodiment of the present application, the execution entity (eg, the user equipment mentioned above) extracts the encryption and decryption algorithm description information from the handshake request initiated by the requesting end.

[0034] In conventional network communications, the handshake process is a step to ensure that both parties establish a stable connection before transmitting data. Taking TCP (Transmission Control Protocol) as an example, it uses a three-way handshake:

[0035] 1) SYN: The client sends a data packet with the SYN flag, indicating a request to establish a connection; 2) SYN-ACK: The server responds with a data packet with the SYN and ACK flags, confirming receipt of the client's request; 3) ACK: The client sends a data packet with the ACK flag to confirm receipt of the server's response. This handshake process ensures the reliability and synchronization of the connection, laying the foundation for data transmission.

[0036] This embodiment is based on the conventional handshake scheme, and further requires that the requesting end that initiates the handshake must carry in the handshake request it initiates encryption and decryption algorithm description information for enabling the communication counterpart (i.e., the receiving end) to determine the encryption and decryption algorithm actually used by the requesting end. That is, the encryption and decryption algorithm description information does not directly state in plain text which encryption and decryption algorithm is actually used, but describes it in a way that the receiving end can accurately determine the encryption and decryption algorithm actually used without directly stating it, so that the requesting end and the receiving end can determine the encryption and decryption algorithm actually used based on the prior agreement between the two parties, while other parties cannot accurately determine the encryption and decryption algorithm actually used.

[0037] In a specific embodiment, the encryption and decryption algorithm description information can be obtained in the following manner: first, obtain the handshake request initiated by the requesting end, and then extract the information recorded in the preset field in the handshake request as the encryption and decryption algorithm description information. That is, in this embodiment, the requesting end records the encryption and decryption algorithm description information in the preset field constituting the handshake request in accordance with the prior agreement with the receiving end, so that the receiving end can extract the encryption and decryption algorithm description information from the correct position of the handshake request. Furthermore, the preset field can be a non-standard field or a custom field constituting the handshake request, or it can be a field obtained by modifying or adjusting a standard field or a field originally used to record other request information, which is not specifically limited here.

[0038] S102: Determine algorithm arrangement information according to the encryption / decryption algorithm description information.

[0039] Based on S102, this step aims to determine the algorithm arrangement information according to the encryption and decryption algorithm description information by the execution subject. The algorithm arrangement information refers to the arrangement information of the encryption and decryption algorithm actually used by the requesting end in the preset encryption and decryption algorithm library, that is, by specifically describing the arrangement position of an encryption and decryption algorithm in the algorithm library, the receiving end can determine the correct encryption and decryption algorithm in the encryption and decryption algorithm library using the same arrangement.

[0040] Specifically, the arrangement information used for the target positioning algorithm is usually expressed in the following forms:

[0041] Index: The unique number or position index of each algorithm in the library;

[0042] Category: Algorithms are classified by function or application area, such as sorting, searching, graph algorithms, etc.

[0043] Tags: Use keywords or tags to describe the characteristics and purpose of the algorithm;

[0044] Priority: Algorithms are arranged in order of performance or recommendation;

[0045] Version information: The arrangement of different versions or variants of an algorithm in a library.

[0046] And on this basis, it is also possible to combine the construction form of the library (for example, the library is constructed in the form of several rows and columns), and express the arrangement information according to the arrangement method corresponding to the construction form. For example, for an algorithm library constructed in the form of a 9×9 matrix, the arrangement information of the target encryption and decryption algorithm can be expressed as (4,5), that is, the algorithm in the 4th row and 5th column should be the target encryption and decryption algorithm.

[0047] A specific implementation method may include the following steps:

[0048] First, position description information related to characters used to describe positions (such as Chinese characters, English words, special characters, etc.) is extracted from the encryption and decryption algorithm description information (for example, the encryption and decryption algorithm stored in the fourth row and fifth column, such as (4,5), for example, the encryption and decryption algorithm that starts from the upper right corner and arrives in the order of bottom-down-right-right, etc.); then, the information related to the description arrangement in the position description information is determined as the algorithm arrangement information.

[0049] S103: Determine the encryption / decryption algorithm in the preset encryption / decryption algorithm library that corresponds to the arrangement position described by the algorithm arrangement information as the target encryption / decryption algorithm.

[0050] On the basis of S102, this step aims to determine, by the execution subject, the encryption / decryption algorithm in the preset encryption / decryption algorithm library corresponding to the arrangement position described by the algorithm arrangement information as the target encryption / decryption algorithm.

[0051] Among them, there may be only one or more preset encryption and decryption algorithm libraries. When there is only one preset encryption and decryption algorithm library, it must be located according to the algorithm arrangement information as the only encryption and decryption algorithm library; when there are multiple preset encryption and decryption algorithm libraries, it is also necessary to determine which preset encryption and decryption algorithm library should be the encryption and decryption algorithm library corresponding to the algorithm arrangement information, so as to perform correct positioning according to the algorithm arrangement information in the correct encryption and decryption algorithm, thereby ensuring the correctness of the positioning result.

[0052] S104, using the target encryption and decryption algorithm to decrypt the ciphertext data sent by the requesting end, and sending the ciphertext encrypted by the target encryption and decryption algorithm to the requesting end.

[0053] On the basis that the target encryption and decryption algorithm can be determined according to the algorithm arrangement information in S103, this step is intended for the above-mentioned execution subject to use the target encryption and decryption algorithm to decrypt the ciphertext data sent by the requesting end (for example, to decrypt the ciphertext information in the handshake request, or to decrypt the transmitted ciphertext data in the actual communication process after the handshake process is completed), and to encrypt the plaintext according to the target encryption and decryption algorithm to obtain the ciphertext and then send it to the requesting end when it is necessary to return the required data to the requesting end. That is, it covers all usage methods of the encryption and decryption algorithm, including both the encryption process and the decryption process.

[0054] The data encryption and decryption method provided in this embodiment does not directly record the encryption and decryption algorithm used in the handshake request initiated by the communication requesting end, but only records the description information of the encryption and decryption algorithm actually used, which can be correctly located due to the prior common agreement between it and the communication receiving end. The description information describes the arrangement position of the encryption and decryption algorithm actually used in the preset encryption and decryption algorithm library. Therefore, only the two ends that have arranged the encryption and decryption algorithms in the same arrangement in advance can correctly locate the encryption and decryption algorithm actually used, thereby effectively ensuring the security of data transmission.

[0055] In order to further improve security, when using multiple alternative encryption and decryption algorithm libraries, how to accurately determine the correct encryption and decryption algorithm library to locate the algorithm arrangement information to ensure the accuracy of the result is a key research direction for those skilled in the art. Figure 2 and Figure 3 Two different implementations are provided:

[0056] See first Figure 2 , Figure 2 A schematic diagram of a process of determining a target encryption and decryption algorithm library provided in an embodiment of the present application, wherein process 200 includes the following steps:

[0057] S201, determining a description method of arrangement information according to algorithm arrangement information.

[0058] This step is intended to allow the above-mentioned executor to determine the arrangement information description method based on the algorithm arrangement information. The arrangement information description method refers to the specific method used to describe the arrangement information, such as using an index, priority, version number, or numbering, library construction form, etc., that is, through different description methods of the arrangement information, try to distinguish multiple encryption and decryption algorithm libraries using different arrangement methods.

[0059] S202: Determine, from among a plurality of candidate encryption and decryption algorithm libraries, an encryption and decryption algorithm library that arranges algorithms in an arrangement information description manner as a target encryption and decryption algorithm library.

[0060] On the basis of S201, this step aims to determine, by the execution subject, among multiple candidate encryption and decryption algorithm libraries, the encryption and decryption algorithm library that uses the arrangement information description information to arrange the algorithms as the target encryption and decryption algorithm library. If the arrangement information description method determined in S201 is indexed, then the encryption and decryption algorithm library that uses the indexed method is determined as the target encryption and decryption algorithm library. This facilitates the subsequent determination of the target encryption and decryption algorithm according to the specific arrangement position presented by the algorithm arrangement information in the target encryption and decryption algorithm library.

[0061] S203: Determine the encryption / decryption algorithm in the target encryption / decryption algorithm library that corresponds to the arrangement position described by the algorithm arrangement information as the target encryption / decryption algorithm.

[0062] On the basis of S202, this step aims to determine, by the execution subject, the encryption / decryption algorithm in the target encryption / decryption algorithm library corresponding to the arrangement position described by the algorithm arrangement information as the target encryption / decryption algorithm.

[0063] It should be noted that this scheme is usually based on multiple different encryption and decryption algorithm libraries constructed based on different arrangement information description methods, and each arrangement information description method has a unique corresponding encryption and decryption algorithm library. If the same arrangement information description method corresponds to multiple different encryption and decryption algorithm libraries, additional uniquely determined related information is required to distinguish them. The specific implementation method is not listed here.

[0064] See also Figure 3 , Figure 3 A schematic diagram of another process of determining a target encryption and decryption algorithm library provided by an embodiment of the present application, wherein process 300 includes the following steps:

[0065] S301, determining encryption and decryption algorithm library description information according to encryption and decryption algorithm description information.

[0066] This step is intended for the execution subject to determine the encryption and decryption algorithm library description information based on the encryption and decryption algorithm description information, that is, to distinguish Figure 2 The provided embodiment requires the arrangement information description method determined by the algorithm arrangement information to locate the specific encryption and decryption algorithm library. This embodiment is based on the situation where the encryption and decryption algorithm description information carries the description information for determining the encryption and decryption algorithm library.

[0067] Specifically, the encryption / decryption algorithm library description information is description information that can uniquely identify an encryption / decryption algorithm library among multiple candidate encryption / decryption algorithm libraries, such as a library unique number, a library unique identifier, a library unique creation time, a library unique creation user, and the like.

[0068] S302: Determine a target encryption and decryption algorithm library from a plurality of candidate encryption and decryption algorithm libraries according to the encryption and decryption algorithm library description information.

[0069] On the basis of S301, this step aims to determine, by the execution subject, according to the encryption / decryption algorithm library description information, the encryption / decryption algorithm library corresponding to the encryption / decryption algorithm library description information from among multiple candidate encryption / decryption algorithm libraries as the target encryption / decryption algorithm library.

[0070] S303: Determine the encryption / decryption algorithm in the target encryption / decryption algorithm library that corresponds to the arrangement position described by the algorithm arrangement information as the target encryption / decryption algorithm.

[0071] On the basis of S302, this step aims to determine, by the execution subject, the encryption / decryption algorithm in the target encryption / decryption algorithm library corresponding to the arrangement position described by the algorithm arrangement information as the target encryption / decryption algorithm.

[0072] comprehensive Figure 2 and Figure 3 Two examples can be seen, Figure 2 Provides a description method based on the algorithm arrangement information to distinguish the implementation methods of different encryption and decryption algorithm libraries. Figure 3 A method for uniquely determining a target encryption and decryption algorithm library based on the encryption and decryption algorithm library description information additionally carried in the encryption and decryption algorithm description information is provided. An adaptive implementation method may be adopted according to different application scenarios, and no specific limitation is made here.

[0073] On the basis of any of the above embodiments, in order to further improve security, it is also possible to consider regularly adjusting the arrangement information of each encryption and decryption algorithm in the preset encryption and decryption algorithm library, that is, regularly updating the arrangement position of each encryption and decryption algorithm, so as to prevent a malicious third party from obtaining the correct encryption and decryption algorithm in an unexpected way and continuing to encrypt the ciphertext for subsequent transmission, so that the ciphertext it can decrypt is only a small part of the ciphertext before the update.

[0074] A specific implementation method may include the following steps:

[0075] First, the execution subject (e.g., the server as the receiving end) adjusts the arrangement position of each encryption and decryption algorithm in the preset encryption and decryption algorithm library according to a preset period to obtain the adjusted algorithm library; then, based on the obtained adjusted algorithm library, the first synchronization instruction of the algorithm library information is sent to the requesting end, so that the requesting end adjusts the arrangement position of each encryption and decryption algorithm in the preset encryption and decryption algorithm library recorded locally in response to the received first synchronization instruction. Thereby, the synchronous update of the arrangement position of the communication peer end is realized.

[0076] Another specific implementation method can be found in Figure 4 , Figure 4 A schematic diagram of a process of adjusting arrangement information according to a received synchronization instruction provided in an embodiment of the present application, wherein process 400 may include the following steps:

[0077] S401, receiving a second synchronization instruction of algorithm library information initiated by a requesting end.

[0078] Different from the previous implementation in which the server as the receiving end initiates the synchronization instruction, in this embodiment, the user equipment as the requesting end initiates the synchronization instruction.

[0079] S402: Extracting permission level information from the second synchronization instruction.

[0080] Taking into account that the synchronization instructions initiated by the user device as the requesting end require higher security than those of the server, the present embodiment attempts to extract permission level information from the second synchronization instruction, so as to confirm based on the permission level information that the user or object initiating the second synchronization instruction does have a sufficient security level, thereby minimizing the possibility that the second synchronization instruction is an erroneous synchronization instruction initiated by a malicious requesting end.

[0081] In this embodiment, the permission level information is used to indicate the security level of the user who initiated the instruction. Some specific forms of expression include:

[0082] Role-Based Access Control (RBAC): Manage access by defining roles and their permissions, for example:

[0083] Administrator: Full access to all system resources; Editor: Can modify content but cannot delete; Viewer: Can only view content, no modification permissions.

[0084] Access Control List (ACL): For each resource, specify a list of which users or roles have access to that resource and their permission levels, for example:

[0085] User A: read and write permissions; User B: read-only permissions.

[0086] Privilege Levels: Control access by defining multiple privilege levels, for example:

[0087] Level 1 permissions: basic user operation permissions; Level 2 permissions: additional operation permissions, such as setting personal configuration; Level 3 permissions: management permissions, such as system configuration and user management.

[0088] Policies: Define rules and conditions to determine permissions, for example:

[0089] Policy A: Allow access to certain sensitive data during working hours; Policy B: Only users who have passed multi-factor authentication can access specific functions.

[0090] Capabilities: Manage permissions based on a token or set of capabilities, for example:

[0091] Token X: can access file A and file B; Token Y: can access the database and application configuration.

[0092] Group-Based Access Control (GBAC): Control access by assigning users to different groups, each with different permissions, for example:

[0093] Group 1: has file access permissions; Group 2: has network configuration permissions.

[0094] Multi-factor authentication (MFA): Multiple authentication factors are required to determine permission levels, such as:

[0095] Single-factor authentication: basic access rights; two-factor authentication: elevated rights, allowing more sensitive operations.

[0096] These representations can be used individually or in combination to meet the security requirements of different systems and applications.

[0097] S403, in response to the actual authority level described by the authority level information being greater than the preset authority level, adjusting the original arrangement information of each encryption and decryption algorithm in the preset encryption and decryption algorithm library to the new arrangement information described in the second synchronization instruction.

[0098] This step is based on the fact that the actual authority level described by the authority level information is greater than the preset authority level, and is intended to enable the above-mentioned execution subject to adjust the original arrangement information of each encryption and decryption algorithm in the preset encryption and decryption algorithm library to the new arrangement information described in the second synchronization instruction.

[0099] By comparing the solutions provided by the above two embodiments, it can be seen that when adjusting the arrangement positions of the two ends based on the synchronization instruction, it is necessary to consider the security of the end that initiates the synchronization instruction, so as to provide a processing solution that matches its security or potential security risks, so as to avoid or reduce the occurrence of risks as much as possible.

[0100] The present application also provides a device for data encryption and decryption, the structure of which is as follows: Figure 5 The device 500 shown. The device 500 includes: an encryption and decryption algorithm description information extraction unit 510, configured to extract encryption and decryption algorithm description information from a handshake request initiated by a requesting end; an algorithm arrangement information determination unit 520, configured to determine algorithm arrangement information according to the encryption and decryption algorithm description information; a target encryption and decryption algorithm determination unit 530, configured to determine the encryption and decryption algorithm corresponding to the arrangement position described by the algorithm arrangement information in a preset encryption and decryption algorithm library as the target encryption and decryption algorithm; an encryption and decryption unit 540, configured to use the target encryption and decryption algorithm to decrypt the ciphertext data sent by the requesting end, and send the ciphertext encrypted by the target encryption and decryption algorithm to the requesting end.

[0101] In some embodiments, the encryption / decryption algorithm description information extraction unit 510 is further configured to obtain a handshake request initiated by the requesting end; and extract information recorded in a preset field in the handshake request as encryption / decryption algorithm description information.

[0102] In some embodiments, the algorithm arrangement information determination unit 520 is further configured to extract position description information related to characters used to describe positions from the encryption and decryption algorithm description information; and determine information related to the description arrangement in the position description information as the algorithm arrangement information.

[0103] In some embodiments, the target encryption and decryption algorithm determination unit 530 is further configured to determine the arrangement information description method according to the algorithm arrangement information; among multiple alternative encryption and decryption algorithm libraries, the encryption and decryption algorithm library that arranges algorithms using the arrangement information description method is determined as the target encryption and decryption algorithm library; the encryption and decryption algorithm corresponding to the arrangement position described by the algorithm arrangement information in the target encryption and decryption algorithm library is determined as the target encryption and decryption algorithm; the encryption and decryption algorithm corresponding to the arrangement position described by the algorithm arrangement information in the target encryption and decryption algorithm library is determined as the target encryption and decryption algorithm.

[0104] In some embodiments, the device 500 also includes: an encryption and decryption algorithm library description information determination unit, which is configured to determine the encryption and decryption algorithm library description information based on the encryption and decryption algorithm description information; the target encryption and decryption algorithm determination unit 530 is further configured to determine the target encryption and decryption algorithm library from multiple alternative encryption and decryption algorithm libraries based on the encryption and decryption algorithm library description information; and determine the encryption and decryption algorithm in the target encryption and decryption algorithm library that corresponds to the arrangement position described by the algorithm arrangement information as the target encryption and decryption algorithm.

[0105] In some embodiments, the device 500 also includes: an arrangement position adjustment unit, configured to adjust the arrangement position of each encryption and decryption algorithm in a preset encryption and decryption algorithm library according to a preset period to obtain an adjusted algorithm library; a first synchronization instruction initiating unit, configured to initiate a first synchronization instruction of the algorithm library information to the requesting end based on the obtained adjusted algorithm library.

[0106] In some embodiments, the device 500 also includes: a second synchronization instruction receiving unit, configured to receive a second synchronization instruction of the algorithm library information initiated by the requesting end; an authority level extraction unit, configured to extract the authority level information from the second synchronization instruction; and an arrangement information adjustment unit, configured to adjust the original arrangement information of each encryption and decryption algorithm in the preset encryption and decryption algorithm library to the new arrangement information described in the second synchronization instruction in response to the actual authority level described by the authority level information being greater than the preset authority level.

[0107] In the embodiment of the present device, the communication requesting end does not directly record the encryption and decryption algorithm used in the handshake request it initiates, but only records the description information of the encryption and decryption algorithm actually used, which can be correctly located due to the prior common agreement between it and the communication receiving end. The description information describes the arrangement position of the encryption and decryption algorithm actually used in the preset encryption and decryption algorithm library. Therefore, only the two ends that have arranged the encryption and decryption algorithms in the same arrangement in advance can correctly locate the encryption and decryption algorithm actually used, thereby effectively ensuring the security of data transmission.

[0108] Based on the same inventive concept, an electronic device, a readable storage medium and a computer program product are also provided in an embodiment of the present application. The method corresponding to the electronic device can be the data encryption and decryption method in the aforementioned embodiment, and its principle of solving the problem is similar to that of the method. The electronic device provided in an embodiment of the present application includes: at least one processor; and a memory connected to the at least one processor in communication; wherein the memory stores instructions executable by at least one processor, and the instructions are executed by at least one processor so that at least one processor can execute the methods and / or technical solutions of the aforementioned multiple embodiments of the present application.

[0109] The electronic device may be a user device, or a device formed by integrating a user device and a network device through a network, or an application running on the above device. The user device includes but is not limited to various terminal devices such as computers, mobile phones, tablet computers, smart watches, and bracelets. The network device includes but is not limited to network hosts, single network servers, multiple network server sets, or cloud computing-based computer sets, which can be used to implement some processing functions when setting an alarm. Here, the cloud is composed of a large number of hosts or network servers based on cloud computing, where cloud computing is a type of distributed computing, a virtual computer composed of a group of loosely coupled computer sets.

[0110] Figure 6 The structure of an electronic device suitable for implementing the method and / or technical solution in the embodiment of the present application is shown, and the electronic device 600 includes a central processing unit (CPU, Central Processing Unit) 601, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM, Read Only Memory) 602 or the program loaded from the storage part 608 to the random access memory (RAM, Random Access Memory) 603. In RAM 603, various programs and data required for system operation are also stored. CPU 601, ROM 602 and RAM 603 are connected to each other through bus 605. Input / output (I / O, Input / Output) interface 604 is also connected to bus 605.

[0111] The following components are connected to the I / O interface 604: an input section 606 including a keyboard, a mouse, a touch screen, a microphone, an infrared sensor, etc.; an output section 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), an LED display, an OLED display, etc., and a speaker, etc.; a storage section 608 including one or more computer-readable media such as a hard disk, an optical disk, a magnetic disk, a semiconductor memory, etc.; and a communication section 609 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 609 performs communication processing via a network such as the Internet.

[0112] In particular, the methods and / or embodiments in the embodiments of the present application may be implemented as computer software programs. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes program code for executing the method shown in the flowchart. When the computer program is executed by the central processing unit (CPU) 601, the above functions defined in the method of the present application are executed.

[0113] Another embodiment of the present application further provides a computer-readable storage medium and a computer program product, on which computer program instructions are stored. The computer program instructions can be executed by a processor to implement the methods and / or technical solutions of any one or more embodiments of the present application.

[0114] Specifically, the present embodiment can adopt any combination of one or more computer-readable media. Computer-readable media can be computer-readable signal media or computer-readable storage media. Computer-readable storage media can be, for example, systems, devices or devices including but not limited to electricity, magnetism, light, electromagnetic, infrared, or semiconductors, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: electrical connections with one or more wires, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above. In this document, computer-readable storage media can be any tangible medium containing or storing a program, which can be used by an instruction execution system, device or device or used in combination with it.

[0115] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer readable signal media may also be any computer readable medium other than a computer readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0116] The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0117] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0118] The flow chart or block diagram in the accompanying drawings shows the possible architecture, function and operation of the equipment, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated system for hardware that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0119] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0120] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of modules and units is only a logical function division. There may be other division methods in actual implementation. For example, with units as an example, multiple units or page components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0121] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0122] In addition, each functional module or unit in each embodiment of the present application may be integrated into one processing module or unit, or each module or unit may exist physically separately, or two or more units may be integrated into one module or unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional modules or units.

[0123] The above-mentioned integrated modules and units implemented in the form of software function modules and units can be stored in a computer-readable storage medium. The above-mentioned software function modules and units are stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor (processor) to perform some steps of the methods of each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), disk or optical disk and other media that can store program codes.

[0124] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

[0125] In addition, it is clear that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. Multiple units or devices stated in a device claim can also be implemented by one unit or device through software or hardware. The words first, second, etc. are used to indicate names, and do not indicate any particular order.

Claims

1. A data encryption and decryption method, characterized in that: include: Extract the encryption and decryption algorithm description information from the handshake request initiated by the requester; Determine algorithm arrangement information according to the encryption and decryption algorithm description information; Determine the encryption and decryption algorithm in the preset encryption and decryption algorithm library corresponding to the arrangement position described by the algorithm arrangement information as the target encryption and decryption algorithm; The target encryption and decryption algorithm is used to decrypt the ciphertext data sent by the requesting end, and the ciphertext encrypted by the target encryption and decryption algorithm is sent to the requesting end.

2. The method according to claim 1, characterized in that The extracting of encryption and decryption algorithm description information from the handshake request initiated by the requesting end includes: Obtaining a handshake request initiated by the requesting end; The information recorded in the preset field in the handshake request is extracted as the encryption / decryption algorithm description information.

3. The method according to claim 1, characterized in that The determining the algorithm arrangement information according to the encryption / decryption algorithm description information includes: Extracting location description information related to characters used to describe a location from the encryption / decryption algorithm description information; The information related to the description arrangement in the position description information is determined as the algorithm arrangement information.

4. The method according to claim 1, characterized in that: The step of determining the encryption / decryption algorithm in the preset encryption / decryption algorithm library corresponding to the arrangement position described by the algorithm arrangement information as the target encryption / decryption algorithm comprises: Determine a description method of arrangement information according to the algorithm arrangement information; Among multiple candidate encryption and decryption algorithm libraries, determining an encryption and decryption algorithm library that uses the arrangement information description method to perform algorithm arrangement as a target encryption and decryption algorithm library; The encryption / decryption algorithm in the target encryption / decryption algorithm library corresponding to the arrangement position described by the algorithm arrangement information is determined as the target encryption / decryption algorithm.

5. The method according to claim 1, characterized in that Also includes: Determine the encryption and decryption algorithm library description information according to the encryption and decryption algorithm description information; Correspondingly, determining the encryption and decryption algorithm corresponding to the arrangement position described by the algorithm arrangement information in the preset encryption and decryption algorithm library as the target encryption and decryption algorithm includes: Determining a target encryption and decryption algorithm library from a plurality of candidate encryption and decryption algorithm libraries according to the encryption and decryption algorithm library description information; The encryption / decryption algorithm in the target encryption / decryption algorithm library corresponding to the arrangement position described by the algorithm arrangement information is determined as the target encryption / decryption algorithm.

6. The method according to any one of claims 1 to 5, characterized in that: Also includes: Adjusting the arrangement position of each encryption and decryption algorithm in the preset encryption and decryption algorithm library according to a preset period to obtain an adjusted algorithm library; Based on the obtained adjusted algorithm library, a first synchronization instruction of the algorithm library information is initiated to the requesting end.

7. The method according to any one of claims 1 to 5, characterized in that: Also includes: Receiving a second synchronization instruction of the algorithm library information initiated by the requesting end; extracting permission level information from the second synchronization instruction; In response to the actual authority level described by the authority level information being greater than the preset authority level, original arrangement information of each encryption and decryption algorithm in the preset encryption and decryption algorithm library is adjusted to new arrangement information described in the second synchronization instruction.

8. A data encryption and decryption device, characterized in that: include: The encryption and decryption algorithm description information extraction unit is configured to extract the encryption and decryption algorithm description information from the handshake request initiated by the requesting end; an algorithm arrangement information determining unit, configured to determine the algorithm arrangement information according to the encryption and decryption algorithm description information; a target encryption and decryption algorithm determination unit, configured to determine an encryption and decryption algorithm in a preset encryption and decryption algorithm library corresponding to an arrangement position described by the algorithm arrangement information as a target encryption and decryption algorithm; The encryption and decryption unit is configured to use the target encryption and decryption algorithm to decrypt the ciphertext data sent by the requesting end, and send the ciphertext encrypted by the target encryption and decryption algorithm to the requesting end.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 7.

10. A computer-readable medium, characterized in that Computer program instructions are stored thereon, and the computer program instructions can be executed by a processor to implement the method as claimed in any one of claims 1 to 7.

11. A computer program product, characterized in that The invention comprises a computer program which, when executed by a processor, implements the method according to any one of claims 1 to 7.

Images