Encryption and decryption method and device

Abstract

The invention provides a data encryption and decryption method and device, and the method comprises the steps: responding to a business request initiated by a requester, and encrypting the business request; in response to calling the service request by a target application program, decrypting the encrypted service request based on pre-configured first security policy information to obtain plaintext data of the service request; and rewriting the service request based on the plaintext data, and issuing the rewritten service request to the target application program. According to the embodiment, the security policy information can be configured in advance, so that the universality of the encryption and decryption method is improved, and the development and maintenance cost is reduced.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a data encryption and decryption method and device. Background Art

[0002] With the development of Internet technology, network security issues have received increasing attention. In order to prevent data from being obtained during transmission, it is necessary to encrypt the relevant data. However, due to the complex and diverse structure of data, existing technologies often face problems such as high development and maintenance costs, poor versatility, and difficulty in ensuring stability when encrypting and decrypting data. Summary of the invention

[0003] In view of this, the embodiments of the present disclosure at least provide a data encryption and decryption method, device, electronic device and storage medium, which can improve the versatility of the encryption and decryption method, reduce development and maintenance costs, and thus improve the stability of the system.

[0004] In a first aspect, an embodiment of the present disclosure provides a data encryption and decryption method, the method comprising:

[0005] In response to a requester initiating a service request, encrypting the service request;

[0006] In response to the target application calling the service request, decrypting the encrypted service request based on the pre-configured first security policy information to obtain plaintext data of the service request;

[0007] The service request is rewritten based on the plaintext data, and the rewritten service request is sent to the target application.

[0008] In an optional implementation manner, encrypting the service request includes:

[0009] Obtaining pre-configured first security policy information and key information of a target application;

[0010] The service request is encrypted based on the first security policy information and the key information; wherein the first security policy information is used to indicate the fields and / or interfaces to be encrypted in the service request.

[0011] In an optional implementation manner, before decrypting the encrypted service request based on the pre-configured first security policy information, the method further includes:

[0012] Based on the statement library, the second security policy information with the wildcard is converted into the first security policy information.

[0013] In an optional implementation manner, the method further includes:

[0014] Receiving response data returned by the target application in response to the service request;

[0015] Encrypting the response data based on pre-configured first security policy information to obtain ciphertext data of the response data;

[0016] The response data is rewritten based on the ciphertext data, and the rewritten response data is sent to the requesting party.

[0017] In an optional implementation manner, the method further includes:

[0018] Obtaining update information for the first security policy information;

[0019] The first security policy information is updated based on the update information.

[0020] In a second aspect, the present disclosure also provides an encryption and decryption device, including:

[0021] An encryption module, configured to encrypt a service request in response to a service request initiated by a requester;

[0022] A decryption module, configured to, in response to a target application calling the service request, decrypt the encrypted service request based on pre-configured first security policy information to obtain plaintext data of the service request;

[0023] The interaction module is used to rewrite the service request based on the plaintext data and send the rewritten service request to the target application.

[0024] In an optional implementation, the device further includes:

[0025] A response module is used to receive response data returned by the target application in response to the business request; encrypt the response data based on pre-configured first security policy information to obtain ciphertext data of the response data; rewrite the response data based on the ciphertext data, and send the rewritten response data to the requester.

[0026] In an optional implementation, the device further includes:

[0027] An updating module is used to obtain update information for the first security policy information; and update the first security policy information based on the update information.

[0028] In a third aspect, an embodiment of the present disclosure further provides an electronic device, comprising: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the computer device is running, the processor and the memory communicate through the bus, and when the machine-readable instructions are executed by the processor, the steps in the above-mentioned first aspect, or any optional implementation of the first aspect are performed.

[0029] In a fourth aspect, an embodiment of the present disclosure further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned first aspect, or any optional implementation of the first aspect are executed.

[0030] Any one of the above aspects or any implementation of any one of the aspects can, in response to a requester initiating a service request, encrypt the service request; in response to a target application calling the service request, decrypt the encrypted service request based on the pre-configured first security policy information to obtain the plaintext data of the service request; rewrite the service request based on the plaintext data, and send the rewritten service request to the target application. Thus, by decrypting the encrypted service request through the pre-configured security policy information, the versatility of the encryption and decryption method can be improved, thereby improving the stability of the system.

[0031] In a further embodiment of the present disclosure, when a corresponding encryption and decryption method is added or modified, it can be updated by obtaining update information of the security policy information, thereby further improving the versatility of the encryption and decryption method and reducing development and maintenance costs.

[0032] In a further embodiment of the present disclosure, when there are statements with wildcards in the security policy information, they can also be converted into statements with indexes based on a statement library to implement encryption and decryption of corresponding data, which can further improve the versatility of the encryption and decryption method.

[0033] The effects of the above-mentioned encryption and decryption device, electronic device and storage medium refer to the description of the above-mentioned encryption and decryption method, which will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the following is a brief introduction to the drawings required for use in the embodiments. The drawings herein are incorporated into the specification and constitute a part of the specification. These drawings illustrate embodiments consistent with the present disclosure and are used together with the specification to illustrate the technical solutions of the present disclosure. It should be understood that the following drawings only illustrate certain embodiments of the present disclosure and should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can also be obtained based on these drawings without creative work.

[0035] Figure 1 A flowchart of an encryption and decryption method provided by an embodiment of the present disclosure is shown;

[0036] Figure 2 A schematic diagram of an encryption and decryption device provided by an embodiment of the present disclosure is shown;

[0037] Figure 3 An exemplary system architecture is shown in which embodiments of the present disclosure may be applied;

[0038] Figure 4 A schematic diagram of the structure of a computer system of a terminal device or a server used to implement an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical scheme and advantages of the embodiments of the present disclosure clearer, the technical scheme in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all of the embodiments. The components of the embodiments of the present disclosure generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present disclosure provided in the drawings is not intended to limit the scope of the present disclosure for protection, but merely represents the selected embodiments of the present disclosure. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present disclosure.

[0040] It should be noted that in the technical solution of the present invention, the collection, use, storage, sharing and transfer of user personal information involved are in compliance with the provisions of relevant laws and regulations, and it is necessary to inform the user and obtain the user's consent or authorization. When applicable, the user's personal information is de-identified and / or anonymized and / or encrypted.

[0041] Research has found that with the development of Internet technology, network security issues have received increasing attention. If important data or information is leaked, it may cause irreparable losses. Therefore, when transmitting data, in order to prevent the data from being obtained during the transmission process, it is necessary to encrypt some sensitive data or information.

[0042] In the existing technology, because the structure of the message is complex and diverse, hard coding or AOP (Aspect Oriented Programming) combined with annotations are usually used. However, the development and maintenance costs of the existing technology are high when it comes to multiple structural levels, and in the face of the situation where interfaces may be added or modified at any time as the business develops, the existing technology cannot guarantee the versatility and stability of the system.

[0043] Based on the above research, the disclosed embodiment can decrypt the encrypted business request through the pre-configured security policy information, which can improve the versatility of the encryption and decryption method, thereby improving the stability of the system. In addition, when the corresponding encryption and decryption method is added or modified, it can be updated by obtaining the update information of the security policy information, thereby further improving the versatility of the encryption and decryption method and reducing the development and maintenance costs. In addition, when there are statements with wildcards in the security policy information, it can also be converted into statements with indexes based on the statement library to realize the encryption and decryption of the corresponding data, which can further improve the versatility of the encryption and decryption method.

[0044] The raising of the above problems and the solutions are the results obtained by the inventor after practice and careful research. The discovery process of the above problems and the solutions proposed for the above problems should be the contributions made by the inventor to the present disclosure during the disclosure process.

[0045] The technical solutions in the present disclosure will be clearly and completely described below in conjunction with the drawings in the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all of the embodiments. The components of the present disclosure generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present disclosure provided in the drawings is not intended to limit the scope of the present disclosure claimed for protection, but merely represents the selected embodiments of the present disclosure. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present disclosure.

[0046] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0047] To facilitate understanding of this embodiment, a method for encryption and decryption disclosed in the embodiment of the present disclosure is first introduced in detail. The execution subject of the method for encryption and decryption provided in the embodiment of the present disclosure is generally a computer device with certain computing capabilities, and the computer device includes, for example: a terminal device or a server or other processing device, and the terminal device may be a user equipment (UE), a mobile device, a user terminal, a terminal, a cellular phone, a cordless phone, a personal digital assistant (PDA), a handheld device, a computing device, a vehicle-mounted device, a wearable device, etc. In some possible implementations, the method for encryption and decryption may be implemented by a processor calling a computer-readable instruction stored in a memory.

[0048] See also Figure 1 FIG. 1 is a flowchart of an encryption and decryption method provided by an embodiment of the present disclosure, wherein the method includes S101 to S103, wherein:

[0049] S101: In response to a service request initiated by a requesting party, the service request is encrypted.

[0050] In the embodiment of the present disclosure, the execution subject of data encryption and decryption can obtain the service request initiated by the requesting party, where the requesting party can be a user client or any other device or module associated with the execution subject.

[0051] In the disclosed embodiment, after receiving a service request, the data encryption and decryption execution subject may encrypt the service request, thereby protecting the privacy and security of the service request data.

[0052] In an embodiment of the present disclosure, encrypting the business request includes: obtaining pre-configured first security policy information and key information of the target application; encrypting the business request based on the first security policy information and the key information; wherein the first security policy information is used to indicate the fields and / or interfaces to be encrypted in the business request.

[0053] Specifically, the security policy information may be configured in advance by relevant personnel and saved, wherein the security policy information may include interfaces and fields that need to be encrypted and decrypted; it should be noted here that, since the fields that need to be encrypted and decrypted for request data and response data of the same interface are different, when configuring the security policy information, the form of "interface-request field list-response field list" may be adopted to indicate which fields in the request and response need to be encrypted and decrypted respectively under the interface.

[0054] For example, using the JSONPath structure configuration as an example, the configuration items of the security policy information may also include the following:

[0055] (1) “-demo”: unique application service identifier, used to identify the security policy information configured under a target application;

[0056] (2) certAlias: security policy identifier, used to describe the method used when performing encryption and decryption, such as symmetric encryption, asymmetric encryption, etc.

[0057] (3) apis: Configure the list of interfaces that need to be encrypted and decrypted. It can be in the form of a collection, which can contain multiple interfaces that need to be encrypted and decrypted;

[0058] (4) Interface configuration: the interface (url) and request (requestKeys) and response fields (responseKeys) that can perform encryption and decryption;

[0059] (5) url: a single interface address that needs to perform encryption and decryption, used to identify the encryption and decryption fields of the request and response when accepting client requests;

[0060] (6) requestKeys: a list of fields to be decrypted in the interface request message. Multiple fields can be configured. Each configuration item represents a field or a field stored in one or more collections in a multi-level organization.

[0061] (7) responseKeys: A list of fields that need to be encrypted in the interface response message. Multiple fields can be configured. Each configuration item represents a field or a field stored in one or more collections in a multi-level organization.

[0062] It should be noted that the configuration items in the above security policy information are only a possible implementation method of the embodiment of the present disclosure and do not constitute an improper limitation of the present invention. In practical applications, they should be combined with actual conditions to achieve their purposes. The embodiment of the present disclosure does not make specific limitations on this.

[0063] In a specific implementation, after the security policy information is configured, the requester that initiates the service request can be initialized. Specifically, the requester can first pull the security policy information, and on the premise of determining that the relevant security policy information has been configured, the security key of the target application can be obtained, so that when the service request is subsequently encrypted, the service request can be directly encrypted according to the security configuration information and the security key, ensuring the security of the service data.

[0064] S102: In response to the target application calling the service request, the encrypted service request is decrypted based on pre-configured first security policy information to obtain plaintext data of the service request.

[0065] In an embodiment of the present disclosure, in response to the target application calling the service request, before decrypting the encrypted service request based on the pre-configured first security policy information, the second security policy information with wildcards can also be converted into the first security policy information based on the statement library.

[0066] In a specific implementation, JSONPath configuration or any other feasible configuration statements can be used in the security policy information, such as String structure, collection form, etc. For example, taking the use of JSONPath structure configuration as an example, for a relatively simple KV (Key-Value) structure, a clear JSONPath configuration can be used, such as $.data.contactPersonInfo.name, etc.; and for a more complex Array structure, a JSONPath wildcard configuration can be used, such as $.data[*].acceptorName, etc.

[0067] In the disclosed embodiment, such configuration statements with wildcards can be regarded as second security policy information, and can be converted into clear first security policy information based on the statement library. The statement library here is used to parse the data items of each level and the relationship between the levels according to the corresponding grammatical structure. For the collection form, each data item in the collection will be marked one by one according to the index from 0 to N based on the specific data, and then organized into indexed configuration statements according to the bottom-up hierarchical relationship. Exemplarily, taking the JSONPath configuration statement as an example, the statement library can be the JSON-Path class library, and the Configuration property needs to be configured during the conversion.

[0068] In the embodiment of the present disclosure, update information for the first security policy information may also be obtained; and the first security policy information may be updated based on the update information.

[0069] In the specific implementation, when adding or modifying interfaces, the fields that need to be encrypted and decrypted can be set by adding or changing security policy information, which has strong versatility and flexibility.

[0070] In the disclosed embodiment, after obtaining a clear configuration statement through parsing, the service request can be decrypted to obtain the plaintext data of the interface and field corresponding to the security configuration information.

[0071] S103: Rewrite the service request based on the plaintext data, and send the rewritten service request to the target application.

[0072] In this step, since the plaintext data of the corresponding field in the business request has been obtained in the previous step, the business request can be rewritten based on the plaintext data to obtain the complete business request data, and then the rewritten business request is sent to the target application to perform the corresponding operation.

[0073] In the disclosed embodiment, the response data returned by the target application in response to the service request may also be encrypted and decrypted to transmit it back to the requester who initiated the service request.

[0074] Specifically, the execution entity of data encryption and decryption can receive the response data returned by the target application in response to the business request; encrypt the response data based on the pre-configured first security policy information to obtain the ciphertext data of the response data; rewrite the response data based on the ciphertext data, and send the rewritten response data to the requester. The specific implementation method is similar to the method for encrypting and decrypting the business request mentioned above, and will not be repeated here.

[0075] In a specific implementation, after receiving the encrypted response data returned by the target application, the requester can decrypt it based on the key information and security configuration information, thereby ensuring the security and privacy of data transmission between the requester and the target application.

[0076] According to a second aspect of the embodiment of the present disclosure, Figure 2 As shown, a data encryption and decryption device 200 is provided, comprising:

[0077] The encryption module 201 is used to encrypt the service request in response to the service request initiated by the requester;

[0078] The decryption module 202 is used to, in response to the target application calling the service request, decrypt the encrypted service request based on the pre-configured first security policy information to obtain the plaintext data of the service request;

[0079] The interaction module 203 is used to rewrite the service request based on the plaintext data, and send the rewritten service request to the target application.

[0080] Optionally, the encryption module 201 is further used for:

[0081] Obtaining pre-configured first security policy information and key information of a target application;

[0082] The service request is encrypted based on the first security policy information and the key information; wherein the first security policy information is used to indicate the fields and / or interfaces to be encrypted in the service request.

[0083] Optionally, the decryption module 202 is further configured to:

[0084] Based on the statement library, the second security policy information with the wildcard is converted into the first security policy information.

[0085] Optionally, the device further comprises:

[0086] The response module 204 is used to receive the response data returned by the target application in response to the business request; encrypt the response data based on the pre-configured first security policy information to obtain the ciphertext data of the response data; rewrite the response data based on the ciphertext data, and send the rewritten response data to the requesting party.

[0087] Optionally, the device further comprises:

[0088] The updating module 205 is configured to obtain update information for the first security policy information; and update the first security policy information based on the update information.

[0089] According to the third aspect of an embodiment of the present disclosure, an encryption and decryption electronic device is provided, comprising: one or more processors; a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method provided by the first aspect of the embodiment of the present invention.

[0090] According to a fourth aspect of an embodiment of the present disclosure, a computer-readable medium is provided, on which a computer program is stored, and when the program is executed by a processor, the method provided by the first aspect of the embodiment of the present disclosure is implemented.

[0091] Figure 3 An exemplary system architecture 300 is shown to which the encryption and decryption method or encryption and decryption device implemented by the present disclosure can be applied.

[0092] like Figure 3 As shown, the system architecture 300 may include terminal devices 301, 302, 303, a network 304 and a server 305. The network 304 is used to provide a medium for communication links between the terminal devices 301, 302, 303 and the server 305. The network 304 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0093] Users can use terminal devices 301, 302, 303 to interact with server 305 through network 304 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 301, 302, 303, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0094] The terminal devices 301 , 302 , and 303 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers, etc.

[0095] The server 305 may be a server that provides various services, such as a background management server (only an example) that provides support for shopping websites browsed by users using the terminal devices 301, 302, and 303. The background management server may process the received encryption and decryption requests and feed back the processing results (only an example) to the terminal device.

[0096] It should be noted that the encryption and decryption method provided in the embodiment of the present invention is generally performed by the server 305, and accordingly, the encryption and decryption device is generally set in the server 305. The encryption and decryption method provided in the embodiment of the present invention can also be performed by the terminal devices 301, 302, and 303, and accordingly, the encryption and decryption device can be set in the terminal devices 301, 302, and 303.

[0097] It should be understood that Figure 3 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0098] Reference below Figure 4 , which shows a schematic diagram of the structure of a computer system 400 of a terminal device suitable for implementing an embodiment of the present invention. Figure 4 The terminal device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0099] like Figure 4 As shown, the computer system 400 includes a central processing unit (CPU) 401, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 402 or a program loaded from a storage part 408 into a random access memory (RAM) 403. In the RAM 403, various programs and data required for the operation of the system 400 are also stored. The CPU 401, the ROM 402, and the RAM 403 are connected to each other through a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.

[0100] The following components are connected to the I / O interface 405: an input section 406 including a keyboard, a mouse, etc.; an output section 407 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 408 including a hard disk, etc.; and a communication section 409 including a network interface card such as a LAN card, a modem, etc. The communication section 409 performs communication processing via a network such as the Internet. A drive 410 is also connected to the I / O interface 405 as needed. A removable medium 411, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 410 as needed, so that a computer program read therefrom is installed into the storage section 408 as needed.

[0101] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 409, and / or installed from the removable medium 411. When the computer program is executed by the central processing unit (CPU) 401, the above-mentioned functions defined in the system of the present invention are executed.

[0102] It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0103] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0104] The modules involved in the embodiments of the present invention may be implemented in software or hardware. The modules described may also be set in a processor. For example, a processor includes an encryption module, a decryption module, an interaction module, a response module, and an update module, wherein the names of these modules do not constitute a limitation on the modules themselves in certain circumstances. For example, the encryption module may also be described as "a module that encrypts the service request in response to a service request initiated by a requesting party".

[0105] As another aspect, the present invention further provides a computer-readable medium, which may be included in the device described in the above embodiment; or may exist independently without being assembled into the device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by a device, the device implements the following method:

[0106] In response to a requester initiating a service request, encrypting the service request;

[0107] In response to the target application calling the service request, decrypting the encrypted service request based on the pre-configured first security policy information to obtain plaintext data of the service request;

[0108] The service request is rewritten based on the plaintext data, and the rewritten service request is sent to the target application.

[0109] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present disclosure, which are used to illustrate the technical solutions of the present disclosure, rather than to limit them. The protection scope of the present disclosure is not limited thereto. Although the present disclosure is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed in the present disclosure, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present disclosure, and should be included in the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure shall be based on the protection scope of the claims.

Claims

1. A data encryption and decryption method, characterized in that: include: In response to a requester initiating a service request, encrypting the service request; In response to the target application calling the service request, decrypting the encrypted service request based on the pre-configured first security policy information to obtain plaintext data of the service request; The service request is rewritten based on the plaintext data, and the rewritten service request is sent to the target application.

2. The method according to claim 1, characterized in that Encrypting the service request includes: Obtaining pre-configured first security policy information and key information of a target application; The service request is encrypted based on the first security policy information and the key information; wherein the first security policy information is used to indicate the fields and / or interfaces to be encrypted in the service request.

3. The method according to claim 1, characterized in that Before decrypting the encrypted service request based on the pre-configured first security policy information, the method further includes: Based on the statement library, the second security policy information with the wildcard is converted into the first security policy information.

4. The method according to claim 1, characterized in that The method further comprises: Receiving response data returned by the target application in response to the service request; Encrypting the response data based on pre-configured first security policy information to obtain ciphertext data of the response data; The response data is rewritten based on the ciphertext data, and the rewritten response data is sent to the requesting party.

5. The method according to claim 1, characterized in that The method further comprises: Obtaining update information for the first security policy information; The first security policy information is updated based on the update information.

6. A data encryption and decryption device, characterized in that: include: An encryption module, configured to encrypt a service request in response to a service request initiated by a requester; A decryption module, configured to, in response to a target application calling the service request, decrypt the encrypted service request based on pre-configured first security policy information to obtain plaintext data of the service request; The interaction module is used to rewrite the service request based on the plaintext data and send the rewritten service request to the target application.

7. The device according to claim 6, characterized in that The device also includes: A response module is used to receive response data returned by the target application in response to the business request; encrypt the response data based on pre-configured first security policy information to obtain ciphertext data of the response data; rewrite the response data based on the ciphertext data, and send the rewritten response data to the requester.

8. The device according to claim 6, characterized in that The device also includes: An updating module is used to obtain update information for the first security policy information; and update the first security policy information based on the update information.

9. An electronic device, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 5.

10. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images