Method, system and device for decrypting encrypted data

Abstract

The embodiment of the invention provides a decryption method, system and device for encrypted data, and the decryption method applied to a key server comprises the steps: receiving a first key application request from a decryption user side; obtaining a key permission table, wherein the key permission table comprises a first permission and a second permission; according to a key permission table, performing permission verification on the first key application request to obtain a permission verification result, the permission verification result being used for indicating whether the first user system information has a first permission or a second permission; and if the permission verification result is that the first user system information has the first permission or the second permission, sending an original key of the original encrypted data to a decryption user side, so that the decryption user side decrypts the original encrypted data according to the original key. According to the decryption method, computing resources required in the key updating process can be reduced, the key updating efficiency is improved, and the user experience is improved. The invention relates to the technical field of data encryption and decryption.

Description

Technical Field

[0001] The present application relates to the technical field of data encryption and decryption, and in particular to a method, system and device for decrypting encrypted data. Background Art

[0002] With the rapid development of the Internet, people pay more and more attention to data security. In order to protect data from being illegally stolen or tampered with, it is usually necessary to encrypt and decrypt the data.

[0003] At present, for the sake of data security, the existing encryption and decryption methods usually require regular key updates after data encryption. This method requires decrypting the encrypted data during each key update process, and then re-encrypting the data based on the updated key. The required computing resources are large and the update efficiency is low. In addition, this method requires users to re-verify permissions for the updated key after each update, and the user experience is unsatisfactory.

[0004] Therefore, the problems existing in the prior art still need to be solved and optimized. Summary of the invention

[0005] The object of the present invention is to solve one of the technical problems existing in the related art to at least some extent.

[0006] The main purpose of the embodiments of the present application is to propose a method, system and device for decrypting encrypted data, wherein the decryption method can reduce the computing resources required for the key update process, improve the key update efficiency, and improve the user experience.

[0007] To achieve the above object, a first aspect of an embodiment of the present application proposes a decryption method for encrypted data, which is applied to a key server. The decryption method comprises the following steps:

[0008] Receiving a first key application request from a decryption client, wherein the first key application request includes first user system information of the decryption client and an original key code of original encrypted data;

[0009] Obtain a key permission table, the key permission table including a first permission and a second permission, the first permission being a key permission corresponding to the original key code, and the second permission being a key permission corresponding to the updated original key code;

[0010] According to the key permission table, performing permission verification on the first key application request to obtain a permission verification result, wherein the permission verification result is used to indicate whether the first user system information has the first permission or the second permission;

[0011] If the authority verification result is that the first user system information has the first authority or the second authority, the original key of the original encrypted data is sent to the decryption client, so that the decryption client decrypts the original encrypted data according to the original key.

[0012] In some embodiments, the decryption method further comprises:

[0013] Acquire current trigger data, preset key update conditions and a first key, where the first key is the original key or the updated original key;

[0014] According to the key update condition, condition verification is performed on the current trigger data to obtain a condition verification result, where the condition verification result is used to indicate whether the current trigger data satisfies the key update condition;

[0015] If the condition verification result is that the current trigger data meets the key update condition, the first key is updated to obtain a second key, and a third permission corresponding to the second key is generated;

[0016] The current key permission table is updated according to the second key and the third permission to obtain an updated key permission table.

[0017] In some embodiments, performing permission verification on the first key application request according to the key permission table to obtain a permission verification result includes:

[0018] Performing first permission information verification on the first permission according to the first user system information to obtain a first verification result;

[0019] Performing second permission information verification on the second permission according to the first user system information to obtain a second verification result;

[0020] The authority verification result is determined according to the first verification result and the second verification result.

[0021] In some embodiments, the original encrypted data is obtained by the following steps:

[0022] receiving a second key application request from an encryption client, wherein the second key application request includes second user system information of the encryption client;

[0023] generating, according to the second key application request, a third key and a third key code corresponding to the second user system information;

[0024] The third key and the third key code are sent to the encryption client, so that the encryption client constructs encrypted data for the preset data to be encrypted according to the third key and the third key code to obtain the original encrypted data, wherein the original encrypted data includes the third key code and the encrypted data to be encrypted.

[0025] To achieve the above-mentioned purpose, a second aspect of an embodiment of the present application proposes a decryption method for encrypted data, which is applied to a decryption user terminal. The decryption method includes:

[0026] Sending a first key application request to a key server, wherein the first key application request includes the first user system information of the decryption client and the original key code of the original encrypted data;

[0027] Receiving an original key corresponding to the original encrypted data returned by the key server, and decrypting the original encrypted data according to the original key;

[0028] The original key is obtained by the following steps:

[0029] The key server obtains a key permission table, the key permission table including a first permission and a second permission, the first permission being a key permission corresponding to the original key code, and the second permission being a key permission corresponding to the updated original key code;

[0030] The key server performs permission verification on the first key application request according to the key permission table to obtain a permission verification result, where the permission verification result is used to indicate whether the first user system information has the first permission or the second permission;

[0031] If the authority verification result is that the first user system information has the first authority or the second authority, the key server sends the original key of the original encrypted data to the decryption client.

[0032] In some embodiments, the decryption method further comprises:

[0033] Obtaining a system default key and a system key code corresponding to the first user system information;

[0034] According to the system key code, the original key code is verified for consistency to obtain a code verification result, wherein the code verification result is used to indicate whether the system key code is consistent with the original key code;

[0035] If the code verification result is that the system key code is consistent with the original key code, the original encrypted data is decrypted according to the system default key.

[0036] In some embodiments, the decryption method further comprises:

[0037] Acquire second user system information corresponding to the original encrypted data;

[0038] According to the second user system information, the first user system information is processed by a permission request construction to obtain a permission application request;

[0039] The permission application request is sent to the key server, so that the key server updates the key permission table according to the permission application request, and then obtains the permission table update result returned by the key server.

[0040] To achieve the above purpose, a third aspect of an embodiment of the present application proposes a method for decrypting encrypted data, comprising:

[0041] The decryption client sends a first key application request to the key server, wherein the first key application request includes the first user system information of the decryption client and the original key code of the original encrypted data;

[0042] The key server obtains a key permission table, the key permission table including a first permission and a second permission, the first permission being a key permission corresponding to the original key code, and the second permission being a key permission corresponding to the updated original key code;

[0043] The key server performs permission verification on the first key application request according to the key permission table to obtain a permission verification result, where the permission verification result is used to indicate whether the first user system information has the first permission or the second permission;

[0044] If the authority verification result is that the first user system information has the first authority or the second authority, the key server sends the original key of the original encrypted data to the decryption client;

[0045] The decryption client decrypts the original encrypted data according to the original key.

[0046] To achieve the above-mentioned purpose, a fourth aspect of the embodiments of the present application proposes a decryption system for encrypted data, including a decryption client and a key server;

[0047] The decryption client is used to send a first key application request to the key server, wherein the first key application request includes the first user system information of the decryption client and the original key code of the original encrypted data; decrypt the original encrypted data according to the original key;

[0048] The key server is used to obtain a key permission table, the key permission table includes a first permission and a second permission, the first permission is the key permission corresponding to the original key code, and the second permission is the key permission corresponding to the updated original key code; according to the key permission table, the first key application request is subjected to permission verification to obtain a permission verification result, and the permission verification result is used to indicate whether the first user system information has the first permission or the second permission; if the permission verification result is that the first user system information has the first permission or the second permission, the original key of the original encrypted data is sent to the decryption user end.

[0049] To achieve the above-mentioned purpose, a fifth aspect of an embodiment of the present application proposes a decryption device for encrypted data, which is applied to a key server. The decryption system includes:

[0050] A first processing unit, configured to receive a first key application request from a decryption client, wherein the first key application request includes first user system information of the decryption client and an original key code of original encrypted data;

[0051] a second processing unit, configured to obtain a key permission table, the key permission table including a first permission and a second permission, the first permission being a key permission corresponding to the original key code, and the second permission being a key permission corresponding to the updated original key code;

[0052] A third processing unit is used to perform permission verification on the first key application request according to the key permission table to obtain a permission verification result, where the permission verification result is used to indicate whether the first user system information has the first permission or the second permission;

[0053] The fourth processing unit is used to send the original key of the original encrypted data to the decryption client if the result of the authority verification is that the first user system information has the first authority or the second authority, so that the decryption client decrypts the original encrypted data according to the original key.

[0054] To achieve the above-mentioned purpose, the sixth aspect of an embodiment of the present application proposes an electronic device, which includes a memory and a processor, wherein the memory stores a computer program, and the processor implements the above-mentioned method when executing the computer program.

[0055] To achieve the above-mentioned purpose, the seventh aspect of the embodiments of the present application proposes a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program implements the above-mentioned method when executed by a processor.

[0056] The present application proposes a method, system and device for decrypting encrypted data, wherein the decryption method applied to a key server receives a first key application request from a decryption client, wherein the first key application request includes the first user system information of the decryption client and the original key code of the original encrypted data; obtains a key permission table, wherein the key permission table includes a first permission and a second permission, wherein the first permission is a key permission corresponding to the original key code, and the second permission is a key permission corresponding to the updated original key code; according to the key permission table, performs permission verification on the first key application request to obtain a permission verification result, wherein the permission verification result is used to indicate whether the first user system information has the first permission or the second permission; if the permission verification result is that the first user system information has the first permission or the second permission, the original key of the original encrypted data is sent to the decryption client, so that the decryption client decrypts the original encrypted data according to the original key. The decryption method is based on a key permission table that records the first permission and the second permission, so that the user no longer needs to re-verify the permission for the updated key after the key is updated, which can effectively improve the user experience; in addition, the decryption method performs permission verification on the first key application request through the key permission table, and can obtain the original key corresponding to the original encrypted data when the first user system information on the decryption user end has the first permission or the second permission. This can eliminate the need to decrypt the encrypted data and then re-encrypt it during the key update process, which can effectively reduce the computing resources required for the key update process and improve the key update efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the embodiments of the present application or the drawings of the related technical solutions in the prior art are introduced below. It should be understood that the drawings introduced below are only for the convenience of clearly expressing some embodiments of the technical solutions of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0058] Figure 1 It is a flowchart of a method for decrypting encrypted data provided by an embodiment of the present application;

[0059] Figure 2 is a flowchart of step S103 provided in an embodiment of the present application;

[0060] Figure 3 This is an optional flowchart of a method for decrypting encrypted data provided in an embodiment of the present application;

[0061] Figure 4This is another optional flowchart of a method for decrypting encrypted data provided in an embodiment of the present application;

[0062] Figure 5 It is a structural schematic diagram of a decryption device for encrypted data provided in an embodiment of the present application;

[0063] Figure 6 It is a schematic diagram of the hardware structure of the electronic device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0064] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0065] It should be noted that, although the functional modules are divided in the device schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first", "second", etc. in the specification, claims and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0066] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0067] At present, for the sake of data security, the existing encryption and decryption methods usually require regular key updates after data encryption. This method requires decrypting the encrypted data during each key update process, and then re-encrypting the data based on the updated key. It requires more computing resources and has low update efficiency. In addition, this method requires users to re-verify permissions for the updated key and the updated encrypted data after each update, which is not a satisfactory user experience. In addition, due to factors such as the incompatibility of the new and old keys during the key update process, this method will have an adverse impact on the business that needs to use the data, and data security and business continuity are poor.

[0068] In view of this, an embodiment of the present application provides a method, system and device for decrypting encrypted data, wherein the decryption method is based on a key permission table that records the first permission and the second permission, so that the user no longer needs to re-verify the permission for the updated key and the updated encrypted data after the key is updated, which can effectively improve the user experience; in addition, the decryption method verifies the permission of the first key application request through the key permission table, and returns the original key corresponding to the original encrypted data when the first user system information of the decryption user end has the first permission or the second permission, which can eliminate the need to decrypt the encrypted data and then re-encrypt it during the key update process, which can effectively reduce the computing resources required for the key update process, improve the key update efficiency, and thus improve data security and business continuity.

[0069] The embodiments of the present application provide a method, system and device for decrypting encrypted data, which are specifically described through the following embodiments.

[0070] The method provided in the embodiment of the present application can be applied to digital medical application scenarios or digital financial application scenarios. In digital medical application scenarios or digital financial application scenarios, the data service provider can encrypt and decrypt data by using a decryption method for encrypted data provided in its embodiment, which can reduce the computing resources required for the key update process, improve the key update efficiency, and improve the user experience.

[0071] The method provided in the embodiment of the present application can be applied to the terminal, can also be applied to the server side, and can also be software running in the terminal or the server side. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, etc.; the server side can be configured as an independent physical server, or a server cluster or distributed system composed of multiple physical servers, and can also be configured as a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application that implements the above method, etc., but is not limited to the above forms.

[0072] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0073] It should be noted that in each specific implementation of the present application, when it comes to the need to perform relevant processing based on data related to user identity or characteristics such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first, and the collection, use, and processing of these data will comply with relevant laws, regulations, and standards. In addition, when the embodiment of the present application needs to obtain the user's sensitive personal information, the user's separate permission or consent will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining the user's separate permission or consent, the necessary user-related data for the normal operation of the embodiment of the present application will be obtained.

[0074] Figure 1 is an optional flow chart of a method for decrypting encrypted data provided in an embodiment of the present application, the method being applied to a key server, Figure 1 The decryption method may include but is not limited to steps S101 to S104.

[0075] Step S101: receiving a first key application request from a decryption client, wherein the first key application request includes first user system information of the decryption client and an original key code of original encrypted data;

[0076] In an embodiment of the present application, the decryption user terminal can be a user terminal that decrypts the original encrypted data, and the user terminal can specifically be a user terminal loaded with the SDK software tool; in addition, the user terminal can be an encryption user terminal that encrypts and generates the original encrypted data, or it can be other user terminals that receive the original encrypted data.

[0077] It can be understood that the first user system information is used to represent the information of the decryption user terminal, which can specifically include any one of the user account code, system code, etc.; the original encrypted data includes the original key code and the encrypted data to be encrypted, wherein the original key code is the coded data of the original key, which can specifically be the coded ID of the original key, which is used to indicate the corresponding original key to the key server, and the original key is the encryption key of the data to be encrypted. It should be noted that after obtaining the first user system information and the original key code, the decryption user terminal can construct a first key application request based on the obtained first user system information and the original key code, and send the first key application request to the key server through the gateway. There are many specific construction methods, which will not be repeated in this application.

[0078] Step S102: Obtain a key permission table, wherein the key permission table includes a first permission and a second permission, wherein the first permission is a key permission corresponding to the original key code, and the second permission is a key permission corresponding to the updated original key code;

[0079] In an embodiment of the present application, after receiving the first key application request, the key server can obtain the key authority table currently corresponding to the original key code based on the original key code in the first key application request, and the key authority table includes the first permission and the second permission, and each key permission records the user system information with the corresponding key decryption permission.

[0080] It can be understood that the second authority in the embodiment of the present application can be the key authority corresponding to the latest second key; it can also be the key authority of all different historical versions of the updated original key. For example, the original key obtains two historical versions of updated original keys during two key update processes, which are respectively recorded as the first updated key and the second updated key. The first updated key and the second updated key can both be the updated original key mentioned in the embodiment of the present application.

[0081] Step S103: According to the key permission table, perform permission verification on the first key application request to obtain a permission verification result, where the permission verification result is used to indicate whether the first user system information has the first permission or the second permission;

[0082] In the embodiment of the present application, the authority verification in step S103 is used to verify whether the first user system information of the decryption user terminal has the first authority or the second authority. Specifically, if the first user system information has the first authority or the second authority, it can be explained that the decryption user terminal has obtained the decryption authority for the specific original encrypted data before or after a certain key update process; on the contrary, if the first user system information does not have the first authority and the second authority, it means that the decryption user terminal has not obtained the decryption authority for the specific original encrypted data before or after all key update processes, and at this time, the key server can directly return the signal data of the rejection of the application to the decryption user terminal.

[0083] It should be noted that, for a certain encrypted data, the embodiment of the present application records the latest second permission corresponding to the encrypted data based on the key permission table, while retaining the first permission and several previous historical versions of the second permission. This allows the user to no longer need to re-verify the permission for the updated key and the updated encrypted data after the key is updated, which can effectively improve the user experience.

[0084] Reference Figure 2 In some embodiments, the step S103, performing permission verification on the first key application request according to the key permission table to obtain a permission verification result, includes:

[0085] Step S1031: Perform first permission information verification on the first permission according to the first user system information to obtain a first verification result;

[0086] Step S1032: Perform second permission information verification on the second permission according to the first user system information to obtain a second verification result;

[0087] Step S1033: Determine the authority verification result according to the first verification result and the second verification result.

[0088] In an embodiment of the present application, step S1031 may first be that the key server obtains system information of several users with first authority recorded in its own database, and then compares and matches each user system information with first authority one by one according to the first user system information. If the first user system information is consistent with any user system information with first authority in the key server, a first verification result indicating that the user has the first authority is obtained; conversely, if the first user system information is inconsistent with all user system information with first authority in the key server, a first verification result indicating that the user does not have the first authority is obtained.

[0089] It can be understood that the content of step S1032 is similar to the content of the aforementioned step S1032, and it can be simply inferred that after obtaining the first verification result or the second verification result respectively, the authority verification result can be directly determined based on the first verification result and the second verification result. If the authority verification result is that the first user system information does not have the first authority and does not have the second authority, the key server can return an error message of no authority at this time.

[0090] Step S104: If the authority verification result is that the first user system information has the first authority or the second authority, the original key of the original encrypted data is sent to the decryption client, so that the decryption client decrypts the original encrypted data according to the original key.

[0091] In an embodiment of the present application, if the result of the authority verification is that the first user system information has the first authority or has the second authority, the key server can obtain the corresponding original key based on the original key code in the first key application request, and send the obtained original key to the decryption client, so that the decryption client decrypts the original encrypted data based on the original key.

[0092] It should be noted that the embodiment of the present application verifies the authority of the first key application request through the key authority table, and returns the original key corresponding to the original encrypted data when the first user system information of the decrypted user terminal has any one of the first authority or the second authority. This can eliminate the need to decrypt the encrypted data and then re-encrypt it during the key update process, which can effectively reduce the computing resources required for the key update process, improve the key update efficiency, and thus improve data security and business continuity.

[0093] Reference Figure 3 In some embodiments, the decryption method further comprises:

[0094] Step S201, obtaining current trigger data, a preset key update condition and a first key, where the first key is the original key or the updated original key;

[0095] Step S202: According to the key update condition, condition verification is performed on the current trigger data to obtain a condition verification result, where the condition verification result is used to indicate whether the current trigger data meets the key update condition;

[0096] Step S203: If the condition verification result is that the current trigger data meets the key update condition, the first key is updated to obtain a second key, and a third permission corresponding to the second key is generated;

[0097] Step S204: Update the current key permission table according to the second key and the third permission to obtain an updated key permission table.

[0098] In an embodiment of the present application, the current trigger data corresponds to a preset key update condition. Specifically, if the key update condition is the key update time, the current trigger data may be the current standard time; or, if the key update condition is whether the key server administrator issues a key update instruction, the current trigger data may be the key update instruction of the key server administrator. The present application only provides examples of the key update condition and the current trigger data.

[0099] It is understandable that the condition verification in step S202 can be to verify the current trigger data in real time according to the key update condition, or can be to trigger the condition verification based on a parameter setting such as a preset time interval, time point, etc., and there are many specific implementation methods. In addition, after obtaining the condition verification result, if the condition verification result is that the current trigger data does not meet the key update condition, the key server can wait for the next condition verification.

[0100] It should be noted that if the condition verification result is that the current trigger data meets the key update condition, the key update in step S203 can be inputting the first key into a key derivation function, and the specific key derivation function includes PBKDF2 function, HKDF function, etc., so as to obtain the second key; or, generating a key based on a random number generation method or a key generation algorithm, and updating the first key based on the generated key, so as to obtain the second key. In addition, after obtaining the second key, the key server can generate a corresponding third permission for the second key. There are many specific generation methods, which will not be repeated in this application.

[0101] It is worth mentioning that the permission table update in step S204 can be based on the second key, and the third permission in the current key permission table can be replaced and updated. Specifically, it can be based on the second key, determining the second permission corresponding to the corresponding original key, and then replacing the second permission in the current key permission table with the third permission, so as to obtain an updated key permission table; or, the permission table update in step S204 can also be based on the second key and the third permission, and the current key permission table can be supplemented and updated. Specifically, it can be based on the second key, determining the corresponding original key and first permission in the current key permission table, and then adding the second key and the third permission to the corresponding original key and first permission list in the current key permission table, so as to obtain an updated key permission table. The example of this application is for illustration only and does not limit this application.

[0102] In some embodiments, the original encrypted data is obtained by the following steps:

[0103] Step S301: receiving a second key application request from an encryption client, where the second key application request includes second user system information of the encryption client;

[0104] Step S302: Generate a third key and a third key code corresponding to the second user system information according to the second key application request;

[0105] Step S303: Send the third key and the third key code to the encryption client, so that the encryption client constructs encrypted data for the preset data to be encrypted according to the third key and the third key code to obtain the original encrypted data, wherein the original encrypted data includes the third key code and the encrypted data to be encrypted.

[0106] In an embodiment of the present application, the encryption user terminal and the decryption user terminal can be the same user terminal or different user terminals; the second key application request is used to instruct the key server to generate and return the original key corresponding to the current second key application request, which includes the second user system information of the encryption user terminal. The second user system information is similar to the aforementioned first user system information and can be simply inferred.

[0107] It can be understood that after receiving the second key application request, the key server may first perform an application verification on the second key application request. If the encryption client corresponding to the second key application request does not have the authority to apply for the original key, the key server may return an error message of no authority; or, if the encryption client corresponding to the second key application request has the authority to apply for the original key, the key server may generate a third key and a third key code corresponding to the second key application request, and generate a corresponding key authority based on the third key or the third key code, and add the key authority to the key authority table.

[0108] It should be noted that after the encryption client receives the third key and the third key code, the encryption data construction in the encryption client can first encrypt the data to be encrypted based on the third key to obtain the encrypted data to be encrypted; then, the third key code is determined as a data header, and the data header and the encrypted data to be encrypted are taken as a whole to obtain the original encrypted data through encoding operations.

[0109] In addition, the embodiment of the present application also provides a method for decrypting encrypted data, which is applied to a decryption user terminal, and the decryption method includes:

[0110] Step S401: Send a first key application request to a key server, wherein the first key application request includes the first user system information of the decryption client and the original key code of the original encrypted data;

[0111] Step S402: receiving an original key corresponding to the original encrypted data returned by the key server, and decrypting the original encrypted data according to the original key;

[0112] The original key is obtained by the following steps:

[0113] The key server obtains a key permission table, the key permission table including a first permission and a second permission, the first permission being a key permission corresponding to the original key code, and the second permission being a key permission corresponding to the updated original key code;

[0114] The key server performs permission verification on the first key application request according to the key permission table to obtain a permission verification result, where the permission verification result is used to indicate whether the first user system information has the first permission or the second permission;

[0115] If the authority verification result is that the first user system information has the first authority or the second authority, the key server sends the original key of the original encrypted data to the decryption client.

[0116] In an embodiment of the present application, the content of step S401 is similar to the content of the aforementioned step S101, and can be simply deduced by analogy, and step S402 can first decode the original encrypted data to obtain the original key encoding and the encrypted data to be encrypted, respectively, and then based on the obtained original key, perform decryption calculation on the encrypted data to be encrypted to obtain the original data to be encrypted.

[0117] It can be understood that the method of obtaining the original key is similar to the contents of the aforementioned steps S102 to S104 and can be simply deduced by analogy.

[0118] In some embodiments, the decryption method further comprises:

[0119] Step S501: Obtain a system default key and a system key code corresponding to the first user system information;

[0120] Step S502: According to the system key code, the original key code is verified for consistency to obtain a code verification result, wherein the code verification result is used to indicate whether the system key code is consistent with the original key code;

[0121] Step S503: If the coding verification result is that the system key coding is consistent with the original key coding, the original encrypted data is decrypted according to the system default key.

[0122] In the embodiment of the present application, while the encryption client encrypts the historical data to be encrypted and obtains the historical original encrypted data, it can also store the historical original key and the historical original key code corresponding to the encryption process locally on the encryption client. The stored historical original key can be recorded as the system default key, and the stored historical original key code can be recorded as the system key code. Since the encryption client and the decryption client can be the same user terminal, after receiving a certain original encrypted data, the decryption client can first obtain the local system default key and system key code of the decryption client.

[0123] It can be understood that after obtaining a certain original encrypted data, the decryption user end can first decode the original encrypted data to obtain the original key code corresponding to the current original encrypted data and the encrypted data to be encrypted; then step S502 can be based on the consistency verification of the system key code and the current original key code. If the system key code is inconsistent with the current original key code, it means that the decryption user end does not have the decryption key or decryption key authority of the current original encrypted data. At this time, the decryption user end can jump to execute the relevant steps of obtaining the decryption key or decryption key authority of the current original encrypted data; or, if the system key code is consistent with the current original key code, it means that the decryption user end has the decryption key or decryption key authority of the current original encrypted data. At this time, the decryption user end can directly decrypt the encrypted data to be encrypted in the original encrypted data based on the local system default key to obtain the original data to be encrypted.

[0124] Reference Figure 4 In some embodiments, the decryption method further comprises:

[0125] Step S601, obtaining second user system information corresponding to the original encrypted data;

[0126] Step S602: Perform permission request construction processing on the first user system information according to the second user system information to obtain a permission application request;

[0127] Step S603: Send the permission application request to the key server, so that the key server updates the key permission table according to the permission application request, and then obtains the permission table update result returned by the key server.

[0128] In an embodiment of the present application, for step S601, if the decryption user terminal does not have the decryption key or decryption key authority for the current original encrypted data, the decryption user terminal can first decode the current original encrypted data, and obtain the second user system information based on the original key code in the current original encrypted data. Specifically, the original key code can be determined as the second user system information, or the system code of the corresponding user terminal (such as the encryption user terminal) is obtained based on the original key code, etc. The example of this application is for illustration only.

[0129] It can be understood that the permission application request is used to instruct the key server to assign decryption key permissions corresponding to the current original encrypted data to the decryption user terminal, and the permission request construction process in step S602 can be to construct a permission application request based on the first user system information and the second user system information, wherein the first user system information is used to indicate the target user terminal that requires decryption key permissions, and the second user system information is used to indicate the original encrypted data that requires the original decryption key.

[0130] It should be noted that after receiving the permission application request, the key server can generate key permissions corresponding to the current original encrypted data based on the permission application request, and then update the key permission table based on the generated key permissions. The specific key permission table update content is similar to the content of the aforementioned step S204, so as to obtain an updated key permission table and the corresponding permission table update result.

[0131] In addition, the embodiment of the present application also provides a method for decrypting encrypted data, the decryption method comprising:

[0132] The decryption client sends a first key application request to the key server, wherein the first key application request includes the first user system information of the decryption client and the original key code of the original encrypted data;

[0133] The key server obtains a key permission table, the key permission table including a first permission and a second permission, the first permission being a key permission corresponding to the original key code, and the second permission being a key permission corresponding to the updated original key code;

[0134] The key server performs permission verification on the first key application request according to the key permission table to obtain a permission verification result, where the permission verification result is used to indicate whether the first user system information has the first permission or the second permission;

[0135] If the authority verification result is that the first user system information has the first authority or the second authority, the key server sends the original key of the original encrypted data to the decryption client;

[0136] The decryption client decrypts the original encrypted data according to the original key.

[0137] It can be understood that this method is similar to the aforementioned method embodiment and can be simply deduced by analogy, so it will not be described in detail here.

[0138] The embodiment of the present application also provides a decryption system for encrypted data, including a decryption client and a key server;

[0139] The decryption client is used to send a first key application request to the key server, wherein the first key application request includes the first user system information of the decryption client and the original key code of the original encrypted data; decrypt the original encrypted data according to the original key;

[0140] The key server is used to obtain a key permission table, the key permission table includes a first permission and a second permission, the first permission is the key permission corresponding to the original key code, and the second permission is the key permission corresponding to the updated original key code; according to the key permission table, the first key application request is subjected to permission verification to obtain a permission verification result, and the permission verification result is used to indicate whether the first user system information has the first permission or the second permission; if the permission verification result is that the first user system information has the first permission or the second permission, the original key of the original encrypted data is sent to the decryption user end.

[0141] It can be understood that the specific implementation of the system is basically the same as the specific embodiment of the above method, and will not be repeated here.

[0142] See also Figure 5 The embodiment of the present application further provides a decryption device for encrypted data, which is applied to a key server, and the decryption system includes:

[0143] The first processing unit 801 is used to receive a first key application request from a decryption client, where the first key application request includes first user system information of the decryption client and an original key code of original encrypted data;

[0144] The second processing unit 802 is configured to obtain a key permission table, where the key permission table includes a first permission and a second permission, where the first permission is a key permission corresponding to the original key code, and the second permission is a key permission corresponding to the updated original key code;

[0145] The third processing unit 803 is used to perform permission verification on the first key application request according to the key permission table to obtain a permission verification result, where the permission verification result is used to indicate whether the first user system information has the first permission or the second permission;

[0146] The fourth processing unit 804 is used to send the original key of the original encrypted data to the decryption client if the result of the authority verification is that the first user system information has the first authority or the second authority, so that the decryption client decrypts the original encrypted data according to the original key.

[0147] It can be understood that the specific implementation of the system is basically the same as the specific embodiment of the above method, and will not be repeated here.

[0148] The embodiment of the present application also provides an electronic device, the electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the above method when executing the computer program. The electronic device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0149] See also Figure 6 , Figure 6 The hardware structure of an electronic device of another embodiment is illustrated, and the electronic device includes:

[0150] The processor 901 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application.

[0151] The memory 902 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 902 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 902, and the processor 901 calls and executes the methods of the embodiments of this application;

[0152] Input / output interface 903, used to implement information input and output;

[0153] Communication interface 904, used to realize communication interaction between the device and other devices, which can be realized through wired mode (such as USB, network cable, etc.) or wireless mode (such as mobile network, WI FI, Bluetooth, etc.);

[0154] A bus 905 that transmits information between various components of the device (e.g., the processor 901, the memory 902, the input / output interface 903, and the communication interface 904);

[0155] The processor 901 , the memory 902 , the input / output interface 903 and the communication interface 904 are connected to each other in communication within the device via a bus 905 .

[0156] An embodiment of the present application further provides a computer-readable storage medium, which stores a computer program, and the computer program implements the above method when executed by a processor.

[0157] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0158] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0159] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0160] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0161] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0162] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0163] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0164] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0165] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0166] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0167] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0168] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

Claims

1. A method for decrypting encrypted data, characterized in that: Applied to a key server, the decryption method includes: Receiving a first key application request from a decryption client, wherein the first key application request includes first user system information of the decryption client and an original key code of original encrypted data; Obtain a key permission table, the key permission table including a first permission and a second permission, the first permission being a key permission corresponding to the original key code, and the second permission being a key permission corresponding to the updated original key code; According to the key permission table, performing permission verification on the first key application request to obtain a permission verification result, wherein the permission verification result is used to indicate whether the first user system information has the first permission or the second permission; If the authority verification result is that the first user system information has the first authority or the second authority, the original key of the original encrypted data is sent to the decryption client, so that the decryption client decrypts the original encrypted data according to the original key.

2. The decryption method according to claim 1, characterized in that: The decryption method further comprises: Acquire current trigger data, preset key update conditions and a first key, where the first key is the original key or the updated original key; According to the key update condition, condition verification is performed on the current trigger data to obtain a condition verification result, where the condition verification result is used to indicate whether the current trigger data satisfies the key update condition; If the condition verification result is that the current trigger data meets the key update condition, the first key is updated to obtain a second key, and a third permission corresponding to the second key is generated; The current key permission table is updated according to the second key and the third permission to obtain an updated key permission table.

3. The decryption method according to claim 1, characterized in that: The step of performing permission verification on the first key application request according to the key permission table to obtain a permission verification result includes: Performing first permission information verification on the first permission according to the first user system information to obtain a first verification result; Performing second permission information verification on the second permission according to the first user system information to obtain a second verification result; The authority verification result is determined according to the first verification result and the second verification result.

4. The decryption method according to claim 1, characterized in that: The original encrypted data is obtained by the following steps: receiving a second key application request from an encryption client, wherein the second key application request includes second user system information of the encryption client; generating, according to the second key application request, a third key and a third key code corresponding to the second user system information; The third key and the third key code are sent to the encryption client, so that the encryption client constructs encrypted data for the preset data to be encrypted according to the third key and the third key code to obtain the original encrypted data, wherein the original encrypted data includes the third key code and the encrypted data to be encrypted.

5. A method for decrypting encrypted data, characterized in that: Applied to decryption user end, the decryption method includes: Sending a first key application request to a key server, wherein the first key application request includes the first user system information of the decryption client and the original key code of the original encrypted data; Receiving an original key corresponding to the original encrypted data returned by the key server, and decrypting the original encrypted data according to the original key; The original key is obtained by the following steps: The key server obtains a key permission table, the key permission table including a first permission and a second permission, the first permission being a key permission corresponding to the original key code, and the second permission being a key permission corresponding to the updated original key code; The key server performs permission verification on the first key application request according to the key permission table to obtain a permission verification result, where the permission verification result is used to indicate whether the first user system information has the first permission or the second permission; If the authority verification result is that the first user system information has the first authority or the second authority, the key server sends the original key of the original encrypted data to the decryption client.

6. The decryption method according to claim 5, characterized in that: The decryption method further comprises: Obtaining a system default key and a system key code corresponding to the first user system information; According to the system key code, the original key code is verified for consistency to obtain a code verification result, wherein the code verification result is used to indicate whether the system key code is consistent with the original key code; If the code verification result is that the system key code is consistent with the original key code, the original encrypted data is decrypted according to the system default key.

7. The decryption method according to claim 5, further comprising: Acquire second user system information corresponding to the original encrypted data; According to the second user system information, the first user system information is processed by a permission request construction to obtain a permission application request; The permission application request is sent to the key server, so that the key server updates the key permission table according to the permission application request, and then obtains the permission table update result returned by the key server.

8. A method for decrypting encrypted data, characterized in that: include: The decryption client sends a first key application request to the key server, wherein the first key application request includes the first user system information of the decryption client and the original key code of the original encrypted data; The key server obtains a key permission table, the key permission table including a first permission and a second permission, the first permission being a key permission corresponding to the original key code, and the second permission being a key permission corresponding to the updated original key code; The key server performs permission verification on the first key application request according to the key permission table to obtain a permission verification result, where the permission verification result is used to indicate whether the first user system information has the first permission or the second permission; If the authority verification result is that the first user system information has the first authority or the second authority, the key server sends the original key of the original encrypted data to the decryption client; The decryption client decrypts the original encrypted data according to the original key.

9. A decryption system for encrypted data, characterized in that: Including decryption client and key server; The decryption client is used to send a first key application request to the key server, wherein the first key application request includes the first user system information of the decryption client and the original key code of the original encrypted data; Decrypting the original encrypted data according to the original key; The key server is configured to obtain a key permission table, the key permission table including a first permission and a second permission, the first permission being a key permission corresponding to the original key code, and the second permission being a key permission corresponding to the updated original key code; performing permission verification on the first key application request according to the key permission table to obtain a permission verification result, the permission verification result being used to indicate whether the first user system information has the first permission or the second permission; If the authority verification result is that the first user system information has the first authority or the second authority, the original key of the original encrypted data is sent to the decryption client.

10. A decryption device for encrypted data, characterized in that: Applied to a key server, the decryption system comprises: A first processing unit, configured to receive a first key application request from a decryption client, wherein the first key application request includes first user system information of the decryption client and an original key code of original encrypted data; a second processing unit, configured to obtain a key permission table, the key permission table including a first permission and a second permission, the first permission being a key permission corresponding to the original key code, and the second permission being a key permission corresponding to the updated original key code; A third processing unit is used to perform permission verification on the first key application request according to the key permission table to obtain a permission verification result, where the permission verification result is used to indicate whether the first user system information has the first permission or the second permission; The fourth processing unit is used to send the original key of the original encrypted data to the decryption client if the result of the authority verification is that the first user system information has the first authority or the second authority, so that the decryption client decrypts the original encrypted data according to the original key.

Images