A method and system for data encryption and decryption

Abstract

This invention relates to a method and system for data encryption and decryption. The method encrypts the data to be encrypted using a dynamic original key. It then encrypts the dynamic original key using all first keys obtained from a key management platform to obtain a first target key. A first number of first keys are selected from all the first keys and combined into a second number of combinations. Each combined key is used to encrypt the dynamic original key to obtain a second target key. When decrypting the encrypted data, if all key requests are answered, the first target key is decrypted using the first key; otherwise, the second target key is decrypted using the combined key obtained from the answered first keys. Finally, the encrypted data is decrypted using the decrypted target key to obtain the original data. Therefore, this invention can still decrypt encrypted data even if the key management platform fails, improving reliability.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a method and system for data encryption and decryption. Background Technology

[0002] Current data encryption and decryption typically involves a central platform acquiring the data, encrypting it using an encryption key obtained from a key management platform, and then storing the encrypted data. When the data is needed, the central platform requests the encryption key from the key management platform, uses the obtained encryption key to decrypt the encrypted data, and thus obtains the decrypted data. This method relies on a key management platform, which may become unusable due to business needs or other reasons. Therefore, there are situations where the central platform cannot obtain the decryption key, resulting in the data being undecryptable. Summary of the Invention

[0003] The technical problem to be solved by the present invention is to provide a method and system for data encryption and decryption, thereby improving the reliability of data encryption and decryption.

[0004] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows:

[0005] In a first aspect, the present invention provides a method for encrypting and decrypting data, comprising:

[0006] Obtain a dynamic raw key, encrypt the data to be encrypted using the dynamic raw key to obtain encrypted data, perform a hash calculation on the dynamic raw key to obtain a first hash value, and store the first hash value in the monitoring platform;

[0007] Obtain the first key from all key management platforms, and encrypt the dynamic original key using all the first keys to obtain the first target key;

[0008] Select a first number of first keys from all the first keys and combine them into a second number of combinations to obtain all combined keys. Encrypt the dynamic original key with each combined key to obtain all the second target keys.

[0009] When decrypting the encrypted data, a key request is sent to all key management platforms. It is determined whether all key requests have been responded to. If so, the first target key is decrypted using the first key obtained from all key requests to obtain the decrypted target key. If not, the combined key obtained by combining the first keys obtained from the key requests is used to decrypt all second target keys to obtain the decrypted target key. The hash value of the decrypted target key is calculated to obtain the second hash value. A verification request is sent to the monitoring platform to obtain the first hash value. It is determined whether the first hash value and the second hash value are the same. If so, the encrypted data is decrypted using the decrypted target key corresponding to the second hash value to obtain the original data.

[0010] The beneficial effects of this invention are as follows: Encrypting data to be encrypted using a dynamic original key ensures that backend administrators cannot directly use the original key to illegally decrypt or leak the data, guaranteeing the security of the data to be encrypted. When encrypting the dynamic original key, not only is encryption performed using the first keys from all key management platforms, but a first number of first keys are also selected from all first keys for a second number of combinations. The resulting combined key is then used to encrypt the dynamic original key. This ensures that when decrypting the encrypted data, if not all first keys can be obtained from the key management platform (i.e., if the key management platform fails or malfunctions), the combined key obtained from the first keys obtained from a responding key management platform can be used to decrypt the second target key. The target key corresponding to the second hash value, which is identical to the first hash value of the dynamic original key, is then used to decrypt the encrypted data, thus obtaining the original data. Furthermore, the first hash value is obtained from the monitoring platform, ensuring its security and enabling the decryption of the encrypted data, thereby improving the reliability of data encryption and decryption.

[0011] Optionally, the process of obtaining the dynamic raw key includes:

[0012] Generate dynamic raw keys in a trusted execution environment.

[0013] As described above, the dynamic raw key is generated in a trusted execution environment to ensure its security.

[0014] Optionally, generating the dynamic raw key in the trusted execution environment includes:

[0015] Obtain the local physical key and generate a random number. Then, use an encryption algorithm to superimpose the physical key and the random number onto the dynamic original key to generate a new dynamic original key.

[0016] As described above, the final dynamic raw key is obtained by superimposing a physical key and a random number on the original raw key, using multiple encryption methods to improve the security and flexibility of the dynamic raw key.

[0017] Optionally, encrypting the dynamic original key using all the first keys to obtain the first target key includes:

[0018] The dynamic original key is encrypted sequentially using each first key to obtain the first target key;

[0019] and / or

[0020] A new first key is generated by superimposing all the first keys using an encryption algorithm, and the dynamic original key is then encrypted using the new first key to obtain the first target key;

[0021] and / or

[0022] All the first keys are encrypted with each other using an encryption algorithm to obtain all the encrypted first keys. The dynamic original key is then encrypted with all the encrypted first keys to obtain all the first target keys.

[0023] As described above, by encrypting the dynamic original key in a variety of ways using all first keys, the flexibility of the first target key is improved while its security is also enhanced.

[0024] Optionally, the step of selecting a first number of first keys from all the first keys and combining them a second number of times to obtain all combined keys includes:

[0025] Substituting the first quantity and the second quantity into the combination formula, we obtain all possible combinations. Based on all the possible combinations, we obtain all possible combination keys. The combination formula is as follows:

[0026]

[0027] Where P represents the total number of combinations, n represents the first number, and m represents the second number.

[0028] Optionally, the second quantity is (1, the first quantity).

[0029] As described above, the number of combinations is calculated using a combination formula, and the second number is (1, the first number], meaning that the second number has multiple possibilities, resulting in a variety of combination methods. This ensures the comprehensiveness of all obtained combination numbers and improves the diversity and comprehensiveness of the obtained combination keys.

[0030] Optionally, the method further includes:

[0031] Store the first target key and all the second target keys locally.

[0032] As described above, storing the first and second target keys locally reduces reliance on the key management platform, while storing the first hash value on the monitoring platform facilitates real-time monitoring of data decryption events related to the first hash value, thereby improving security.

[0033] Optionally, if not, then decrypting all the second target keys using the combined key obtained by combining the first key obtained from the key request includes:

[0034] The key management platform that does not respond to the key request is designated as an invalid platform, and the second target key associated with the invalid platform is deleted.

[0035] As described above, for key management platforms that do not respond, i.e., invalid platforms, the second target key associated with them will be deleted to reduce resource consumption.

[0036] Optionally, designating a key management platform that does not respond to the key request as an invalid platform includes:

[0037] An alarm is issued for the failed platform.

[0038] As described above, an alert will be issued for a failed platform, facilitating timely maintenance of the failed platform.

[0039] In a second aspect, the present invention provides a data encryption and decryption system, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that the processor executes the computer program to implement the data encryption and decryption method described in the first aspect.

[0040] The technical effects of the data encryption and decryption system provided in the second aspect are described in the relevant description of the data encryption and decryption method provided in the first aspect. Attached Figure Description

[0041] Figure 1 This is a flowchart of a data encryption and decryption method provided in this embodiment;

[0042] Figure 2 This is a schematic diagram of the overall process of a data encryption and decryption method provided in this embodiment;

[0043] Figure 3 This is a schematic diagram of the structure of a data encryption and decryption system provided in this embodiment.

[0044] [Explanation of Labels in the Attached Image]

[0045] 1. A data encryption and decryption system;

[0046] 2. Processor;

[0047] 3. Memory. Detailed Implementation

[0048] To better understand the above technical solutions, exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the drawings, it should be understood that the present invention can be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that the present invention can be understood more clearly and thoroughly, and that the scope of the present invention can be fully conveyed to those skilled in the art.

[0049] Example 1

[0050] When applied to a target device, this embodiment treats the target device as a device for managing encrypted data. The first key of the key management platform is a highly complex key generated by the key management platform. The key management platform provides a key transmission interface to the target device and transmits the first key generated and managed by the key management platform through the interface. The target device uses the first keys of multiple key management platforms to manage data. Compared with the scheme where the target device generates keys and stores them in the key management platform, the first key generated by the key management platform in this scheme has higher complexity and security. In addition, this scheme requires less modification to the key management platform and is easy to implement.

[0051] The specific technical solutions are discussed below.

[0052] Please refer to Figures 1 to 2 This invention provides a method for encrypting and decrypting data, comprising the following steps:

[0053] S1. Obtain the dynamic original key, encrypt the data to be encrypted using the dynamic original key to obtain encrypted data, perform hash calculation on the dynamic original key to obtain a first hash value, and store the first hash value in the monitoring platform.

[0054] In this embodiment, as Figure 2 As shown, the description is based on the central platform as the execution entity. That is, the central platform encrypts the data to be encrypted using the obtained dynamic original key, thereby obtaining the encrypted data, performs a hash calculation on the dynamic original key to obtain the first hash value, and stores the first hash value on the regulatory platform.

[0055] At this point, before obtaining the dynamic raw key in step S1, the following is included:

[0056] S10. Generate a dynamic raw key in a trusted execution environment.

[0057] At this point, step S10 includes:

[0058] S101. Obtain the local physical key and generate a random number. Use an encryption algorithm to superimpose the physical key and the random number onto the dynamic original key to generate a new dynamic original key.

[0059] In this embodiment, as Figure 2 As shown, a dynamic raw key is generated in a trusted execution environment, and a local physical key and a random number are obtained. A new dynamic raw key is generated by superimposing the physical key and the random number on the dynamic raw key through an encryption algorithm.

[0060] S2. Obtain the first keys from all key management platforms, and encrypt the dynamic original key using all the first keys to obtain the first target key. This scheme can be applied to the target device (or central platform), which manages encrypted data. In this scheme, the first key of the key management platform is a highly complex key generated by the key management platform. Furthermore, the key management platform provides a key transmission interface to the target device, and transmits the keys generated and managed by the key management platform through the interface. The target device uses keys from multiple key management platforms to manage data. Compared to the scheme where the target device generates keys and stores them in the key management platform, the key generated by the key management platform in this scheme is more complex and has higher security. In addition, this scheme requires minimal modification to the key management platform and is easy to implement.

[0061] At this point, step S2, which involves encrypting the dynamic original key using all the first keys to obtain the first target key, includes:

[0062] S21. Encrypt the dynamic original key sequentially using each first key to obtain the first target key;

[0063] In this embodiment, as Figure 2 As shown, the dynamic original key is encrypted sequentially using each first key. For example, there are key management platforms 1, 2, 3, 4, and 5, with corresponding first keys M1, M2, M3, M4, and M5 respectively. The dynamic original key is K1. Then, K1 is encrypted sequentially using M1, M2, M3, M4, and M5 to obtain the first target key.

[0064] and / or

[0065] S22. By superimposing all the first keys using an encryption algorithm to generate a new first key, the dynamic original key is encrypted using the new first key to obtain the first target key;

[0066] In this embodiment, as Figure 2 As shown, a new first key is generated by superimposing all the first keys through an encryption algorithm. That is, M1, M2, M3, M4 and M5 are superimposed through an encryption algorithm to obtain a new first key, such as G1. Then, the dynamic original key K1 is encrypted through G1 to obtain the first target key.

[0067] and / or

[0068] S23. Encrypt all the first keys with each other using an encryption algorithm to obtain all encrypted first keys. Then, encrypt the dynamic original key with all the encrypted first keys to obtain all the first target keys.

[0069] In this embodiment, as Figure 2 As shown, all first keys are encrypted with each other using an encryption algorithm. For example, M1 and M2 are encrypted, M1 and M3 are encrypted, M1 and M4 are encrypted, M1 and M5 are encrypted, M2 and M3 are encrypted, M2 and M4 are encrypted, M2 and M5 are encrypted, M3 and M4 are encrypted, M3 and M5 are encrypted, and M4 and M5 are encrypted to obtain all encrypted first keys. The encrypted first keys are then used to encrypt the dynamic original key K1 to obtain all first target keys.

[0070] S3. Select a first number of first keys from all the first keys and combine them into a second number of combinations to obtain all combined keys. Encrypt the dynamic original key with each combined key to obtain all the second target keys.

[0071] In this embodiment, as Figure 2 As shown, a first number of first keys are selected from all the first keys and combined with a second number of combinations. At this time, the second number is (1, first number]. For example, there are 5 key management platforms, namely key management platform 1, key management platform 2, key management platform 3, key management platform 4 and key management platform 5, and their corresponding first keys are M1, M2, M3, M4 and M5 respectively. That is, there are 5 first keys. At this time, the first number is 4, that is, the second number is (1,4]. That is, 4 first keys are selected from the 5 first keys and combined in pairs, and / or in groups of three, and / or in groups of four to obtain all the combined keys. The dynamic original key is encrypted by each combined key to obtain all the second target keys.

[0072] At this point, step S3, which involves selecting a first number of first keys from all the first keys and combining them a second number of times, yields all the combined keys, including:

[0073] S31. Substitute the first quantity and the second quantity into the combination formula to calculate all possible combinations. Then, obtain all possible combination keys based on all the possible combination quantities. The combination formula is:

[0074]

[0075] Where P represents the total number of combinations, n represents the first number, and m represents the second number.

[0076] In this embodiment, as Figure 2 As shown, substituting the first and second quantities into the combination formula yields all possible combinations. For example, if the first quantity is 4, and the corresponding first keys are M1, M3, M4, and M5, and the second quantity takes values ​​of 2, 3, and 4 respectively, then substituting it into the combination formula along with the first quantity will result in a value of 2. When the second quantity is 2, i.e., when performing pairwise combinations... When the second quantity is 3, that is, when performing a combination of threes, When the second quantity is 4, that is, when performing a four-by-four combination, Therefore, the total number of combinations is 6 + 4 + 1 = 11. Based on the total number of combinations, the keys for all combinations are as follows:

[0077] Combination keys 1: M1 and M3;

[0078] Combination keys 2: M1 and M4;

[0079] Combination keys 3: M1 and M5;

[0080] Combination keys 4: M3 and M4;

[0081] Combination keys 5: M3 and M5;

[0082] Combination keys 6: M4 and M5;

[0083] Combination keys 7: M1, M3, and M4;

[0084] Combination keys 8: M1, M3, and M5;

[0085] Combination keys 9: M1, M4, and M5;

[0086] Combination keys 10: M3, M4, and M5;

[0087] Combination keys 11: M1, M3, M4 and M5.

[0088] In this embodiment, the first target key obtained in step S2 and the second target key obtained in step S3 are both stored locally.

[0089] S4. When decrypting the encrypted data, a key request is sent to all key management platforms. It is determined whether all key requests have been responded to. If so, the first target key is decrypted using the first key obtained from all key requests to obtain the decrypted target key. If not, the combined key obtained by combining the first key obtained from the key requests is used to decrypt all second target keys to obtain the decrypted target key. The hash value of the decrypted target key is calculated to obtain the second hash value. A verification request is sent to the monitoring platform to obtain the first hash value. It is determined whether the first hash value and the second hash value are the same. If so, the encrypted data is decrypted using the decrypted target key corresponding to the second hash value to obtain the original data.

[0090] In this embodiment, as Figure 2 As shown, when decrypting encrypted data, the central platform sends key requests to all key management platforms and obtains the first and second target keys locally. Simultaneously, it sends a request to the regulatory platform to obtain the first hash value. It determines whether all key requests receive a response. If all responses are received, the first target key is decrypted using the first keys obtained from all key requests to obtain the decrypted target key. If no responses are received, the first keys obtained from the key requests are combined to obtain a combined key. The combination method used is the same as in step S2. The second target key is then decrypted using the obtained combined key to obtain the decrypted target key. The hash value of the decrypted target key is calculated to obtain the second hash value. A verification request is then sent to the regulatory platform to obtain the first hash value. The regulatory platform receives and agrees to the verification request before sending the first hash value back to the central platform. The central platform determines whether the first hash value and the second hash value are the same. If they are the same, it means that the decrypted target key corresponding to the second hash value can correctly decrypt the encrypted data to obtain the original data. If they are different, the correct original data cannot be obtained.

[0091] At this point, if not, step S4 involves decrypting all the second target keys using the combined key obtained from the first key obtained from the key request, which includes:

[0092] S41. The key management platform that does not respond to the key request is designated as an invalid platform.

[0093] In this embodiment, as Figure 2As shown, if all key requests are not answered, the key management platform for which the key requests are not answered is designated as an invalid platform, and all second target keys associated with the invalid platform are deleted.

[0094] At this point, step S41, which refers to the key management platform that does not respond to the key request as an invalid platform, includes:

[0095] S411. Issue an alarm for the failed platform.

[0096] In this embodiment, as Figure 2 As shown, an alarm will also be issued for a failed platform.

[0097] Example 2

[0098] Please refer to Figure 3 The present invention provides a data encryption and decryption system 1, including a memory 3, a processor 2, and a computer program stored on the memory 3 and executable on the processor 2. When the processor 2 executes the computer program, it implements the steps in the above embodiment 1.

[0099] Since the systems / devices described in the above embodiments of the present invention are systems / devices used to implement the methods of the above embodiments of the present invention, those skilled in the art can understand the specific structure and modifications of the systems / devices based on the methods described in the above embodiments of the present invention, and therefore will not be repeated here. All systems / devices used in the methods of the above embodiments of the present invention fall within the scope of protection of the present invention.

[0100] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0101] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, as well as combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions.

[0102] It should be noted that any reference numerals placed between parentheses in the claims should not be construed as limiting the claims. The word "comprising" does not exclude the presence of components or steps not listed in the claims. The word "a" or "an" preceding a component does not exclude the presence of a plurality of such components. The invention can be implemented by means of hardware comprising several different components and by means of a suitably programmed computer. In claims that enumerate several means, several of these means may be embodied by the same hardware. The use of the terms first, second, third, etc., is merely for convenience of expression and does not indicate any order. These terms can be understood as part of the component names.

[0103] Furthermore, it should be noted that in the description of this specification, the terms "one embodiment," "some embodiments," "embodiment," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Furthermore, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0104] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the claims should be interpreted to include both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0105] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, then this invention should also include these modifications and variations.

Claims

1. A method for encrypting and decrypting data, characterized in that, include: Obtain a dynamic raw key, encrypt the data to be encrypted using the dynamic raw key to obtain encrypted data, perform a hash calculation on the dynamic raw key to obtain a first hash value, and store the first hash value in the monitoring platform; Obtain the first key from all key management platforms, and encrypt the dynamic original key using all the first keys to obtain the first target key; Select a first number of first keys from all the first keys and combine them into a second number of combinations to obtain all combined keys. Encrypt the dynamic original key with each combined key to obtain all the second target keys. When decrypting the encrypted data, a key request is sent to all key management platforms. It is determined whether all key requests have been responded to. If so, the first target key is decrypted using the first key obtained from all key requests to obtain the decrypted target key. If not, the combined key obtained by combining the first keys obtained from the key requests is used to decrypt all second target keys to obtain the decrypted target key. The hash value of the decrypted target key is calculated to obtain the second hash value. A verification request is sent to the monitoring platform to obtain the first hash value. It is determined whether the first hash value and the second hash value are the same. If so, the encrypted data is decrypted using the decrypted target key corresponding to the second hash value to obtain the original data.

2. The data encryption and decryption method as described in claim 1, characterized in that, The process of obtaining the dynamic raw key includes: Generate dynamic raw keys in a trusted execution environment.

3. The data encryption and decryption method as described in claim 2, characterized in that, The generation of dynamic raw keys in a trusted execution environment includes: Obtain the local physical key and generate a random number. Then, use an encryption algorithm to superimpose the physical key and the random number onto the dynamic original key to generate a new dynamic original key.

4. The data encryption and decryption method as described in claim 1, characterized in that, The step of encrypting the dynamic original key using all the first keys to obtain the first target key includes: The dynamic original key is encrypted sequentially using each first key to obtain the first target key; and / or A new first key is generated by superimposing all the first keys using an encryption algorithm, and the dynamic original key is then encrypted using the new first key to obtain the first target key; and / or All the first keys are encrypted with each other using an encryption algorithm to obtain all the encrypted first keys. The dynamic original key is then encrypted with all the encrypted first keys to obtain all the first target keys.

5. The data encryption and decryption method as described in claim 1, characterized in that, The step of selecting a first number of first keys from all the first keys and combining them into a second number of combinations to obtain all combined keys includes: Substituting the first quantity and the second quantity into the combination formula, we obtain all possible combinations. Based on all the possible combinations, we obtain all possible combination keys. The combination formula is as follows: Where P represents the total number of combinations, n represents the first number, and m represents the second number.

6. The data encryption and decryption method as described in claim 1, characterized in that, The second quantity is (1, the first quantity).

7. The data encryption and decryption method as described in claim 1, characterized in that, The description also includes: Store the first target key and all the second target keys locally.

8. The data encryption and decryption method as described in claim 1, characterized in that, If not, then decrypting all the second target keys using the combined key obtained from the first key obtained from the key request includes: The key management platform that does not respond to the key request is designated as an invalid platform, and the second target key associated with the invalid platform is deleted.

9. A data encryption and decryption method as described in claim 8, characterized in that, The step of designating a key management platform that does not respond to a key request as an invalid platform includes: An alarm is issued for the failed platform.

10. A data encryption and decryption system, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method as described in any one of claims 1 to 9.

Images