Method and system for encrypting, decrypting and desensitizing private data of e-commerce platform

Abstract

The invention discloses an encryption, decryption and desensitization method and system for private data of an e-commerce platform, and relates to the technical field of data security, and the encryption of the private data of the e-commerce platform comprises the following steps: receiving an encryption request initiated by a client, randomly generating a key pair comprising an encryption key and a decryption key, and storing the secret key pair in a local database, setting a secret key identifier for the secret key pair, encrypting the private data according to the data type identifier of the private data by using the encryption secret key according to fields, generating encrypted private data, and storing the secret key identifier and the encrypted private data in the local database. According to the data type identifier of the privacy data, the ciphertext identifier is set for the encrypted privacy data, and the ciphertext identifier is associated with the secret key identifier and the encrypted privacy data, so that the security of the privacy data of the user in the transmission and storage process is ensured.

Description

Technical Field

[0001] The present disclosure relates to the field of data security technology, and in particular to a method, system, device and medium for encrypting, decrypting and desensitizing private data on an e-commerce platform. Background Art

[0002] The types of personal privacy data involved in e-commerce platforms are numerous and of great importance, mainly including but not limited to users' personal information (such as name, contact information, home address, etc.), detailed order information (purchase records, payment details, etc.), and user portrait data formed through big data analysis (purchase preferences, purchase methods, etc.). The security protection of users' personal privacy data faces huge challenges. In order to prevent the leakage and abuse of sensitive data, it is particularly important to encrypt users' personal privacy data comprehensively and effectively. Existing e-commerce platforms have taken a series of measures to strengthen the protection of users' personal privacy data.

[0003] At the data storage level, each business domain encrypts and stores user personal privacy data according to its own characteristics and needs. At the external network communication level, e-commerce platforms generally use the HTTPS protocol, and use SSL / TLS encryption technology to ensure that all user personal privacy data is encrypted during the data transmission process, whether the user logs in, browses products or submits orders, effectively resisting the risk of man-in-the-middle attacks and theft of user personal privacy data. However, in the intranet environment, there are still potential security risks in the transmission, sharing and use of user personal privacy data. Summary of the invention

[0004] In order to at least partially solve the defects of the prior art, an embodiment of the present invention provides an e-commerce platform privacy data encryption and decryption method and system.

[0005] In a first aspect, the method for encrypting private data of an e-commerce platform provided by an embodiment of the present invention comprises the following steps: Accepting an encryption request initiated by a client, wherein the encryption request carries private data and a data type identifier of the private data, wherein the data type identifier is a name identifier, a phone identifier, an address identifier, a bank card number identifier, or a payment password identifier; Randomly generate a key pair including an encryption key and a decryption key, store the key pair in a local database and set a key identifier for the key pair, encrypt the private data field by field using the encryption key according to the data type identifier of the private data, generate encrypted private data, and store the key identifier and the encrypted private data in the local database; According to the data type identifier of the private data, a ciphertext identifier is set for the encrypted private data, and the ciphertext identifier is associated with the key identifier and the encrypted private data respectively; According to the business domain where the private data is located, the data type identifier and the ciphertext identifier of the private data are sent to the corresponding decryption server, wherein the business domain includes a user domain, an order domain and a payment domain.

[0006] In one example, before accepting the encryption request initiated by the client, the e-commerce platform private data encryption method further includes: The encryption request is sent to an authentication server, and the authentication server is used to determine whether the encryption request has encryption authority. If it is determined that the encryption request has encryption authority, the encryption request is accepted.

[0007] In one example, the encryption key is a key encrypted by a working key, and the working key is a key encrypted by a master key.

[0008] In one example, the master key is configured in shards using the Shamir sharding algorithm.

[0009] In one example, the method further includes: The working key and the master key are replaced regularly.

[0010] In a second aspect, the e-commerce platform privacy data decryption method provided by the embodiment of the present invention comprises the following steps: Accepting a decryption request initiated by the encryption server, wherein the decryption request carries a data type identifier of the private data and a ciphertext identifier of the private data after encryption obtained by using the e-commerce platform private data encryption method disclosed in the first aspect; Determining whether the encrypted private data associated with the ciphertext identifier exists; If it is determined that the encrypted private data exists, obtaining a key identifier associated with the ciphertext identifier; According to the key identifier, a decryption key for the encrypted private data is obtained, and according to the decryption key, the encrypted private data is decrypted to obtain the decrypted private data, and the ciphertext identifier is associated with the decrypted private data; The data type of the private data and the encrypted ciphertext identifier of the private data are stored in a local database; According to the business domain where the decrypted private data is located, the data type of the private data and the ciphertext identifier of the encrypted private data are sent to the corresponding desensitizing server.

[0011] In a third aspect, the method for desensitizing private data of an e-commerce platform provided by an embodiment of the present invention comprises the following steps: Accepting a desensitization request sent by a decryption server, wherein the desensitization request carries the data type of the private data and the ciphertext identifier of the private data after encryption obtained by using the e-commerce platform private data encryption method disclosed in the first aspect; Determining whether the encrypted private data associated with the ciphertext identifier exists; If it is determined that the encrypted private data exists, obtaining a key identifier associated with the ciphertext identifier; According to the key identifier, a decryption key for the encrypted private data is obtained, and according to the decryption key, the encrypted private data is decrypted to obtain the decrypted private data; According to the data type identifier of the private data, a corresponding desensitization strategy is adopted to desensitize the decrypted private data.

[0012] In a fourth aspect, the e-commerce platform privacy data encryption system provided by the embodiment of the present invention includes: The acquisition module is configured to accept an encryption request initiated by a client, wherein the encryption request carries private data and a data type identifier of the private data, wherein the data type identifier is a name identifier, a phone identifier, an address identifier, a bank card number identifier, or a payment password identifier; an encryption module, configured to randomly generate a key pair including an encryption key and a decryption key, store the key pair in a local database and set a key identifier for the key pair, encrypt the private data field by field using the encryption key according to the data type identifier of the private data, generate encrypted private data, and store the key identifier and the encrypted private data in the local database; an associating module configured to set a ciphertext identifier for the encrypted private data according to a data type identifier of the private data, and associate the ciphertext identifier with the key identifier and the encrypted private data respectively; The sending module is configured to send the data type identifier and the ciphertext identifier of the private data to the corresponding decryption server according to the business domain where the private data is located, wherein the business domain includes a user domain, an order domain and a payment domain.

[0013] In the fifth aspect, the electronic device provided by an embodiment of the present invention includes a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, it implements the e-commerce platform privacy data encryption method described in the first aspect, the e-commerce platform privacy data decryption method described in the second aspect, or the e-commerce platform privacy data desensitization method described in the third aspect.

[0014] In a sixth aspect, a computer-readable storage medium provided by an embodiment of the present invention stores computer program instructions, and when the computer program instructions are executed by a processor, the e-commerce platform privacy data encryption method described in the first aspect, the e-commerce platform privacy data decryption method described in the second aspect, or the e-commerce platform privacy data desensitization method described in the third aspect is implemented.

[0015] Compared with the prior art, the e-commerce platform privacy data encryption and decryption method and system provided by the embodiment of the present invention has the following beneficial effects: (1) During the entire process of decryption and desensitization, only the ciphertext identifier and data type identifier of the private data are transmitted between the encryption server, decryption server and desensitization server. Since the ciphertext identifier is a unique and irreversible identifier and is only associated with the encrypted private data, no information about the original data can be inferred from it. This ensures the security of the user's private data (or sensitive data) during transmission and storage, and can also prevent unauthorized access and operation, ensuring the compliance of the user's private data; (2) For privacy data of different data types, different encryption keys, decryption keys and desensitization strategies are used to encrypt, decrypt and desensitize the privacy data respectively, realizing encryption, decryption and desensitization of privacy data by field, further ensuring the security of privacy data. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0017] Figure 1 A schematic diagram of a method for encrypting private data on an e-commerce platform disclosed according to an embodiment of the present invention; Figure 2 A schematic diagram of a method for decrypting private data on an e-commerce platform according to an embodiment of the present invention; Figure 3 A schematic diagram of a privacy data desensitization process of an e-commerce platform disclosed according to an embodiment of the present invention; Figure 4 A schematic diagram of the microservice architecture composition of an e-commerce platform disclosed according to an embodiment of the present invention; Figure 5 A schematic diagram of a privacy data encryption system according to an embodiment of the present invention; Figure 6 The figure is a schematic diagram of the structure of an electronic device disclosed according to an embodiment of the present invention. DETAILED DESCRIPTION

[0018] The following is a further detailed description of the embodiments of the present disclosure in conjunction with the accompanying drawings and examples. The detailed descriptions and drawings of the following embodiments are used to exemplarily illustrate the principles of the present disclosure, but cannot be used to limit the scope of the present disclosure. The present disclosure can be implemented in many different forms, not limited to the specific embodiments disclosed herein, but includes all technical solutions falling within the scope of the claims.

[0019] Explanation of terms Microservices are about splitting an application into multiple different services according to certain standards (such as business areas), and each service is independently developed, deployed and expanded. Services communicate with each other through HTTP and other methods. Each service can be developed, deployed and elastically expanded. Each service has its own database to form resource isolation, prevent resource shortages caused by multiple services connecting to the same database to operate the database, and facilitate management. Microservices are usually deployed in containers. The embodiments of the present invention mainly involve authentication services, encryption services, decryption services and desensitization services, and each service is only called in the intranet environment.

[0020] Example 1

[0021] like Figure 1 As shown, the e-commerce platform privacy data encryption method provided by the embodiment of the present invention is executed by the encryption server and includes the following steps: S101, accepting an encryption request initiated by a client, wherein the encryption request carries private data and a data type identifier of the private data, wherein the data type identifier is a name identifier, a phone identifier, an address identifier, a bank card number identifier, or a payment password identifier.

[0022] In some examples, before step S101, the authentication server is used to determine whether the encryption request has access rights, and if the encryption request has access rights to encrypt the private data, the encryption request is accepted, and if not, the encryption request is rejected.

[0023] Specifically, permissions are configured for each business request (including encryption requests, decryption requests, and desensitization requests). Only business requests with the appropriate permissions can access the corresponding micro servers normally. A business request has one and only one credential, which serves as the unique identifier appid for the business request. This appid needs to be applied for in advance and saved in the corresponding micro server. Business requests without an appid cannot use the encryption service, decryption service, and desensitization service normally. The data type is a classification and description of different field data. One data type corresponds to one field, and the data type identifier serves as the unique identifier for each different field data. The authentication server verifies the permissions of the encryption request and feedbacks the verification result to the encryption server. Only encrypted requests that are authorized (with the appid for the encryption request) can be accepted by the encryption server. The authentication server can be the gateway.

[0024] S102, randomly generate a key pair including an encryption key and a decryption key, store the key pair in the local database and set a key identifier for the key pair. According to the data type of the private data, use the encryption key to encrypt the private data field by field, generate the encrypted private data, and store the key identifier and the encrypted private data in the local database.

[0025] In some examples, the encryption key is a key encrypted by a working key, and the working key is a key encrypted by a master key.

[0026] Specifically, for private data of different data types, different encryption keys and encryption algorithms are used for encryption, achieving field-by-field encryption of private data and ensuring the security of private data.

[0027] Specifically, to ensure the security of the keys, a three-layer key system is adopted, mainly including the master key, the working key, and the encryption key. The master key is a key encryption key, and its main function is to protect the secure transmission and storage of its underlying keys. The master key is configured in fragments through the Shamir secret sharing algorithm and distributed to different storage servers. That is, a fragment of a key is generated through the key fragment interface and configured into different storage servers, ensuring that even if a certain storage server is compromised, the master key cannot be restored. The encryption and decryption service obtains the key fragments from the database file and the configuration file when starting up and restores the master key based on the key fragments. For example: use the threshold algorithm for splitting: For example, using the Shamir secret sharing scheme, split the key K into n key components K1...K n , and only when greater than or equal to t (t < n) key components can K be restored. The working key is a key encryption key, and its main function is to protect the secure transmission, distribution, and storage of the encryption key. The encryption key is the key to protect the security of private data and is used to directly encrypt private data.

[0028] A working key (asymmetric key) is randomly generated, and then the working key private key is encrypted using the master key public key. A data encryption key (symmetric key) is randomly generated, and the data key is encrypted using the working key public key.

[0029] In some examples, the working key and the master key are periodically replaced.

[0030] Specifically, in order to ensure key security, the risk of key cracking can be reduced by regularly replacing keys. Configure a timer to regularly replace data keys and working keys. According to the set replacement cycle, configure a timer to trigger the key replacement operation at a specified time, update the newly generated key and key version information to the key repository, and establish a key mapping table.

[0031] S103, setting a ciphertext identifier for the encrypted private data, and associating the ciphertext identifier with the key identifier and the encrypted private data respectively.

[0032] Specifically, a ciphertext identifier corresponds to a key identifier and encrypted private data of a data type.

[0033] S104, sending the ciphertext identifier to a corresponding decryption server according to the business domain where the private data is located, wherein the business domain includes a user domain, an order domain, and a payment domain.

[0034] Specifically, the privacy data corresponding to the user domain includes data of different data types (fields) such as name, contact information, and contact address; the privacy data corresponding to the order domain includes data of different data types (fields) such as product name, purchase preferences, and purchase methods; the privacy data corresponding to the payment domain includes data of different data types (fields) such as payment amount, payment password, and payment method.

[0035] The encryption service and decryption service rely on various encryption algorithms to realize the encryption and decryption of private data. This embodiment is compatible with international general algorithms, such as RSA, AES-CBC, AES-ECB and other algorithms, and also supports national encryption algorithms certified by the State Cryptography Administration, such as SM2, SM3-CBC, SM4-CFB and other encryption algorithms. The encryption service and decryption service can switch between these encryption algorithms.

[0036] Specifically, when used in batch privacy data encryption scenarios, determine the business scenarios for batch privacy data encryption (saving user information, real-name authentication), such as: encrypted batch requests for mobile phone numbers and addresses. The plaintext and data type identifier corresponding to the mobile phone number, and the plaintext and data type identifier corresponding to the address are packaged into a data set and sent to the encryption server for encryption by field, and the encryption service call authority is verified (configured in advance). After the verification is passed, the encrypted privacy data is stored in the encryption server, and the data type identifier of the mobile phone number, the data type identifier of the address, the ciphertext identifier of the encrypted mobile phone number, and the ciphertext identifier of the encrypted address are returned. When processing batch privacy data, it may contain data of different data types. If a certain data type of privacy data in the encryption request is not authorized, the entire encryption request is rejected and no data is processed.

[0037] Example 2

[0038] like Figure 2 As shown, the e-commerce platform privacy data decryption method provided by the embodiment of the present invention is executed by the decryption server and includes the following steps: S201, accepting a decryption request sent by an encryption server, wherein the decryption request carries a data type identifier of the private data and a ciphertext identifier of the encrypted private data obtained by using the e-commerce platform private data encryption method disclosed in Example 1.

[0039] S202, determining whether the encrypted private data associated with the ciphertext identifier exists.

[0040] Specifically, the encrypted private data is stored in an encryption server.

[0041] S203: If it is determined that the encrypted private data exists, obtain a key identifier associated with the ciphertext identifier.

[0042] Specifically, the key identifier is stored in the encryption server.

[0043] S204, obtaining a decryption key for the encrypted private data according to the key identifier, decrypting the encrypted private data according to the decryption key, obtaining decrypted private data, and associating the ciphertext identifier with the decrypted private data.

[0044] Specifically, the decryption key is stored in the encryption server. Specifically, for privacy data of different data types, different decryption keys and decryption algorithms are used for decryption, which realizes the decryption of privacy data by field, further ensuring the security of privacy data.

[0045] S205: Store the data type of the private data and the ciphertext identifier of the encrypted private data in a local database.

[0046] S206: According to the business domain where the decrypted private data is located, the data type identifier of the private data and the ciphertext identifier of the encrypted private data are sent to the corresponding desensitizing server.

[0047] Specifically, before accepting the decryption request sent by the encryption server, the decryption server uses the authentication server to determine whether the decryption request has the authorization to decrypt the data of this type. The authentication server verifies the authority of the decryption request and feeds back the verification result to the decryption server. Only authorized decryption requests (with the decryption request appid) can be accepted by the decryption server.

[0048] Example 3

[0049] like Figure 3 As shown, the e-commerce platform privacy data desensitization method provided by the embodiment of the present invention is executed by the desensitization server and includes the following steps: S301, accepting a desensitization request sent by a decryption server, wherein the desensitization request carries the data type of the private data and the ciphertext identifier of the encrypted private data obtained by using the e-commerce platform private data encryption method disclosed in Example 1.

[0050] Specifically, before accepting the desensitization request sent by the decryption server, the desensitization server uses the authentication server to determine whether the desensitization request has the authorization to desensitize the data of this type. The authentication server verifies the authority of the desensitization request and feeds back the verification result to the desensitization server. Only authorized desensitization requests (with the desensitization request appid) can be accepted by the desensitization server.

[0051] In particular, the encryption server may also directly send a desensitization request to the desensitization server.

[0052] S302, determining whether the encrypted private data associated with the ciphertext identifier exists.

[0053] Specifically, the encrypted private data is stored in an encryption server.

[0054] S303: If it is determined that the encrypted private data exists, obtain a key identifier associated with the ciphertext identifier.

[0055] Specifically, the key identifier is stored in the encryption server.

[0056] S304: Obtain a decryption key for the encrypted private data according to the key identifier and decrypt the encrypted private data according to the decryption key to obtain decrypted private data.

[0057] Specifically, the decryption key is stored in the encryption server.

[0058] S305 , according to the data type identifier of the private data, adopt a corresponding desensitization strategy to perform desensitization processing on the decrypted private data.

[0059] Specifically, we use mask shielding to desensitize different types of private data using different desensitization strategies, thereby desensitizing private data by field, further ensuring the security of private data. Taking mobile phone number desensitization as an example, for mobile phone number 12345678901: Before desensitization: registerMobile = "12345678901"; Desensitization strategy: keep the first three and last four digits, and replace the middle four digits with asterisks; After desensitization: registerMobile = "123****8901".

[0060] Specifically, Figure 4 As shown, the authentication server, encryption server, decryption server and desensitizing server form a microservice architecture and are in the same intranet environment. The authentication server, encryption server, decryption server and desensitizing server can be cloud servers, and the authentication server, encryption server, decryption server and desensitizing server communicate bidirectionally via HTTP.

[0061] During the entire process of decryption and desensitization, only the ciphertext identifier and data type identifier of the private data are transmitted between the encryption server, decryption server and desensitizing server. Since the ciphertext identifier is a unique and irreversible identifier and is only associated with the encrypted private data, no information about the original data can be inferred from it. This ensures the security of the user's private data during transmission and storage, and prevents unauthorized access and operation.

[0062] Example 4

[0063] like Figure 5 As shown, the e-commerce platform privacy data encryption system provided by the embodiment of the present invention includes: The acquisition module is configured to accept an encryption request initiated by a client, wherein the encryption request carries private data and a data type identifier of the private data, and the data type identifier is a name identifier, a phone identifier, an address identifier, a bank card number identifier, or a payment password identifier.

[0064] The encryption module is configured to randomly generate a key pair including an encryption key and a decryption key, store the key pair in a local database and set a key identifier for the key pair, encrypt the privacy data field by field using the encryption key according to the data type identifier of the privacy data, generate encrypted privacy data and store the key identifier and the encrypted privacy data in the local database.

[0065] The association module is configured to set a ciphertext identifier for the encrypted private data according to the data type identifier of the private data, and associate the ciphertext identifier with the key identifier and the encrypted private data respectively.

[0066] The sending module is configured to send the data type identifier and the ciphertext identifier of the private data to the corresponding decryption server according to the business domain where the private data is located, wherein the business domain includes a user domain, an order domain and a payment domain.

[0067] Figure 6 The hardware structure principle block diagram of an embodiment of the electronic device provided by the present invention is shown. The electronic device includes a processor 601 and a memory 602 storing computer program instructions. When the processor executes the computer program instructions, the method disclosed in the above embodiment of the present invention is implemented.

[0068] Specifically, the processor 601 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiment of the present invention.

[0069] The memory 602 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 602 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive or a combination of two or more of these. In appropriate cases, the memory 602 may include a removable or non-removable (or fixed) medium. In appropriate cases, the memory 602 may be inside or outside the integrated gateway disaster recovery device. In a specific embodiment, the memory 602 is a non-volatile solid-state memory.

[0070] The memory may include read-only memory (ROM), random access memory (RAM), magnetic disk storage media devices, optical storage media devices, flash memory devices, electrical, optical or other physical / tangible memory storage devices. Thus, typically, the memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to an aspect of the present disclosure.

[0071] In some examples, such as Figure 6As shown, the electronic device may further include a communication interface 603 and a bus 610. Figure 6 As shown, the processor 601, the memory 602, and the communication interface 603 are connected and communicate with each other via a bus 610. The electronic device in the embodiment of the present invention can be an encryption server, a decryption server, a desensitizing server, or other computing devices, or a cloud encryption server, a cloud decryption server, or a cloud desensitizing server.

[0072] The communication interface 603 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiment of the present invention.

[0073] Bus 610 includes hardware, software or both, and couples the components of online data traffic billing equipment to each other. For example, but not limitation, the bus may include accelerated graphics port (AGP) or other graphics bus, enhanced industrial standard architecture (EISA) bus, front-side bus (FSB), hypertransport (HT) interconnection, industrial standard architecture (ISA) bus, infinite bandwidth interconnection, low pin count (LPC) bus, memory bus, micro channel architecture (MCA) bus, peripheral component interconnect (PCI) bus, PCI-Express (PCI-E) bus, serial advanced technology attachment (SATA) bus, video electronics standard association local (VLB) bus or other suitable bus or two or more of these combinations. Where appropriate, bus 610 may include one or more buses. Although the embodiment of the present invention describes and shows a specific bus, the present invention considers any suitable bus or interconnection.

[0074] The present invention also provides a computer program product, which includes computer program instructions, and when the computer program instructions are executed by a processor, the method provided by the embodiment of the present invention is implemented. The computer program product is, for example, a software installation package, a plug-in compatible with a related software system, etc.

[0075] It should be clear that the present invention is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present invention.

[0076] In addition, the words “first”, “second” and the like used in the present disclosure do not indicate any order, quantity or importance, but are only used to distinguish different parts.

[0077] The above is only a specific implementation of the present invention. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working process of the above-described system, module and unit can refer to the process in the aforementioned method embodiment, and will not be repeated here. It should be understood that the protection scope of the present invention is not limited to this. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be covered within the protection scope of the present invention.

Claims

1. A method for encrypting private data on an e-commerce platform, characterized in that: The following steps are involved: Accepting an encryption request initiated by a client, wherein the encryption request carries private data and a data type identifier of the private data, wherein the data type identifier is a name identifier, a phone identifier, an address identifier, a bank card number identifier, or a payment password identifier; Randomly generate a key pair including an encryption key and a decryption key, store the key pair in a local database and set a key identifier for the key pair, encrypt the private data field by field using the encryption key according to the data type identifier of the private data, generate encrypted private data, and store the key identifier and the encrypted private data in the local database; According to the data type identifier of the private data, a ciphertext identifier is set for the encrypted private data, and the ciphertext identifier is associated with the key identifier and the encrypted private data respectively; According to the business domain where the private data is located, the data type identifier and the ciphertext identifier of the private data are sent to the corresponding decryption server, wherein the business domain includes a user domain, an order domain and a payment domain.

2. The method for encrypting private data of an e-commerce platform according to claim 1, characterized in that: Before accepting the encryption request initiated by the client, the e-commerce platform privacy data encryption method further includes: The encryption request is sent to an authentication server, and the authentication server is used to determine whether the encryption request has encryption authority. If it is determined that the encryption request has encryption authority, the encryption request is accepted.

3. The method for encrypting private data of an e-commerce platform according to claim 1, characterized in that: The encryption key is a key encrypted by a working key, and the working key is a key encrypted by a master key.

4. The method for encrypting private data of an e-commerce platform according to claim 3, characterized in that: The master key adopts Shamir's sharding algorithm and is configured in shards.

5. The method for encrypting private data of an e-commerce platform according to claim 3, characterized in that: The method further comprises: The working key and the master key are replaced regularly.

6. A method for decrypting private data on an e-commerce platform, characterized in that: The following steps are involved: Accepting a decryption request initiated by the encryption server, wherein the decryption request carries a data type identifier of the private data and a ciphertext identifier of the private data after encryption obtained by using the e-commerce platform private data encryption method according to claim 1; Determining whether the encrypted private data associated with the ciphertext identifier exists; If it is determined that the encrypted private data exists, obtaining a key identifier associated with the ciphertext identifier; According to the key identifier, a decryption key for the encrypted private data is obtained, and according to the decryption key, the encrypted private data is decrypted to obtain the decrypted private data, and the ciphertext identifier is associated with the decrypted private data; The data type of the private data and the encrypted ciphertext identifier of the private data are stored in a local database; According to the business domain where the decrypted private data is located, the data type of the private data and the ciphertext identifier of the encrypted private data are sent to the corresponding desensitizing server.

7. A method for desensitizing private data on an e-commerce platform, characterized in that: The following steps are involved: Accepting a desensitization request sent by a decryption server, wherein the desensitization request carries the data type of the private data and the ciphertext identifier of the private data after encryption obtained by using the e-commerce platform private data encryption method according to claim 1; Determining whether the encrypted private data associated with the ciphertext identifier exists; If it is determined that the encrypted private data exists, obtaining a key identifier associated with the ciphertext identifier; According to the key identifier, a decryption key for the encrypted private data is obtained, and according to the decryption key, the encrypted private data is decrypted to obtain the decrypted private data; According to the data type identifier of the private data, a corresponding desensitization strategy is adopted to desensitize the decrypted private data.

8. An e-commerce platform privacy data encryption system, characterized in that: include: An acquisition module is configured to accept an encryption request initiated by a client, wherein the encryption request carries private data and a data type identifier of the private data, wherein the data type identifier is a name identifier, a phone identifier, an address identifier, a bank card number identifier, or a payment password identifier; an encryption module, configured to randomly generate a key pair including an encryption key and a decryption key, store the key pair in a local database and set a key identifier for the key pair, encrypt the private data field by field using the encryption key according to the data type identifier of the private data, generate encrypted private data, and store the key identifier and the encrypted private data in the local database; an associating module configured to set a ciphertext identifier for the encrypted private data according to a data type identifier of the private data, and associate the ciphertext identifier with the key identifier and the encrypted private data respectively; The sending module is configured to send the data type identifier and the ciphertext identifier of the private data to the corresponding decryption server according to the business domain where the private data is located, wherein the business domain includes the user domain, the order domain and the payment domain.

9. An electronic device, comprising a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, it implements the e-commerce platform privacy data encryption method as described in any one of claims 1 to 5, the e-commerce platform privacy data decryption method as described in claim 6, or the e-commerce platform privacy data desensitization method as described in claim 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, which, when executed by the processor, implement the e-commerce platform privacy data encryption method according to any one of claims 1 to 5, the e-commerce platform privacy data decryption method according to claim 6, or the e-commerce platform privacy data desensitization method according to claim 7.

Images