Data encryption and decryption methods and devices

Abstract

This application discloses a data encryption and decryption method and apparatus. The method includes: obtaining account information corresponding to an application or system of a first terminal; determining the number M of key storage areas in the card application based on the account information using the software development kit (SDK) and card application of the first terminal; wherein N sets of keys are stored in the M key storage areas; when an encryption request for instructing the encryption of original data is obtained, determining a target key storage area from the M key storage areas based on the timestamp corresponding to the encryption request and the number M of key storage areas using the SDK and card application; encrypting the original data of the encryption request based on the key in the target key storage area using the card application to obtain encrypted data, so that the first terminal can send target data including the timestamp and encrypted data to a second terminal.

Description

Technical Field

[0001] This application belongs to the field of data security protection technology, specifically relating to a data encryption and decryption method and apparatus. Background Technology

[0002] In related technologies, the encryption methods for data transmission of local data or network communication are simply to encrypt with a single key. The typical data transmission process is as follows: original message - encryption / decryption with a fixed key - terminal receives message - decryption using a key in the program - terminal processes specific business data.

[0003] With this type of encryption method that uses a fixed key, if the program on the terminal is debugged, the transmitted message and the original key can be cracked, resulting in the leakage of transmitted data. For data leakage in the Internet of Things, vehicle network and other fields, it may lead to the intrusion and control of the device or vehicle, causing adverse effects.

[0004] In other words, the data protection methods of related technologies have poor security issues. Summary of the Invention

[0005] This application provides a data encryption and decryption method and apparatus that can solve the problem of poor security in related data protection methods.

[0006] In a first aspect, embodiments of this application provide a data encryption method applied to a first terminal. The method includes: obtaining account information corresponding to an application or system of the first terminal; determining the number M of key storage areas in the card application based on the account information using the SDK and card application of the first terminal; wherein N sets of keys are stored in the M key storage areas; when an encryption request for instructing encryption of original data is obtained, determining a target key storage area from the M key storage areas based on the timestamp corresponding to the encryption request and the number M of key storage areas using the SDK and the card application; wherein the encryption request is used to instruct encryption of the original data; and encrypting the original data of the encryption request based on the key in the target key storage area using the card application to obtain encrypted data, so that the first terminal sends target data including the timestamp and the encrypted data to a second terminal.

[0007] Secondly, this application provides a data decryption method applied to a second terminal. The method includes: obtaining account information corresponding to an application or system of the second terminal; determining the number M of key storage areas in the card application based on the account information using the SDK and card application of the second terminal; wherein N sets of keys are stored in the M key storage areas; when receiving target data including an encrypted timestamp and encrypted data sent by a first terminal device, determining a target key storage area from the M key storage areas based on the encrypted timestamp and the number M of key storage areas using the SDK and the card application; and decrypting the target data using the card application based on the target key in the target key storage area to obtain the original data.

[0008] Thirdly, embodiments of this application provide a data encryption device, the device comprising: a first sending module, configured to acquire account information corresponding to an application or system of a first terminal; a first determining module, configured to determine the number M of key storage areas in the card application based on the account information and based on the first hash value, using the SDK of the first terminal and the card application of the first terminal; wherein, the M key storage areas store N sets of keys; a second determining module, configured to, when receiving an encryption request indicating encryption of original data, determine a target key storage area from the M key storage areas based on the timestamp corresponding to the encryption request and the number M of the key storage areas, using the SDK and the card application; and an encryption module, configured to encrypt the original data of the encryption request based on the key in the target key storage area using the card application, to obtain encrypted data, so that the first terminal sends target data including the timestamp and the encrypted data to a second terminal.

[0009] Fourthly, this application provides a data decryption device, comprising: a second sending module for acquiring account information corresponding to an application or system of a second terminal; a third determining module for determining the number M of key storage areas in the card application based on the account information using the SDK and card application of the second terminal; wherein the M key storage areas store N sets of keys; a fourth determining module for determining a target key storage area from the M key storage areas based on the encrypted timestamp and the number M of key storage areas when receiving target data including encrypted timestamps and encrypted data sent by a first terminal device, using the SDK and the card application; and a decryption module for decrypting the target data using the card application based on the target key in the target key storage area to obtain the original data.

[0010] Fifthly, embodiments of this application provide an electronic device comprising: a processor; and a memory arranged to store computer-executable instructions configured to be executed by the processor, the executable instructions including instructions for performing a data encryption method as described in the first aspect, or for performing a data decryption method as described in the second aspect.

[0011] In a sixth aspect, embodiments of this application provide a storage medium for storing computer-executable instructions that cause a computer to perform the data encryption method as described in the first aspect, or to perform the data decryption method as described in the second aspect.

[0012] In a seventh aspect, embodiments of this application provide a chip, the chip including a processor and a communication interface, the communication interface being coupled to the processor, the processor being used to run programs or instructions to implement the data encryption method as described in the first aspect, or to execute the data decryption method as described in the second aspect.

[0013] Eighthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the data encryption method as described in the first aspect, or performs the data decryption method as described in the second aspect.

[0014] In this embodiment, account information corresponding to the application or system of the first terminal is obtained; based on the account information, the number M of key storage areas in the card application is determined through the SDK and card application of the first terminal; wherein, N sets of keys are stored in the M key storage areas; when an encryption request for instructing the encryption of original data is obtained, the target key storage area is determined from the M key storage areas through the SDK and card application based on the timestamp corresponding to the encryption request and the number M of key storage areas; wherein, the encryption request is used to instruct the encryption of original data; then, based on the key in the target key storage area, the original data of the encryption request is encrypted through the card application to obtain encrypted data, so that the first terminal sends the target data including the timestamp and encrypted data to the second terminal. Compared to the fixed-key encryption method used in related technologies, this solution designs an SDK and card application. Based on the account information corresponding to the application, the SDK and card application determine the appropriate number of key storage areas within the card application. This allows for the determination of a different number of key storage areas for each application, increasing the randomness of key storage. Furthermore, based on the number of key storage areas and the timestamp corresponding to the encryption request, the target key storage area is determined. Encryption is then performed using the key from the target key storage area. This increases the randomness of the selection of the encryption key (the key used for encryption), thereby reducing the possibility of using the same encryption key during data transmission. Even if a key is cracked once, subsequent communication (data transmission) data will not be leaked, ensuring the security of the transmitted data and solving the problem of poor security in related data protection methods. Attached Figure Description

[0015] Figure 1 This is a flowchart illustrating a data encryption method provided in an embodiment of this application;

[0016] Figure 2 This is a schematic diagram of an embodiment of encrypted raw data provided in this application;

[0017] Figure 3 This is a schematic swimlane diagram of another data encryption method provided in the embodiments of this application;

[0018] Figure 4 This is a schematic diagram illustrating the initialization of a key storage area according to an embodiment of this application;

[0019] Figure 5 This is a flowchart illustrating a data decryption method provided in an embodiment of this application;

[0020] Figure 6 This is a schematic diagram of the structure of a data encryption device provided in an embodiment of this application;

[0021] Figure 7 This is a schematic diagram of the structure of a data decryption device provided in an embodiment of this application;

[0022] Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0023] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0024] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0025] The data encryption and decryption methods and apparatus provided in this application will be described in detail below with reference to the accompanying drawings, through specific embodiments and application scenarios.

[0026] It should be noted that, in the following text, the first terminal device and the second terminal device are two parties that transmit data to each other. For ease of explanation, the following text takes the first terminal device as the data sender, performing the data encryption method, and the second terminal device as the data receiver, performing the data decryption method as an example. However, both the first terminal device and the second terminal device in this application can perform the data encryption method and the data decryption method. Therefore, it is not limited to the first terminal device performing the data encryption method and the second terminal device performing the data decryption method.

[0027] Figure 1 This illustration shows a data encryption method provided by an embodiment of the present invention. The method can be executed by a first terminal device, such as an in-vehicle terminal or a mobile phone terminal. In other words, the method can be executed by software or hardware installed on the first terminal device, and the method includes the following steps:

[0028] S102: Obtain the account information corresponding to the application or system of the first terminal.

[0029] In practical applications, the system can obtain the account information corresponding to the application or system in response to the user's opening operation of the application or system on the first terminal.

[0030] The account information can be obtained by the user from the Software Development Kit (SDK) of the first terminal. Alternatively, the user can request account information from the SDK through a device other than the first terminal, and then input the account information into the first terminal; or the user can request account information from the SDK through the first terminal, and the SDK will send the account information to the first terminal.

[0031] Specifically, the SDK can provide business users with interface development packages for key updates, data encryption or decryption, for users to manage keys, and for encrypting and decrypting business data.

[0032] Specifically, the account information corresponding to the application or system on the first terminal may include the application (APP) account (Identity document, ID) and application key (APPkey) on the SDK.

[0033] S104: Based on the account information, determine the number M of key storage areas in the card application using the SDK of the first terminal and the card application of the first terminal.

[0034] Among them, M key storage areas store N sets of keys.

[0035] The card application is used for storing and managing N sets of keys, as well as encrypting or decrypting business data. Optionally, the card application can be an application for a Subscriber Identity Module (SIM) card, an application for a Universal Subscriber Identity Module (USIM) card, or an application for a Super SIM card. The card application includes, but is not limited to, applications for the aforementioned cards.

[0036] Specifically, a first hash value can be generated based on account information and a hash algorithm, and then the number M of key storage areas in the card application can be determined based on the first hash value.

[0037] S106: When an encryption request is received indicating that the original data should be encrypted, the target key storage area is determined from the M key storage areas based on the timestamp corresponding to the encryption request and the number M of key storage areas through the SDK and card application.

[0038] S108: Through the card application, based on the key in the target key storage area, the original data of the encryption request is encrypted to obtain encrypted data, so that the first terminal can send the target data including the timestamp and the encrypted data to the second terminal.

[0039] This includes raw data, such as control commands to the second terminal.

[0040] In practical applications, an encryption request can be generated for encrypting the original data in response to the user's input, or an encryption request can be received by the first terminal for encrypting the original data.

[0041] Specifically, when the first terminal receives an encryption request instructing the encryption of the original data, it sends the encryption request to the SDK. The SDK receives the encryption request and determines the timestamp corresponding to the encryption request based on the time the request is received. Then, the SDK sends the encryption request, including the original data, and the timestamp to the card application. The card application then determines the target key storage area from among the M key storage areas based on the timestamp and the number of key storage areas M. Based on the key in the target key storage area, it encrypts the original data of the encryption request to obtain encrypted data. The timestamp corresponding to the encryption request is determined by the SDK based on the time the encryption request is received. Alternatively, the timestamp can be determined by the card application based on the time the encryption request is received, or it can be a timestamp included in the encryption request itself.

[0042] Specifically, a modulo operation can be performed based on the timestamp and the number of key stores to obtain the first index of the key store. Based on this first index, the corresponding target key store can be determined. The formula for calculating the first index of the key store is as follows:

[0043] storageIndex1=timestamp%storageCount

[0044] Where storageIndex1 is the first index of the key storage area, timestamp is the timestamp, and storageCount is the number of key storage areas.

[0045] For example, if the first index of the key storage area can be 3, then the key storage area with the preset sequence number 3 is the target key storage area.

[0046] Optionally, the target key store may include one or more keys. If the target key store includes multiple keys, a key can be randomly selected from the multiple keys in the target key store by the card application.

[0047] After obtaining the encrypted data, the target data, including the timestamp and encrypted data, can be returned to the first terminal via the SDK through the card application, so that the first terminal can send the target data to the second terminal.

[0048] The data encryption method provided in this embodiment of the invention obtains account information corresponding to the application or system of a first terminal; through the SDK and card application of the first terminal, based on the account information, the number M of key storage areas in the card application are determined; wherein, N sets of keys are stored in the M key storage areas; when an encryption request for instructing the encryption of original data is obtained, the target key storage area is determined from the M key storage areas through the SDK and card application based on the timestamp corresponding to the encryption request and the number M of key storage areas; wherein, the encryption request is used to instruct the encryption of original data; then, through the card application, the original data of the encryption request is encrypted based on the key in the target key storage area to obtain encrypted data, so that the first terminal sends the target data including the timestamp and the encrypted data to the second terminal. Compared to the fixed-key encryption method used in related technologies, this solution designs an SDK and card application. Based on the account information corresponding to the application, the SDK and card application determine the appropriate number of key storage areas within the card application. This allows for the determination of a different number of key storage areas for each application, increasing the randomness of key storage. Furthermore, based on the number of key storage areas and the timestamp corresponding to the encryption request, the target key storage area is determined. Encryption is then performed using the key from the target key storage area. This increases the randomness of the selection of the encryption key (the key used for encryption), thereby reducing the possibility of using the same encryption key during data transmission. Even if a key is cracked once, subsequent communication (data transmission) data will not be leaked, ensuring the security of the transmitted data and solving the problem of poor security in related data protection methods.

[0049] In one implementation, after determining the number M of key storage areas in the card application based on account information (i.e., S104), the following steps A1 to A2 can be performed to store N sets of keys into M key storage areas:

[0050] Step A1: Obtain N sets of keys, and use the SDK and card application to perform hash calculation on each of the N sets of keys to determine the key hash value corresponding to each key.

[0051] Specifically, the first terminal can obtain N sets of keys and send them to the SDK. Then, the SDK sends the received N sets of keys to the card application. The card application performs a hash calculation on each of the received N sets of keys to determine the key hash value corresponding to each key.

[0052] Step A2: Using the card application, based on the key hash value and the number M of key storage areas, determine the key storage area corresponding to each key, so as to store N sets of keys into M key storage areas.

[0053] Specifically, a second index for each key storage area can be obtained by performing a modulo operation based on the key hash value and the number of key storage areas. This second index allows determination of the key storage area corresponding to each key. The formula for calculating the second index of the key storage area is as follows:

[0054] storageIndex2=keyHash%storageCount

[0055] Where storageIndex2 is the second index of the key storage area, keyHash is the key hash value, and storageCount is the number of key storage areas.

[0056] In this embodiment, by performing a hash calculation on each of the N sets of keys, the key hash value corresponding to each key is determined. Then, based on the key hash value and the number M of key storage areas, the key storage area corresponding to each key is determined. This increases the randomness of storing the N sets of keys into M key storage areas, thereby increasing the randomness of the selection of encryption keys, reducing the possibility of using the same encryption key during data transmission, and improving the security of the transmitted data.

[0057] In one implementation, such as Figure 2 As shown, the encryption request also includes the encryption algorithm selected by the user. When an encryption request indicating that the original data should be encrypted is received, the target key storage area (i.e., S106) is determined from the M key storage areas through the SDK and card application based on the timestamp corresponding to the encryption request and the number M of key storage areas. This can be specifically executed as follows: Steps B1 to B4:

[0058] Step B1: When an encryption request is received indicating that the original data should be encrypted, the encryption request is sent to the SDK.

[0059] Step B2: Receive the encryption request via the SDK and determine the timestamp corresponding to the encryption request based on the time the encryption request was received.

[0060] Step B3: Send an encryption request, including the original data and the encryption algorithm selected by the user, along with a timestamp, to the card application via the SDK;

[0061] Step B4: Using the card application, determine the target key storage area from among the M key storage areas based on the received timestamp and the number M of key storage areas.

[0062] Accordingly, based on the key in the target key storage area, the original data is encrypted by the card application to obtain encrypted data (i.e., S108), which can be specifically executed as follows: Step B5:

[0063] Step B5: Using the card application, the original data is encrypted based on the key in the target key storage area and the encryption algorithm selected by the user, resulting in encrypted data.

[0064] Specifically, the encryption algorithm selected by the user can be implemented by the card application; that is, the card containing the card application can store one or more encryption algorithms. The target data sent from the first terminal to the second terminal also includes the encryption algorithm selected by the user.

[0065] In this embodiment, by introducing a user-selected encryption algorithm, the original data is encrypted based on the key in the target key storage area and the user-selected encryption algorithm, which increases the difficulty of cracking the encrypted data and thus improves the security of data encryption. In addition, the encryption of the original data is implemented through card application, and both the key and the encryption algorithm are stored in the card, which improves the security of key and encryption algorithm storage.

[0066] In one implementation, the target data may also include a user-selected encryption algorithm, or an index of the user-selected encryption algorithm and the key in the target key storage area.

[0067] Specifically, the card application can determine the number of keys in the target key storage area. If there are multiple keys in the target key storage area, the target data can also include the encryption algorithm selected by the user and the index of the key in the target key storage area. The key index can be used to describe the storage location of the key used for encryption in the target key storage area.

[0068] When the target data also includes a user-selected encryption algorithm and an index of the key in the target key storage area, the target data format can be, for example,: user-selected encryption algorithm (encryptMethod, 2 bits) + index of the key in the target key storage area (random, 2 bits) + timestamp + encrypted data (encryptData). It should be noted that this target data format is merely an example and does not constitute a specific limitation to this embodiment.

[0069] In one implementation, the number M of key storage areas in the card application is determined based on the account information through the SDK of the first terminal and the card application of the first terminal (i.e., S104). This can be specifically executed as follows:

[0070] Step C1: Using the SDK of the first terminal and the card application of the first terminal, a first hash value is generated based on the account information and hash algorithm, and the number M of key storage areas in the card application is determined based on the first hash value.

[0071] Optionally, the first hash value can be a decimal string or a binary string. For example, if the first hash value is a binary string, the number M of key storage areas in the corresponding card application can be determined based on the number of "1"s in the binary string. It should be noted that this example is for illustrative purposes only and does not constitute a limitation on the first hash value.

[0072] In one implementation, the SDK of the first terminal and the card application of the first terminal generate a first hash value based on account information and a hash algorithm, and determine the number M of key storage areas in the card application based on the first hash value (i.e., step C1). This can be specifically executed as follows: steps D1 to D3:

[0073] Step D1: Based on the account information, perform hash calculation using the SDK to obtain the second hash value, and then convert the second hash value to obtain the first hash value.

[0074] The first hash value is a decimal string.

[0075] Specifically, the second hash value can be obtained by hashing the account information (such as the APP key).

[0076] Step D2: Send the first hash value to the card application via the SDK.

[0077] Step D3: Using the card application, determine the number M of key storage areas in the card application based on the received first hash value, in order to initialize the key storage areas.

[0078] Specifically, the units digit of the first hash value (decimal string) can be taken as the number M of the key storage area in the card application, and the key storage area in the card application can be initialized according to the number M of the key storage area.

[0079] In this embodiment, by converting the second hash value of binary into the first hash value of decimal string, the number of key storage areas in the card application can be controlled to be within 10, thereby reducing the possibility of a certain key storage area storing 0 keys due to an excessive number of key storage areas.

[0080] In one implementation, the aforementioned card application is installed on a Super SIM card, and the aforementioned key storage area is a secure storage area of ​​the Super SIM card.

[0081] Super SIM cards are similar in structure to regular SIM cards (such as the aforementioned SIM cards and USIM cards), both comprising a physical layer, data storage layer, application layer, and security control layer. However, Super SIM cards offer higher performance and functionality at each layer. For example, at the physical layer: Super SIM cards support more types and sizes of interfaces to adapt to different device needs. At the data storage layer: Super SIM cards can provide larger storage capacity and higher read / write speeds to meet more complex application requirements. At the application layer: Super SIM cards support a wider range of applications, such as those in the fields of connected vehicles and the Internet of Things. At the security control layer: Super SIM cards can use higher levels of encryption and authentication technologies and have stronger data protection and privacy protection features.

[0082] In summary, the Super SIM card offers superior performance and functionality at every level compared to the regular SIM card, and can be expanded to a wider range of application scenarios.

[0083] Accordingly, after obtaining the account information corresponding to the application or system of the first terminal (i.e., S102), the following step E1 can also be performed:

[0084] Step E1: Using the SDK, detect whether the first terminal meets the preset conditions and execute the above-mentioned S104.

[0085] The preset conditions include one or more of the following: the first terminal includes a Super SIM card and the Super SIM card has the card application installed.

[0086] In this embodiment, by installing the card application on the Super SIM card and storing the key in the secure storage area of ​​the Super SIM card, the security of data (e.g., key and raw data) storage is further improved.

[0087] In one implementation, after determining the number M of key storage areas in the card application based on account information (i.e., S104), steps F1 to F2 can be performed to update the key:

[0088] Step F1: Send a key request to the server so that the server generates and sends N sets of keys to the first terminal and sends N sets of keys to the second terminal according to the key update request.

[0089] The server is used to generate updated key pairs (N sets of keys).

[0090] In practical applications, after S104 is executed, the card application can return an initialization result to the first terminal via the SDK. The first terminal can then respond to this initialization result by sending a key update request to the server. Upon receiving the key update request, the server generates N sets of keys and returns them to the first terminal.

[0091] Since the second terminal B maintains a network connection with the server, when the first terminal and the second terminal transmit data, the transmission process is as follows: the first terminal sends the data to the server, and then the server sends it to the second terminal; the same applies to updating the key: the first terminal sends a key update request to the server, and the server will simultaneously push new N sets of keys to the second terminal and the first terminal, so that the second terminal and the first terminal can update the keys in the key storage area of ​​their card applications.

[0092] Step F2: Receive N sets of keys from the server, and update the keys in the key storage area of ​​the card application through the SDK and card application.

[0093] Specifically, the server can send messages to the second terminal and the first terminal. The second terminal and the first terminal can decrypt the received messages using an initial key, where account information can be used as the initial key to decrypt and obtain the N sets of keys.

[0094] It should be noted that the key storage (update) process in step F2 above can be referred to the specific implementation process of steps A1 to A2 above, and will not be repeated here.

[0095] In this embodiment, by updating the key in the key storage area of ​​the card application before each transmission of encrypted data, the possibility of using the same encryption key during data transmission can be reduced. Even if the key is cracked once, the data to be communicated later will not be leaked, thus improving the security of the transmitted data.

[0096] Figure 3 This is a schematic swimlane diagram of another data encryption method provided in the embodiments of this application. Figure 3 As shown, the data encryption method may include the following S3.1-S3.19:

[0097] S3.1, In response to the user's operation of opening the application or system on the first terminal, the first terminal sends the obtained account information corresponding to the application or system to the SDK.

[0098] S3.2, SDK, detects whether the first terminal meets the preset conditions; and performs hash calculation based on account information to generate the first hash value.

[0099] The first hash value is a decimal string. Preset conditions include one or more of the following: the first terminal includes a Super SIM card and the Super SIM card application is already installed.

[0100] S3.3, SDK, sends the first hash value to the card application.

[0101] S3.4, Card application, based on the received first hash value, determines the number M of key storage areas in the card application in order to initialize the key storage areas.

[0102] The card application is installed on the Super SIM card, and the key storage area is a secure storage area of ​​the Super SIM card.

[0103] For the initialization process described in S3.1-S3.4 via SDK and card application, a schematic diagram of initializing the key storage area is also provided, as shown below. Figure 4 As shown.

[0104] S3.5, the card application, returns the initialization result to the first terminal through the SDK.

[0105] The initialization results include the initialization results of the key storage area and the results of detecting whether the first terminal meets the preset conditions.

[0106] S3.6, the first terminal sends a key update request to the server.

[0107] S3.7, the server generates N sets of keys based on the key update request.

[0108] S3.8 The server sends N sets of keys to the first terminal and N sets of keys to the second terminal.

[0109] S3.9 The first terminal receives N sets of keys from the server and sends the N sets of keys to the SDK.

[0110] S3.10, the SDK sends N sets of keys to the card application.

[0111] S3.11, the card application performs a hash calculation on each key in the N sets of keys to determine the key hash value corresponding to each key, and determines the key storage area corresponding to each key based on the key hash value and the number of key storage areas M, so as to store the N sets of keys into M key storage areas.

[0112] S3.12, Card Application, returns a message to the first terminal that the key has been successfully saved via the SDK.

[0113] S3.13 When an encryption request is received that instructs the original data to be encrypted, the encryption request is sent to the SDK.

[0114] S3.14, SDK, receives encryption requests and determines the timestamp corresponding to the encryption request based on the time the encryption request is received.

[0115] S3.15, sends an encryption request, including the original data and the user-selected encryption algorithm, and a timestamp to the card application via the SDK.

[0116] S3.16, Card Application: Based on the received timestamp and the number M of key storage areas, determine the target key storage area among the M key storage areas, and encrypt the original data based on the key in the target key storage area and the encryption algorithm selected by the user to obtain encrypted data.

[0117] S3.17, Card Application, returns target data to the first terminal via SDK.

[0118] The target data includes timestamps, encryption algorithms, and encrypted data.

[0119] S3.18, the first terminal sends the target data to the server.

[0120] S3.19, the server sends the target data to the second terminal.

[0121] In this embodiment, the account information corresponding to the application or system of the first terminal is obtained; based on the account information, the number M of key storage areas in the card application is determined through the SDK and card application of the first terminal; wherein, N sets of keys are stored in the M key storage areas; when an encryption request for instructing the encryption of the original data is obtained, the target key storage area is determined from the M key storage areas through the SDK and card application based on the timestamp corresponding to the encryption request and the number M of key storage areas; wherein, the encryption request is used to instruct the encryption of the original data; then, based on the key in the target key storage area, the original data of the encryption request is encrypted through the card application to obtain encrypted data, so that the first terminal sends the target data including the timestamp and the encrypted data to the second terminal. Compared to the fixed-key encryption method used in related technologies, this solution designs an SDK and card application. Based on the account information corresponding to the application, the SDK and card application determine the appropriate number of key storage areas within the card application. This allows for the determination of a different number of key storage areas for each application, increasing the randomness of key storage. Furthermore, based on the number of key storage areas and the timestamp corresponding to the encryption request, the target key storage area is determined. Encryption is then performed using the key from the target key storage area. This increases the randomness of the selection of the encryption key (the key used for encryption), thereby reducing the possibility of using the same encryption key during data transmission. Even if a key is cracked once, subsequent communication (data transmission) data will not be leaked, ensuring the security of the transmitted data and solving the problem of poor security in related data protection methods.

[0122] Corresponding to the above Figures 1 to 4 Based on the same technical concept, this application also provides a data decryption method in its embodiments. Figure 5This is a flowchart illustrating a data decryption method provided in an embodiment of this application. The method can be executed by a second terminal device, such as an in-vehicle terminal or a mobile phone terminal. In other words, the method can be executed by software or hardware installed on the second terminal device, and includes the following steps:

[0123] S502: Obtain the account information corresponding to the application or system on the second terminal.

[0124] Specifically, the application or system of the second terminal can correspond to the application or system of the first terminal opened by the user.

[0125] S504: Based on account information, determine the number M of key storage areas in the card application using the SDK of the second terminal and the card application of the second terminal.

[0126] Among them, M key storage areas store N sets of keys.

[0127] S506: When receiving target data including encrypted timestamps and encrypted data sent by the first terminal device, the target key storage area is determined from the M key storage areas based on the encrypted timestamps and the number M of key storage areas through the SDK and card application.

[0128] Specifically, the encrypted timestamp can be referred to in the above data encryption method implementation examples, and will not be repeated here.

[0129] S508: Based on the target key in the target key storage area, the target data is decrypted through the card application to obtain the original data.

[0130] It should be noted that the process of determining the target key storage area in S502 to S506 above can refer to the specific implementation process of the above embodiments, and will not be repeated here.

[0131] In the data decryption method of this application embodiment, during the data encryption stage, the SDK and card application determine the corresponding number of key storage areas in the card application based on the account information corresponding to the application. This allows for the determination of a different number of key storage areas for each application, thereby increasing the randomness of key storage in the key storage area. Furthermore, based on the number of key storage areas and the timestamp corresponding to the encryption request, the target key storage area is determined, and encryption is performed based on the key in the target key storage area. This further increases the randomness of the selection of the encryption key (the key used for encryption). Consequently, during the decryption stage, it is more difficult for an attacker to crack the encryption key, ensuring the security of the transmitted data.

[0132] In one implementation, after determining the number M of key storage areas in the card application based on account information (i.e., S504), the following steps G1 to G2 can be performed to store N sets of keys into M key storage areas:

[0133] Step G1: Obtain N sets of keys, and through the SDK and card application, perform hash calculation on each of the received N sets of keys to determine the key hash value corresponding to each key.

[0134] Step G2: Using the card application, based on the key hash value and the number M of key storage areas, determine the key storage area corresponding to each key, so as to store N sets of keys into M key storage areas.

[0135] In one implementation, the target data may also include one or more of the following: a user-selected encryption algorithm and an index of the target key in the target key storage area.

[0136] If the target data also includes a user-selected encryption algorithm, the target data is decrypted using the card application based on the target key in the target key storage area to obtain the original data (i.e., S508). This can be specifically executed as follows: H1:

[0137] Step H1: Based on the encryption algorithm selected by the user and the target key in the target key storage area, the target data is decrypted through the card application to obtain the original data.

[0138] In this embodiment, by introducing a user-selected encryption algorithm, the difficulty of cracking encrypted data is increased, thereby improving data security. In addition, the decryption of the original data is achieved through card application, and both the key and the encryption algorithm are stored in the card, which improves the security of key and encryption algorithm storage.

[0139] In one implementation, the number M (i.e., S504) of key storage areas in the card application is determined based on account information using the SDK of the first terminal and the card application of the first terminal. This can be specifically executed as follows: J1:

[0140] Step J1: Using the SDK and card application of the first terminal, a first hash value is generated based on account information and a hash algorithm, and the number M of key storage areas in the card application is determined based on the first hash value.

[0141] In one implementation, the SDK of the second terminal and the card application of the second terminal generate a first hash value based on account information and a hash algorithm, and determine the number M of key storage areas in the card application based on the first hash value (i.e., step J1). This can be specifically executed as follows: steps K1 to K3:

[0142] Step K1: Based on the account information, perform hash calculation through the SDK of the second terminal to obtain the second hash value, and then convert the second hash value to obtain the first hash value.

[0143] The first hash value is a decimal string.

[0144] Step K2: Send the first hash value to the card application via the SDK.

[0145] Step K3: Using the card application, based on the received first hash value, determine the number M of key storage areas in the card application to initialize the key storage areas.

[0146] In one implementation, the card application is installed on the Super SIM card, and the key storage area is a secure storage area of ​​the Super SIM card.

[0147] In one implementation, after determining the number M (i.e., S504) of key storage areas in the card application based on account information, the following step L1 can be performed to update the key:

[0148] Step L1: Receive N sets of keys from the server, and update the keys in the key storage area of ​​the card application through the SDK and the card application.

[0149] Among them, N sets of keys are issued by the server in response to the key update request sent by the first terminal to the server.

[0150] It should be noted that the data decryption process described above can be referred to the specific implementation process of the above embodiments, and will not be repeated here.

[0151] Corresponding to the data encryption method provided in the above embodiments, based on the same technical concept, this embodiment of the invention also provides a data encryption device. Figure 6 This is a schematic diagram of a data encryption device according to an embodiment of the present invention, which is used to perform... Figures 1 to 4 The described data encryption method, such as Figure 6 As shown, the data encryption device includes: a first sending module 610, a first determining module 620, a second determining module 630, and an encryption module 640.

[0152] The first sending module 610 is used to obtain the account information corresponding to the application or system of the first terminal;

[0153] The first determining module 620 is used to determine the number M of key storage areas in the card application based on account information through the SDK of the first terminal and the card application of the first terminal; wherein, M key storage areas store N sets of keys.

[0154] The second determining module 630 is used to determine the target key storage area among M key storage areas by means of the SDK and card application, based on the timestamp corresponding to the encryption request and the number M of key storage areas, when an encryption request is obtained to instruct the encryption of the original data.

[0155] The encryption module 640 is used to encrypt the original data of the encryption request based on the key in the target key storage area via a card application to obtain encrypted data, so that the first terminal can send the target data including the timestamp and the encrypted data to the second terminal.

[0156] In one implementation, the data encryption device further includes a first storage module 650. The storage module 650 is used for:

[0157] Obtain N sets of keys, and through the SDK and card application, perform hash calculation on each of the received N sets of keys to determine the key hash value corresponding to each key;

[0158] By using the card application, based on the key hash value and the number M of key storage areas, the key storage area corresponding to each key is determined, so that N sets of keys can be stored in M ​​key storage areas.

[0159] In one implementation, the aforementioned encryption request also includes a user-selected encryption algorithm. The second determining module 630 is specifically used for:

[0160] When an encryption request is received that instructs the original data to be encrypted, the encryption request is sent to the SDK;

[0161] The SDK receives encryption requests and determines the timestamp corresponding to the encryption request based on the time the encryption request is received.

[0162] Sends an encryption request, including the raw data and the user-selected encryption algorithm, along with a timestamp, to the card application via the SDK;

[0163] Using the card application, the target key storage area is determined from among the M key storage areas based on the received timestamp and the number M of key storage areas.

[0164] Correspondingly, the encryption module 640 is specifically used for:

[0165] The card application encrypts the original data using the key in the target key storage area and the encryption algorithm selected by the user, resulting in encrypted data.

[0166] In one implementation, the target data may also include a user-selected encryption algorithm, or an index of the user-selected encryption algorithm and the key in the target key storage area.

[0167] In one implementation, the first determining module 620 includes:

[0168] The first determining unit 6201 is used to generate a first hash value based on account information and a hash algorithm through the SDK of the first terminal and the card application of the first terminal, and to determine the number M of key storage areas in the card application based on the first hash value.

[0169] In one implementation, the first determining unit 6201 is specifically used for:

[0170] Based on the account information, a hash calculation is performed using the SDK to obtain a second hash value, which is then converted to obtain a first hash value; the first hash value is a decimal string.

[0171] The first hash value is sent to the card application via the SDK;

[0172] The card application determines the number M of key storage areas in the card application based on the received first hash value, and initializes the key storage areas.

[0173] In one implementation, the aforementioned card application is installed on a super SIM card, and the key storage area is a secure storage area of ​​the super SIM card.

[0174] In one implementation, the data encryption device further includes a key request module 660. The key request module 660 is used for:

[0175] Send a key update request to the server so that the server generates and sends N sets of keys to the first terminal and sends N sets of keys to the second terminal based on the key update request;

[0176] Upon receiving N sets of keys from the server, the key storage area of ​​the card application is updated via the SDK and the card application.

[0177] In this embodiment, the account information corresponding to the application or system of the first terminal is obtained; based on the account information, the number M of key storage areas in the card application is determined through the SDK and card application of the first terminal; wherein, N sets of keys are stored in the M key storage areas; when an encryption request for instructing the encryption of the original data is obtained, the target key storage area is determined from the M key storage areas through the SDK and card application based on the timestamp corresponding to the encryption request and the number M of key storage areas; wherein, the encryption request is used to instruct the encryption of the original data; then, based on the key in the target key storage area, the original data of the encryption request is encrypted through the card application to obtain encrypted data, so that the first terminal sends the target data including the timestamp and the encrypted data to the second terminal. Compared to the fixed-key encryption method used in related technologies, this solution designs an SDK and card application. Based on the account information corresponding to the application, the SDK and card application determine the appropriate number of key storage areas within the card application. This allows for the determination of a different number of key storage areas for each application, increasing the randomness of key storage. Furthermore, based on the number of key storage areas and the timestamp corresponding to the encryption request, the target key storage area is determined. Encryption is then performed using the key from the target key storage area. This increases the randomness of the selection of the encryption key (the key used for encryption), thereby reducing the possibility of using the same encryption key during data transmission. Even if a key is cracked once, subsequent communication (data transmission) data will not be leaked, ensuring the security of the transmitted data and solving the problem of poor security in related data protection methods.

[0178] Those skilled in the art will understand that the above-described data encryption device can be used to implement the data encryption method described above, and the detailed description therein should be similar to the method description in the preceding text. To avoid repetition, it will not be repeated here.

[0179] Corresponding to the data decryption method provided in the above embodiments, based on the same technical concept, the present invention also provides a data decryption device. Figure 7 This is a schematic diagram of the structure of a data decryption device according to an embodiment of the present invention. The data decryption device is used to perform... Figure 5 The described data decryption method, such as Figure 7 As shown, the data decryption device includes: a second sending module 710, a third determining module 720, a fourth determining module 730, and a decryption module 740.

[0180] The second sending module 710 is used to obtain the account information corresponding to the application or system of the second terminal;

[0181] The third determining module 720 is used to determine the number M of key storage areas in the card application based on account information through the SDK of the second terminal and the card application of the second terminal; wherein, M key storage areas store N sets of keys.

[0182] The fourth determining module 730 is used to determine the target key storage area from M key storage areas based on the encrypted timestamp and the number M of key storage areas when it receives target data including encrypted timestamp and encrypted data sent by the first terminal device, through SDK and card application.

[0183] The decryption module 740 is used to decrypt the target data through the card application based on the target key in the target key storage area to obtain the original data.

[0184] In one implementation, the data decryption device further includes a second storage module 750. The second storage module 750 is used for:

[0185] Obtain N sets of keys, and through the SDK and card application, perform hash calculation on each of the received N sets of keys to determine the key hash value corresponding to each key;

[0186] By using the card application, based on the key hash value and the number M of key storage areas, the key storage area corresponding to each key is determined, so that N sets of keys can be stored in M ​​key storage areas.

[0187] In one implementation, the target data may also include one or more of the following: a user-selected encryption algorithm and an index of the target key in the target key storage area.

[0188] In one implementation, the third determining module 720 includes:

[0189] The second determining unit 7201 is used to generate a first hash value based on account information and a hash algorithm through the SDK of the first terminal and the card application of the first terminal, and to determine the number M of key storage areas in the card application based on the first hash value.

[0190] In one implementation, the second determining unit 7201 is specifically used for:

[0191] Based on the account information, a hash calculation is performed using the SDK to obtain a second hash value, which is then converted to obtain a first hash value; the first hash value is a decimal string.

[0192] The first hash value is sent to the card application via the SDK;

[0193] The card application determines the number M of key storage areas in the card application based on the received first hash value, and initializes the key storage areas.

[0194] In one implementation, the card application is installed on the Super SIM card, and the key storage area is a secure storage area of ​​the Super SIM card.

[0195] In one implementation, the data decryption device further includes an update module 760. The update module 760 is used for:

[0196] Receive N sets of keys from the server, and update the keys in the key storage area of ​​the card application through the SDK and card application.

[0197] Among them, N sets of keys are issued by the server in response to the key update request sent by the first terminal to the server.

[0198] Those skilled in the art will understand that the above-described data decryption apparatus can be used to implement the data decryption method described above, and the detailed description therein should be similar to the method description in the preceding text. To avoid repetition, it will not be repeated here.

[0199] In this embodiment, during the data encryption stage, the SDK and card application determine the corresponding number of key storage areas in the card application based on the account information corresponding to the application. This allows for the determination of a different number of key storage areas for each application, thereby increasing the randomness of key storage. Furthermore, based on the number of key storage areas and the timestamp corresponding to the encryption request, the target key storage area is determined, and encryption is performed based on the key in the target key storage area. This further increases the randomness of the selection of the encryption key (the key used for encryption). Consequently, during the decryption stage, it is more difficult for an attacker to crack the encryption key, ensuring the security of the transmitted data.

[0200] Based on the same technical concept, this application also provides an electronic device for performing the above-described data encryption method. Figure 8 This is a schematic diagram of the structure of an electronic device to implement various embodiments of this application. The electronic device can vary significantly due to differences in configuration or performance, and may include a processor 810, a communications interface 820, a memory 830, and a communication bus 840. The processor 810, communications interface 820, and memory 830 communicate with each other via the communication bus 840. The processor 810 can call a computer program stored in the memory 830 and executable on the processor 810 to perform the following steps:

[0201] Obtain the account information corresponding to the application or system on the first terminal;

[0202] Based on the account information, the number M of key storage areas in the card application is determined using the SDK and card application of the first terminal; among them, M key storage areas store N sets of keys.

[0203] When an encryption request is received that instructs the original data to be encrypted, the target key storage area is determined from the M key storage areas based on the timestamp corresponding to the encryption request and the number M of key storage areas, through the SDK and card application; wherein, the encryption request is used to instruct the original data to be encrypted;

[0204] By using the card application, the original data of the encryption request is encrypted based on the key in the target key storage area to obtain encrypted data, so that the first terminal can send the target data, including the timestamp and the encrypted data, to the second terminal.

[0205] Or perform the following steps:

[0206] Obtain the account information corresponding to the application or system on the second terminal;

[0207] Based on the account information, the number M of key storage areas in the card application is determined using the SDK of the second terminal and the card application of the second terminal; among them, M key storage areas store N sets of keys.

[0208] When the target data including encrypted timestamps and encrypted data is received from the first terminal device, the target key storage area is determined from the M key storage areas based on the encrypted timestamps and the number of key storage areas M.

[0209] Based on the target key in the target key storage area, the target data is decrypted through the card application to obtain the original data.

[0210] In this embodiment, the account information corresponding to the application or system of the first terminal is obtained; based on the account information, the number M of key storage areas in the card application is determined through the SDK and card application of the first terminal; wherein, N sets of keys are stored in the M key storage areas; when an encryption request for instructing the encryption of the original data is obtained, the target key storage area is determined from the M key storage areas through the SDK and card application based on the timestamp corresponding to the encryption request and the number M of key storage areas; wherein, the encryption request is used to instruct the encryption of the original data; then, based on the key in the target key storage area, the original data of the encryption request is encrypted through the card application to obtain encrypted data, so that the first terminal sends the target data including the timestamp and the encrypted data to the second terminal. Compared to the fixed-key encryption method used in related technologies, this solution designs an SDK and card application. Based on the account information corresponding to the application, the SDK and card application determine the appropriate number of key storage areas within the card application. This allows for the determination of a different number of key storage areas for each application, increasing the randomness of key storage. Furthermore, based on the number of key storage areas and the timestamp corresponding to the encryption request, the target key storage area is determined. Encryption is then performed using the key from the target key storage area, further increasing the randomness of the selection of the encryption key (the key used for encryption). This reduces the possibility of using the same encryption key during data transmission. During the decryption phase, it is highly difficult for an attacker to crack the encryption key. Even if the key is cracked once, subsequent communication (data transmission) data will not be leaked, ensuring the security of the transmitted data. This solves the problem of poor security in related data protection methods.

[0211] For specific execution steps, please refer to the above-described data encryption method embodiments, or the various steps of the above-described data decryption method embodiments, which can achieve the same technical effect. To avoid repetition, they will not be described again here.

[0212] It should be noted that the electronic devices in the embodiments of this application include: servers, terminals, or other devices besides terminals.

[0213] The above electronic device structure does not constitute a limitation on the electronic device. An electronic device may include more or fewer components than illustrated, or combine certain components, or arrange them differently. For example, an input unit may include a Graphics Processing Unit (GPU) and a microphone, and a display unit may use a liquid crystal display (LCD), organic light-emitting diode (OLED), or other similar display panels. User input units include at least one of a touch panel and other input devices. A touch panel is also called a touchscreen. Other input devices may include, but are not limited to, physical keyboards, function keys (such as volume control buttons, power buttons, etc.), trackballs, mice, and joysticks, which will not be elaborated further here.

[0214] Memory can be used to store software programs and various data. Memory can primarily include a first storage area for storing programs or instructions and a second storage area for storing data. The first storage area can store the operating system, application programs or instructions required for at least one function (such as sound playback, image playback, etc.). Furthermore, memory can include volatile memory or non-volatile memory, or both. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory can be random access memory (RAM), static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (Synchlink DRAM, SLDRAM), and direct memory bus RAM (DRRAM).

[0215] The processor may include one or more processing units; optionally, the processor integrates an application processor and a modem processor, wherein the application processor mainly handles operations related to the operating system, user interface, and applications, while the modem processor mainly handles wireless communication signals, such as a baseband processor. It is understood that the aforementioned modem processor may also not be integrated into the processor.

[0216] This application also provides a storage medium storing computer-executable instructions. When these computer-executable instructions are executed by a processor, they implement the various processes of the above-described data encryption method embodiments or the above-described data decryption method embodiments, and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0217] The processor is the processor in the electronic device described in the above embodiments. The storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0218] This application embodiment also provides a chip, which includes a processor and a communication interface. The communication interface and the processor are coupled. The processor is used to run programs or instructions to implement the various processes of the above-described data encryption method embodiment or the above-described data decryption method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0219] It should be understood that the chip mentioned in the embodiments of this application may also be referred to as a system-on-a-chip, system chip, chip system, or system-on-a-chip, etc.

[0220] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the various processes of the above-described data encryption method embodiment or the above-described data decryption method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0221] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include multitasking and parallel processing according to the functions involved, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0222] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0223] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A data encryption method, characterized in that, Applied to a first terminal, the method includes: Obtain the account information corresponding to the application or system on the first terminal; Using the software development kit (SDK) of the first terminal and the card application of the first terminal, the number M of key storage areas in the card application is determined based on the account information; wherein, M key storage areas store N sets of keys. When an encryption request is received indicating that the original data should be encrypted, the target key storage area is determined from the M key storage areas based on the timestamp corresponding to the encryption request and the number M of the key storage areas through the SDK and the card application. The card application encrypts the original data of the encryption request based on the key in the target key storage area to obtain encrypted data, so that the first terminal can send target data including the timestamp and the encrypted data to the second terminal.

2. The method according to claim 1, characterized in that, After determining the number M of key storage areas in the card application based on the account information, the method further includes: Obtain the N sets of keys, and through the SDK and the card application, perform a hash calculation on each of the N sets of keys to determine the key hash value corresponding to each key; By using the card application, based on the key hash value and the number M of the key storage areas, the key storage area corresponding to each key is determined, so as to store the N sets of keys into the M key storage areas.

3. The method according to claim 1, characterized in that, The encryption request also includes a user-selected encryption algorithm; when an encryption request instructing the encryption of the original data is received, the target key storage area is determined from the M key storage areas based on the timestamp corresponding to the encryption request and the number M of key storage areas, using the SDK and the card application, including: When an encryption request is received indicating that the original data should be encrypted, the encryption request is sent to the SDK; The SDK receives the encryption request and determines the timestamp corresponding to the encryption request based on the time the encryption request is received. The SDK sends an encryption request, including the original data, the encryption algorithm selected by the user, and the timestamp to the card application. Using the card application, a target key storage area is determined from the M key storage areas based on the received timestamp and the number M of the key storage areas; Accordingly, the step of encrypting the original data using the card application based on the key in the target key storage area to obtain encrypted data includes: The card application encrypts the original data based on the key in the target key storage area and the encryption algorithm selected by the user, resulting in encrypted data.

4. The method according to claim 3, characterized in that The target data also includes the encryption algorithm selected by the user, or the encryption algorithm selected by the user and the index of the key in the target key storage area.

5. The method according to claim 1, characterized in that, The step of determining the number M of key storage areas in the card application based on the account information through the SDK of the first terminal and the card application of the first terminal includes: Using the SDK of the first terminal and the card application of the first terminal, a first hash value is generated based on the account information and hash algorithm, and the number M of key storage areas in the card application is determined based on the first hash value.

6. The method according to claim 5, characterized in that, The step of generating a first hash value based on the account information and a hash algorithm using the SDK of the first terminal and the card application of the first terminal, and determining the number M of key storage areas in the card application based on the first hash value, includes: Based on the account information, a hash calculation is performed using the SDK to obtain a second hash value, and the second hash value is then converted to obtain the first hash value; wherein, the first hash value is a decimal string; The first hash value is sent to the card application via the SDK; Based on the received first hash value, the number M of key storage areas in the card application is determined to initialize the key storage areas.

7. The method according to claim 1, characterized in that, After determining the number M of key storage areas in the card application based on the account information, the method further includes: A key update request is sent to the server, so that the server generates and sends the N sets of keys to the first terminal and the second terminal, respectively, based on the key update request. Upon receiving the N sets of keys issued by the server, the key in the key storage area of ​​the card application is updated through the SDK and the card application.

8. A data decryption method, characterized in that, Applied to a second terminal, the method includes: Obtain the account information corresponding to the application or system on the second terminal; Based on the account information, the number M of key storage areas in the card application is determined using the SDK of the second terminal and the card application of the second terminal; wherein, M key storage areas store N sets of keys. When receiving target data including encrypted timestamps and encrypted data sent by the first terminal device, the target key storage area is determined from the M key storage areas based on the encrypted timestamps and the number M of the key storage areas through the SDK and the card application. Based on the target key in the target key storage area, the target data is decrypted through the card application to obtain the original data.

9. The method according to claim 8, characterized in that, After determining the number M of key storage areas in the card application based on the account information, the method further includes: Obtain the N sets of keys, and through the SDK and the card application, perform a hash calculation on each of the N sets of keys to determine the key hash value corresponding to each key; By using the card application, based on the key hash value and the number M of the key storage areas, the key storage area corresponding to each key is determined, so as to store the N sets of keys into the M key storage areas.

10. The method according to claim 8, characterized in that, The target data also includes one or more of the following: a user-selected encryption algorithm and an index of the target key in the target key storage area; If the target data also includes a user-selected encryption algorithm, the process of decrypting the target data using the card application based on the target key in the target key storage area to obtain the original data includes: Based on the encryption algorithm selected by the user and the target key in the target key storage area, the target data is decrypted through the card application to obtain the original data.

11. A data encryption device, characterized in that, Applied to a first terminal, the device includes: The first sending module is used to obtain the account information corresponding to the application or system of the first terminal; The first determining module is used to determine the number M of key storage areas in the card application based on the account information, using the software development kit (SDK) of the first terminal and the card application of the first terminal; wherein, the M key storage areas store N sets of keys; The second determining module is used to determine a target key storage area from the M key storage areas by means of the SDK and the card application, based on the timestamp corresponding to the encryption request and the number M of the key storage areas, when an encryption request for instructing the encryption of the original data is obtained. An encryption module is used to encrypt the original data of the encryption request based on the key in the target key storage area through the card application to obtain encrypted data, so that the first terminal can send target data including the timestamp and the encrypted data to the second terminal.

12. An electronic device, characterized in that, The electronic device includes: Processor; and A memory configured to store computer-executable instructions, the executable instructions being configured to be executed by the processor, the executable instructions including instructions for performing a data encryption method as described in any one of claims 1-7, or for performing a data decryption method as described in any one of claims 8-10.

13. A storage medium, characterized in that, The storage medium is used to store computer-executable instructions that cause a computer to perform the data encryption method as described in any one of claims 1-7, or to perform the data decryption method as described in any one of claims 8-10.

Images