Encryption and decryption method and device for CDN, medium, electronic equipment and program product

Abstract

The invention discloses an encryption and decryption method and device for a CDN, a medium, electronic equipment and a program product, and belongs to the technical field of encryption and decryption. The encryption method for the CDN comprises the steps that a first key set is generated, and the first key set comprises a plurality of first keys; calculating a hash value of each first key; generating a second key corresponding to each first key according to the first key; determining a mapping relationship between the second key and the hash value; encrypting plaintext data by using the second key to obtain an encrypted ciphertext; and transmitting the encrypted ciphertext and the hash value corresponding to the second key used for encryption together. According to the method, central dependence can be removed, and high service availability of an encryption end and a decryption end is realized.

Description

Technical Field

[0001] The present disclosure relates to the technical field of encryption and decryption, and in particular, to an encryption and decryption method and device, medium, electronic device and program product for CDN. Background Art

[0002] Edge nodes in the content distribution network (CDN) need to encrypt and store some sensitive configurations, server certificates, etc. The usual approach is that the configuration generator and the configuration user use the same key, which is managed by the key management service (KMS) deployed in the center and distributed to the configuration generator and the configuration user. The configuration generator uses the key to symmetric encrypt the sensitive configuration, and the configuration user (for example, numerous edge nodes) uses the key to symmetric decrypt the encrypted sensitive configuration.

[0003] The disadvantage of the above encryption and decryption scheme is that the configuration generation end and the configuration usage end need to interact with KMS. When KMS is unavailable, the services of the configuration generation end and the configuration usage end are also unavailable. Moreover, the pressure on KMS is proportional to the "number of edge nodes * number of key acquisition times". Summary of the invention

[0004] This summary is provided to introduce concepts in a brief form that will be described in detail in the detailed description below. This summary is not intended to identify key features or essential features of the claimed technical solution, nor is it intended to limit the scope of the claimed technical solution.

[0005] In a first aspect, the present disclosure provides an encryption method for a CDN, comprising: generating a first key set, wherein the first key set includes multiple first keys; calculating a hash value of each of the first keys; generating a second key corresponding to each of the first keys based on the first keys; determining a mapping relationship between the second key and the hash value; encrypting plaintext data using the second key to obtain an encrypted ciphertext; and transmitting the encrypted ciphertext together with the hash value corresponding to the second key used for encryption.

[0006] In a second aspect, the present disclosure provides a decryption method for a CDN, comprising: using the encryption method according to the first aspect to obtain the first key set, a hash value of each first key, the second key, and a mapping relationship between the second key and the hash value; receiving an encrypted ciphertext and a hash value transmitted along with the encrypted ciphertext; determining a second key for decrypting the encrypted ciphertext based on the mapping relationship and the received hash value; and decrypting the encrypted ciphertext using the determined second key.

[0007] In a third aspect, the present disclosure provides an encryption device for a CDN, comprising: a first generating module, used to generate a first key set, wherein the first key set includes multiple first keys, calculate a hash value of each of the first keys, generate a second key corresponding to each of the first keys based on the first keys, and determine a mapping relationship between the second key and the hash value; an encryption module, used to encrypt plaintext data using the second key to obtain an encrypted ciphertext; and a sending module, used to transmit the encrypted ciphertext together with the hash value corresponding to the second key used for encryption.

[0008] In a fourth aspect, the present disclosure provides a decryption device for CDN, comprising: a second generation module, used to use the encryption method for CDN according to any one of the first aspects to obtain the first key set, the hash value of each first key, the second key, and the mapping relationship between the second key and the hash value; a receiving module, used to receive an encrypted ciphertext and a hash value transmitted together with the encrypted ciphertext; a decryption module, used to determine a second key for decrypting the encrypted ciphertext according to the mapping relationship and the received hash value, and use the determined second key to decrypt the encrypted ciphertext.

[0009] In a fifth aspect, the present disclosure provides a computer-readable medium having a computer program stored thereon, which, when executed by a processing device, implements the steps of any one of the methods described in the first aspect.

[0010] In a sixth aspect, the present disclosure provides an electronic device, including: a storage device having a computer program stored thereon; A processing device is used to execute the computer program in the storage device to implement the steps of any one of the methods in the first aspect.

[0011] In a seventh aspect, the present disclosure provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of any one of the methods in the first aspect.

[0012] By adopting the above technical solution, since a first key set can be generated, wherein the first key set includes multiple first keys, the hash value of each first key is calculated, and the second key corresponding to each first key is generated according to the first key, the mapping relationship between the second key and the hash value is determined, and the plaintext data is encrypted using the second key to obtain the encrypted ciphertext, and the encrypted ciphertext and the hash value corresponding to the second key used for encryption are transmitted together, therefore, the entire encryption process does not require the KMS as described in the related art, thereby solving the problem of central dependence in the related art, being able to remove the central dependence, and achieving high availability of services at the encryption end and the decryption end. Moreover, due to the large number of keys, there are few cases where the same key is used to encrypt plaintext data, and the possibility of cracking the encrypted ciphertext is very low. Even if one key is cracked, it will not cause all the data to be leaked, thereby improving the security of data transmission (such as data transmission in CDN). In addition, since the encryption method for CDN according to the embodiment of the present disclosure uses a symmetric encryption and decryption algorithm, a large amount of computing resources are saved, and the encryption and decryption performance is greatly improved.

[0013] Other features and advantages of the present disclosure will be described in detail in the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale. In the drawings: Figure 1 is a flow chart of an encryption method according to an embodiment of the present disclosure.

[0015] Figure 2 is a flowchart of a decryption method according to an embodiment of the present disclosure.

[0016] Figure 3 It is a schematic diagram of the encryption and decryption process according to an embodiment of the present disclosure.

[0017] Figure 4 It is a schematic block diagram of an encryption device according to an embodiment of the present disclosure.

[0018] Figure 5 It is a schematic block diagram of a decryption device according to an embodiment of the present disclosure.

[0019] Figure 6 A schematic diagram of the structure of an electronic device suitable for implementing the embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0020] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0021] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0022] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0023] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0024] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0025] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0026] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0027] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can autonomously choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0028] As an optional but non-limiting implementation, in response to receiving an active request from the user, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0029] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet the relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0030] At the same time, it is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0031] Figure 1 The present invention is a flowchart of an encryption method for CDN according to an embodiment of the present invention. The encryption method for CDN is applied to the encryption end. The encryption method for CDN can be applied to various scenarios, for example, the scenario where the edge node in the CDN needs to encrypt and store some sensitive configurations, server certificates, etc., the scenario where the server in the CDN verifies whether the request (for example, including the request header and request body) has been tampered with during transmission, etc. Figure 1 As shown, the encryption method for CDN may include the following steps S11 to S16.

[0032] In step S11, a first key set is generated, wherein the first key set includes a plurality of first keys.

[0033] In some embodiments, generating the first key set in step S11 may include: obtaining the first key set by taking out several bits from a key seed and arranging them, wherein the key seed is a key seed pre-negotiated by the encryption end and the decryption end, and the bits taken out from the key seed and the arrangement method are pre-negotiated by the encryption end and the decryption end.

[0034] For example, the encryption end and the decryption end may pre-negotiate to use "hello world!" as the key seed, and pre-negotiate to extract 5 letters from the key seed to obtain the first key. The extraction method may include, for example, extracting a letter every other digit, extracting a letter every two digits, extracting letters by alternately extracting a letter every other digit and extracting a letter every two digits, etc. The arrangement method of the extracted letters may include, for example, arranging in the ascending order according to the extraction order, arranging in the reverse order according to the extraction order, arranging in a preset mathematical arrangement method, etc.

[0035] The number of first keys in the first key set is positively correlated with the length of the key seed and the number of bits extracted. The larger the length of the key seed and the number of bits extracted, the greater the number of first keys, and thus the greater the number of second keys described later.

[0036] In step S12, a hash value of each first key is calculated.

[0037] In some embodiments, various hash algorithms may be used to calculate the hash value of each first key, such as the md5sum algorithm.

[0038] In addition, if there is a conflict between the hash values ​​of the two first keys, one of the two first keys can be invalidated, for example, the first key generated earlier is invalidated, and the first key generated later is retained. In this way, the problem of hash value conflict is solved.

[0039] In step S13, a second key corresponding to each first key is generated according to the first key.

[0040] In some embodiments, generating the second key corresponding to each first key according to the first key in step S13 may include: generating the second key corresponding to each first key by expanding each first key, wherein the manner of expanding each first key is pre-negotiated by the encryption end and the decryption end.

[0041] There are various ways to expand the first key. For example, the first key can be expanded by repeating the first key once, the first key can be expanded by repeating the last N bits of the first key, and so on.

[0042] In some embodiments, each first key is expanded into a second key, so that a one-to-one correspondence between the first key and the second key can be obtained.

[0043] In step S14, a mapping relationship between the second key and the hash value is determined.

[0044] Since there is a corresponding relationship between the hash value and the first key, and there is a corresponding relationship between the second key and the first key, the mapping relationship between the second key and the hash value can be obtained accordingly.

[0045] In some embodiments, the second key, the hash value, and the mapping relationship between the second key and the hash value can be maintained in the memory (ie, the memory of the encryption end), that is, no persistent storage is performed, thereby improving the security of the key.

[0046] In step S15, the plaintext data is encrypted using the second key to obtain encrypted ciphertext.

[0047] In some embodiments, a second key can be randomly selected from the generated second keys, and the randomly selected second key can be used to encrypt the plaintext data to obtain the encrypted ciphertext. By randomly selecting the second key used for encryption, the key used to encrypt the plaintext data has randomness, which greatly reduces the possibility of the encrypted ciphertext being intercepted, the key cracked, and tampered, and improves the reliability of data transmission from edge nodes to edge nodes and from edge nodes to the center.

[0048] In step S16, the encrypted ciphertext and the hash value corresponding to the second key used for encryption are transmitted together.

[0049] That is, what is transmitted together with the encrypted ciphertext is the hash value of the first key, rather than the second key actually used for encryption. Therefore, the difficulty of deciphering the encrypted ciphertext is increased, and the security of the encrypted ciphertext is improved.

[0050] By adopting the above technical solution, since a first key set can be generated, wherein the first key set includes multiple first keys, the hash value of each first key is calculated, and the second key corresponding to each first key is generated according to the first key, the mapping relationship between the second key and the hash value is determined, and the plaintext data is encrypted using the second key to obtain the encrypted ciphertext, and the encrypted ciphertext and the hash value corresponding to the second key used for encryption are transmitted together, therefore, the entire encryption process does not require the KMS as described in the related art, thereby solving the problem of central dependence in the related art, being able to remove the central dependence, and achieving high availability of services at the encryption end and the decryption end. Moreover, due to the large number of keys, there are few cases where the same key is used to encrypt plaintext data, and the possibility of cracking the encrypted ciphertext is very low. Even if one key is cracked, it will not cause all the data to be leaked, thereby improving the security of data transmission (such as data transmission in CDN). In addition, since the encryption method for CDN according to the embodiment of the present disclosure uses a symmetric encryption and decryption algorithm, a large amount of computing resources are saved, and the encryption and decryption performance is greatly improved.

[0051] In some embodiments, the encryption method for CDN according to the embodiment of the present disclosure may also include: after the encryption end and the decryption end both agree to update the key, using the new key seed negotiated by the encryption end and the decryption end to update the first key, hash value, second key and mapping relationship.

[0052] For example, when the key needs to be updated (for example, due to key leakage and other reasons, the key needs to be updated), it can be implemented through a specific open application programming interface (Open Application Programming Interface, OpenAPI) or a request header. A key update request is initiated by one of the encryption end and the decryption end, wherein a new key seed is carried in the key update request. For security, the new key seed carried needs to be encrypted, wherein the encryption method for CDN according to the embodiment of the present disclosure described above can be used to encrypt the new key seed. After the other end of the encryption end and the decryption end receives and passes the key update request, the encryption end and the decryption end both start to use the new key seed to update the first key set, hash value, second key, and the mapping relationship between the second key and the hash value. In addition, the old first key set, hash value, second key, and the mapping relationship between the second key and the hash value need to be retained in the encryption end and the decryption end process memory for a period of time to consume the data in transmission. In addition, the key seed currently used needs to be persistently stored to avoid the failure to initialize and generate the first key set when the program exits unexpectedly and restarts.

[0053] By adopting the above technical solution, high timeliness and high compatibility of key updates can be achieved, and hot updates of keys are supported, and the update process is lightweight.

[0054] Figure 2 The present invention is a flowchart of a decryption method for CDN according to an embodiment of the present invention. The decryption method for CDN can be applied to a decryption end. The decryption method for CDN can be applied to various scenarios, for example, a scenario where an edge node in a CDN needs to encrypt and store some sensitive configurations, server certificates, etc., a scenario where a server in a CDN verifies whether a request (for example, including a request header and a request body) has been tampered with during transmission, etc. Figure 2 As shown, the decryption method for CDN may include the following steps S21 to S24.

[0055] In step S21, the encryption method for CDN according to the present disclosure is used to obtain a first key set, a hash value of each first key, a second key, and a mapping relationship between the second key and the hash value.

[0056] That is, the same method as that used by the encryption end is used at the decryption end to generate the first key set, the hash value of each first key, the second key, and the mapping relationship between the second key and the hash value. For example, at the decryption end, the same method as described in step S11 is used to generate the first key set, the same method as described in step S12 is used to calculate the hash value of the first key, the same method as described in step S13 is used to generate the second key corresponding to each first key, and the same method as described in step S14 is used to determine the mapping relationship between the second key and the hash value.

[0057] In addition, the key seed used by the decryption end, the key seed extraction bits and the arrangement of the extracted bits, the hash algorithm used, the expansion method of the first key, etc. are all consistent with the encryption end.

[0058] At the decryption end, the second key, hash value, and mapping relationship between the second key and hash value generated by the decryption end are maintained in the memory (ie, the memory of the decryption end), that is, no persistent storage is performed, thereby improving the security of the key.

[0059] In step S22, the encrypted ciphertext and the hash value transmitted along with the encrypted ciphertext are received.

[0060] In step S23, a second key for decrypting the encrypted ciphertext is determined according to the mapping relationship and the received hash value.

[0061] Since the mapping relationship between the hash value and the second key is stored in the decryption end, after receiving the hash value transmitted together with the encrypted ciphertext, the second key corresponding to the hash value can be found as the key for decrypting the encrypted ciphertext.

[0062] In step S24, the encrypted ciphertext is decrypted using the determined second key.

[0063] By adopting the above technical solution, since the encryption method for CDN described in the present disclosure can be used to obtain the first key set, the hash value of each first key, the second key, and the mapping relationship between the second key and the hash value, the encrypted ciphertext and the hash value transmitted together with the encrypted ciphertext are received, and the second key used to decrypt the encrypted ciphertext is determined according to the mapping relationship and the received hash value, and the encrypted ciphertext is decrypted using the determined second key, therefore, the entire decryption process does not require the KMS as described in the related art, thereby solving the problem of central dependence in the related art, being able to remove the central dependence, and achieving high availability of services at the encryption end and the decryption end. Moreover, due to the large number of keys, there are few cases where the same key is used to encrypt plaintext data, and the possibility of cracking the encrypted ciphertext is very low. Even if one key is cracked, it will not cause all the data to be leaked, thereby improving the security of data transmission (such as data transmission in CDN). In addition, since the decryption method according to the embodiment of the present disclosure uses a symmetric encryption and decryption algorithm, a large amount of computing resources are saved, and the encryption and decryption performance is greatly improved.

[0064] In some embodiments, the decryption method for CDN according to the embodiment of the present disclosure may also include: after the encryption end and the decryption end both agree to update the key, using the new key seed negotiated by the encryption end and the decryption end to update the first key, hash value, second key and mapping relationship.

[0065] For example, when the key needs to be updated (for example, due to key leakage and other reasons, the key needs to be updated), it can be implemented through a specific open application programming interface (Open Application Programming Interface, OpenAPI) or a request header. A key update request is initiated by one of the encryption end and the decryption end, wherein a new key seed is carried in the key update request. For security, the new key seed carried needs to be encrypted, wherein the encryption method for CDN according to the embodiment of the present disclosure described above can be used to encrypt the new key seed. After the other end of the encryption end and the decryption end receives and passes the key update request, the encryption end and the decryption end both start to use the new key seed to update the first key set, hash value, second key, and the mapping relationship between the second key and the hash value. In addition, the old first key set, hash value, second key, and the mapping relationship between the second key and the hash value need to be retained in the encryption end and the decryption end process memory for a period of time to consume the data in transmission. In addition, the key seed currently used needs to be persistently stored to avoid the failure to initialize and generate the first key set when the program exits unexpectedly and restarts.

[0066] By adopting the above technical solution, high timeliness and high compatibility of key updates can be achieved, and hot updates of keys are supported, and the update process is lightweight.

[0067] Figure 3 The present invention is a schematic diagram of an encryption and decryption process for a CDN according to an embodiment of the present invention.

[0068] like Figure 3 As shown, at the encryption end and the decryption end, the method for CDN described in steps S11 to S14 above is respectively used to obtain the first key set, the hash value of each first key, the second key, and the mapping relationship between the second key and the hash value.

[0069] At the encryption end, one of the second keys is randomly selected to encrypt the plaintext data to obtain an encrypted ciphertext, and then the encrypted ciphertext and the hash value corresponding to the second key used for encryption are transmitted together.

[0070] At the decryption end, the encrypted ciphertext and the hash value transmitted with the encrypted ciphertext are received. Then, according to the mapping relationship and the received hash value, a second key for decrypting the encrypted ciphertext is determined. Then, the encrypted ciphertext is decrypted using the determined second key.

[0071] By adopting the above encryption and decryption process, the entire encryption and decryption process for CDN does not require the KMS described in the related art, thereby solving the problem of central dependence in the related art, being able to remove central dependence, and achieving high availability of services on the encryption and decryption ends. Moreover, due to the large number of keys, it is rare to use the same key to encrypt plaintext data, and the possibility of cracking the encrypted ciphertext is very low. Even if one key is cracked, it will not cause all the data to be leaked, thereby improving the security of data transmission (such as CDN data transmission). In addition, since the encryption and decryption method according to the embodiment of the present disclosure uses a symmetric encryption and decryption algorithm, a large amount of computing resources are saved, greatly improving the encryption and decryption performance.

[0072] Figure 4 The present invention is a schematic block diagram of an encryption device for CDN according to an embodiment of the present invention. The encryption device for CDN is applied to an encryption end. The encryption device for CDN can be applied to various scenarios, for example, a scenario where an edge node in a CDN needs to encrypt and store some sensitive configurations, server certificates, etc., a scenario where a CDN server verifies whether a request (for example, including a request header and a request body) has been tampered with during transmission, etc.

[0073] like Figure 4As shown, the encryption device 40 for CDN includes: a first generating module 41, used to generate a first key set, wherein the first key set includes multiple first keys, calculate the hash value of each first key, generate a second key corresponding to each first key according to the first key, and determine the mapping relationship between the second key and the hash value; an encryption module 42, used to encrypt plaintext data using the second key to obtain an encrypted ciphertext; a sending module 43, used to transmit the encrypted ciphertext together with the hash value corresponding to the second key used for encryption.

[0074] By adopting the above technical solution, since a first key set can be generated, wherein the first key set includes multiple first keys, the hash value of each first key is calculated, and the second key corresponding to each first key is generated according to the first key, the mapping relationship between the second key and the hash value is determined, and the plaintext data is encrypted using the second key to obtain the encrypted ciphertext, and the encrypted ciphertext and the hash value corresponding to the second key used for encryption are transmitted together, therefore, the entire encryption process does not require the KMS as described in the related art, thereby solving the problem of central dependence in the related art, being able to remove the central dependence, and achieving high availability of services at the encryption end and the decryption end. Moreover, due to the large number of keys, there are few cases where the same key is used to encrypt plaintext data, and the possibility of cracking the encrypted ciphertext is very low. Even if one key is cracked, it will not cause all the data to be leaked, thereby improving the security of data transmission (for example, data transmission in CDN). In addition, since the encryption method according to the embodiment of the present disclosure uses a symmetric encryption and decryption algorithm, a large amount of computing resources are saved, and the encryption and decryption performance is greatly improved.

[0075] Optionally, the first generation module 41 generates a first key set, including: obtaining a first key set by taking out a number of bits from a key seed and arranging them, wherein the key seed is a key seed pre-negotiated by the encryption end and the decryption end, and the bits taken out from the key seed and the arrangement method are pre-negotiated by the encryption end and the decryption end.

[0076] Optionally, the first generation module 41 generates a second key corresponding to each first key based on the first key, including: generating a second key corresponding to each first key by expanding each first key, wherein the manner of expanding each first key is pre-negotiated by the encryption end and the decryption end.

[0077] Optionally, the encryption module 42 uses the second key to encrypt the plaintext data to obtain the encrypted ciphertext, including: randomly selecting a second key from the generated second keys; and encrypting the plaintext data using the randomly selected second key to obtain the encrypted ciphertext.

[0078] Optionally, the encryption device 40 for CDN further includes a storage module (not shown) for maintaining a mapping relationship between the second key and the hash value in a memory.

[0079] Optionally, the encryption device 40 for CDN further includes an update module (not shown) for updating the first key, hash value, second key and mapping relationship using a new key seed negotiated by the encryption end and the decryption end after both the encryption end and the decryption end agree to update the key.

[0080] The specific implementation of the operations performed by the various modules included in the encryption device 40 for CDN according to the embodiment of the present disclosure has been described in detail in the relevant encryption method, and will not be repeated here.

[0081] Figure 5 The present invention is a schematic block diagram of a decryption device for CDN according to an embodiment of the present invention. The decryption device for CDN can be applied to a decryption terminal. The decryption device for CDN can be applied to various scenarios, for example, a scenario where an edge node in a CDN needs to encrypt and store some sensitive configurations, server certificates, etc., a scenario where a CDN server verifies whether a request (for example, including a request header and a request body) has been tampered with during transmission, etc.

[0082] like Figure 5 As shown, the decryption device 50 for CDN may include: a second generating module 51, used to use the encryption method according to the present disclosure to obtain a first key set, a hash value of each first key, a second key, and a mapping relationship between the second key and the hash value; a receiving module 52, used to receive an encrypted ciphertext and a hash value transmitted together with the encrypted ciphertext; a decryption module 53, used to determine a second key for decrypting the encrypted ciphertext according to the mapping relationship and the received hash value, and use the determined second key to decrypt the encrypted ciphertext.

[0083] By adopting the above technical solution, since the encryption method for CDN described in the present disclosure can be used to obtain the first key set, the hash value of each first key, the second key, and the mapping relationship between the second key and the hash value, the encrypted ciphertext and the hash value transmitted together with the encrypted ciphertext are received, and the second key used to decrypt the encrypted ciphertext is determined according to the mapping relationship and the received hash value, and the encrypted ciphertext is decrypted using the determined second key, therefore, the entire decryption process does not require the KMS as described in the related art, thereby solving the problem of central dependence in the related art, being able to remove the central dependence, and achieving high availability of services at the encryption end and the decryption end. Moreover, due to the large number of keys, there are few cases where the same key is used to encrypt plaintext data, and the possibility of cracking the encrypted ciphertext is very low. Even if one key is cracked, it will not cause all the data to be leaked, thereby improving the security of data transmission (such as data transmission in CDN). In addition, since the decryption method according to the embodiment of the present disclosure uses a symmetric encryption and decryption algorithm, a large amount of computing resources are saved, and the encryption and decryption performance is greatly improved.

[0084] The specific implementation of the operations performed by the various modules included in the decryption device 50 for CDN according to the embodiment of the present disclosure has been described in detail in the relevant method, and will not be repeated here.

[0085] The present disclosure also provides a computer-readable medium having a computer program stored thereon, and when the computer program is executed by a processing device, the steps of any method in the present disclosure are implemented.

[0086] The present disclosure also provides an electronic device, comprising: a storage device having a computer program stored thereon; A processing device is used to execute a computer program in a storage device to implement the steps of any method in the present disclosure.

[0087] The present disclosure also provides a computer program product, comprising a computer program, which implements the steps of any method in the present disclosure when executed by a processor.

[0088] Reference below Figure 6 , which shows a schematic diagram of the structure of an electronic device 600 suitable for implementing the embodiment of the present disclosure. The terminal device in the embodiment of the present disclosure may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle terminals (such as vehicle navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 6 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0089] like Figure 6 As shown, the electronic device 600 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the electronic device 600 are also stored. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0090] Typically, the following devices may be connected to the I / O interface 605: an input device 606 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 608 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 609. The communication device 609 may allow the electronic device 600 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 6 The electronic device 600 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0091] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device 609, or installed from a storage device 608, or installed from a ROM 602. When the computer program is executed by the processing device 601, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0092] It should be noted that the computer-readable medium mentioned above in the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. Computer readable signal media may also be any computer readable medium other than computer readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0093] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0094] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0095] The above-mentioned computer-readable medium carries one or more programs. When the above-mentioned one or more programs are executed by the electronic device, the electronic device: generates a first key set, wherein the first key set includes multiple first keys; calculates the hash value of each of the first keys; generates a second key corresponding to each of the first keys based on the first key; determines the mapping relationship between the second key and the hash value; encrypts plaintext data using the second key to obtain encrypted ciphertext; and transmits the encrypted ciphertext together with the hash value corresponding to the second key used for encryption.

[0096] Alternatively, the computer-readable medium carries one or more programs, and when the one or more programs are executed by the electronic device, the electronic device: uses the encryption method described in the present disclosure to obtain the first key set, the hash value of each first key, the second key, and the mapping relationship between the second key and the hash value; receives an encrypted ciphertext and a hash value transmitted together with the encrypted ciphertext; determines a second key for decrypting the encrypted ciphertext based on the mapping relationship and the received hash value; and decrypts the encrypted ciphertext using the determined second key.

[0097] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0098] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0099] The modules involved in the embodiments described in the present disclosure may be implemented by software or hardware. The name of a module does not limit the module itself in some cases. For example, the first generation module may also be described as a "module for generating a first key set".

[0100] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0101] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0102] According to one or more embodiments of the present disclosure, Example 1 provides an encryption method for CDN, including: generating a first key set, wherein the first key set includes multiple first keys; calculating the hash value of each of the first keys; generating a second key corresponding to each of the first keys based on the first key; determining a mapping relationship between the second key and the hash value; encrypting plaintext data using the second key to obtain encrypted ciphertext; and transmitting the encrypted ciphertext together with the hash value corresponding to the second key used for encryption.

[0103] According to one or more embodiments of the present disclosure, Example 2 provides the encryption method for CDN of Example 1, wherein generating the first key set includes: The first key set is obtained by taking out several bits from a key seed and arranging them, wherein the key seed is a key seed pre-negotiated by an encryption end and a decryption end, and the bits taken out from the key seed and the arrangement method are pre-negotiated by the encryption end and the decryption end.

[0104] According to one or more embodiments of the present disclosure, Example 3 provides the encryption method for CDN of Example 1, wherein generating, according to the first key, a second key corresponding to each first key includes: The second key corresponding to each first key is generated by expanding each first key, wherein the manner of expanding each first key is pre-negotiated by the encryption end and the decryption end.

[0105] According to one or more embodiments of the present disclosure, Example 4 provides the encryption method for CDN of Example 1, wherein the encrypting the plaintext data using the second key to obtain the encrypted ciphertext includes: randomly selecting a second key from the generated second keys; The plaintext data is encrypted using a randomly selected second key to obtain the encrypted ciphertext.

[0106] According to one or more embodiments of the present disclosure, Example 5 provides the encryption method for CDN of Example 1, wherein the encryption method further includes: A mapping relationship between the second key and the hash value is maintained in the memory.

[0107] According to one or more embodiments of the present disclosure, Example 6 provides the encryption method for CDN of Example 2, wherein the encryption method further includes: After the encryption end and the decryption end both agree to update the key, a new key seed negotiated between the encryption end and the decryption end is used to update the first key, the hash value, the second key and the mapping relationship.

[0108] According to one or more embodiments of the present disclosure, Example 7 provides a decryption method for CDN, comprising: using the encryption method according to the first aspect to obtain the first key set, the hash value of each first key, the second key, and the mapping relationship between the second key and the hash value; receiving an encrypted ciphertext and a hash value transmitted together with the encrypted ciphertext; determining a second key for decrypting the encrypted ciphertext based on the mapping relationship and the received hash value; and decrypting the encrypted ciphertext using the determined second key.

[0109] According to one or more embodiments of the present disclosure, Example 8 provides an encryption device for a CDN, including: A first generating module, configured to generate a first key set, wherein the first key set includes a plurality of first keys, calculate a hash value of each of the first keys, generate a second key corresponding to each of the first keys according to the first keys, and determine a mapping relationship between the second keys and the hash values; An encryption module, used to encrypt the plaintext data using the second key to obtain encrypted ciphertext; The sending module is used to transmit the encrypted ciphertext together with the hash value corresponding to the second key used for encryption.

[0110] According to one or more embodiments of the present disclosure, Example 9 provides a decryption device for a CDN, including: A second generating module, configured to obtain the first key set, the hash value of each first key, the second key, and a mapping relationship between the second key and the hash value by using the encryption method for CDN according to any one of Examples 1 to 6; A receiving module, used for receiving an encrypted ciphertext and a hash value transmitted along with the encrypted ciphertext; The decryption module is used to determine a second key for decrypting the encrypted ciphertext according to the mapping relationship and the received hash value, and decrypt the encrypted ciphertext using the determined second key.

[0111] According to one or more embodiments of the present disclosure, Example 10 provides a computer-readable medium having a computer program stored thereon, which implements the steps of any of the methods described in Examples 1-7 when executed by a processing device.

[0112] According to one or more embodiments of the present disclosure, Example 11 provides an electronic device, including: a storage device having a computer program stored thereon; A processing device is used to execute the computer program in the storage device to implement the steps of any one of the methods described in Examples 1-7.

[0113] According to one or more embodiments of the present disclosure, Example 12 provides a computer program product, including a computer program, which implements the steps of any one of the methods described in Examples 1 to 7 when executed by a processor.

[0114] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other to form a technical solution.

[0115] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0116] Although the subject matter has been described in language specific to structural features and / or method logic actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims. Regarding the device in the above embodiment, the specific manner in which each module performs the operation has been described in detail in the embodiment related to the method, and will not be elaborated here.

Claims

1. An encryption method for CDN, characterized in that: include: Generate a first key set, wherein the first key set includes a plurality of first keys; Calculate a hash value of each of the first keys; Generate, according to the first key, a second key corresponding to each of the first keys; Determine a mapping relationship between the second key and the hash value; Encrypt the plaintext data using the second key to obtain encrypted ciphertext; The encrypted ciphertext and the hash value corresponding to the second key used for encryption are transmitted together.

2. The encryption method for CDN according to claim 1, characterized in that: The generating of the first key set comprises: The first key set is obtained by taking out several bits from a key seed and arranging them, wherein the key seed is a key seed pre-negotiated by an encryption end and a decryption end, and the bits taken out from the key seed and the arrangement method are pre-negotiated by the encryption end and the decryption end.

3. The encryption method for CDN according to claim 1, characterized in that: The step of generating, according to the first key, a second key corresponding to each of the first keys comprises: The second key corresponding to each first key is generated by expanding each first key, wherein the manner of expanding each first key is pre-negotiated by the encryption end and the decryption end.

4. The encryption method for CDN according to claim 1, characterized in that: The step of encrypting the plaintext data using the second key to obtain encrypted ciphertext includes: randomly selecting a second key from the generated second keys; The plaintext data is encrypted using a randomly selected second key to obtain the encrypted ciphertext.

5. The encryption method for CDN according to claim 1, characterized in that: The encryption method further comprises: A mapping relationship between the second key and the hash value is maintained in the memory.

6. The encryption method for CDN according to claim 2, characterized in that: The encryption method further comprises: After the encryption end and the decryption end both agree to update the key, a new key seed negotiated between the encryption end and the decryption end is used to update the first key, the hash value, the second key and the mapping relationship.

7. A decryption method for CDN, characterized in that: include: Using the encryption method for CDN according to any one of claims 1 to 6, obtain the first key set, the hash value of each first key, the second key, and the mapping relationship between the second key and the hash value; Receiving an encrypted ciphertext and a hash value transmitted along with the encrypted ciphertext; Determine a second key for decrypting the encrypted ciphertext according to the mapping relationship and the received hash value; The encrypted ciphertext is decrypted using the determined second key.

8. An encryption device for CDN, characterized in that: include: A first generating module, configured to generate a first key set, wherein the first key set includes a plurality of first keys, calculate a hash value of each of the first keys, generate a second key corresponding to each of the first keys according to the first keys, and determine a mapping relationship between the second keys and the hash values; An encryption module, used to encrypt the plaintext data using the second key to obtain encrypted ciphertext; The sending module is used to transmit the encrypted ciphertext together with the hash value corresponding to the second key used for encryption.

9. A decryption device for CDN, characterized in that: include: A second generating module, configured to obtain the first key set, the hash value of each first key, the second key, and a mapping relationship between the second key and the hash value by using the encryption method for CDN according to any one of claims 1 to 6; A receiving module, used for receiving an encrypted ciphertext and a hash value transmitted along with the encrypted ciphertext; The decryption module is used to determine a second key for decrypting the encrypted ciphertext according to the mapping relationship and the received hash value, and use the determined second key to decrypt the encrypted ciphertext.

10. A computer readable medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processing device, the steps of the method according to any one of claims 1 to 7 are implemented.

11. An electronic device, characterized in that: include: a storage device having a computer program stored thereon; A processing device, configured to execute the computer program in the storage device to implement the steps of the method according to any one of claims 1 to 7.

12. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images