Encryption and decryption method, readable storage medium, program product and electronic equipment

Abstract

The invention relates to the technical field of computers, in particular to an encryption and decryption method, a readable storage medium, a program product and electronic equipment. The encryption and decryption method is applied to the electronic equipment and comprises the following steps: detecting an update message for updating at least part of configuration items in a plurality of configuration items corresponding to a first configuration file from a first encrypted version to a second encrypted version, and enabling the electronic equipment to enter a first state; when the electronic equipment is in a first state, an instruction for calling a first configuration item in at least part of configuration items is detected, and the first configuration item is used for running a first application program; obtaining a first key corresponding to the first encrypted version and a second key corresponding to the second encrypted version; and decrypting the first configuration item based on the first key and the second key to obtain first configuration data corresponding to the first configuration item, and running the first application program based on the first configuration data. By means of the method, when the encrypted versions of at least part of the configuration items are updated, normal operation of the application program can be guaranteed.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an encryption and decryption method, a readable storage medium, a program product, and an electronic device. Background Art

[0002] In some electronic equipment systems and applications, some variable parameters or data are required to support the dynamic operation of the system or application. Such parameters or data are generally stored in configuration files as configuration items, which can dynamically control the operation of the system or application.

[0003] In some cases, the configuration items in electronic devices are all in plain text, but some of them are sensitive (such as uniform resource locators of database connections, accounts, passwords, and various keys, which are configuration items with strong security risks). Therefore, these sensitive configuration items need to be encrypted. When the application loads the corresponding configuration items, the configuration items can be decrypted by the corresponding keys.

[0004] In some cases, in order to further ensure the security of encryption, electronic devices need to update the key version according to the reasonable life cycle of the key and other requirements. After the key version is updated, the content of the new and old keys is different, and the new version of the key cannot decrypt the configuration items encrypted by the old version of the key. Therefore, during the key update process, the electronic device generally suspends data use, which affects the user experience. Summary of the invention

[0005] The embodiments of the present application provide an encryption and decryption method, a readable storage medium, a program product, and an electronic device. The encryption and decryption method can enable the application to run normally when the encryption version is updated, thereby improving the user experience.

[0006] In a first aspect, an embodiment of the present application provides an encryption and decryption method, which is applied to an electronic device, wherein a first configuration file is configured in the electronic device, the first configuration file includes multiple configuration items, and the configuration items are used to run corresponding applications. The method includes: detecting an update message that updates at least some of the multiple configuration items corresponding to the first configuration file from a first encrypted version to a second encrypted version, and the electronic device enters a first state; when the electronic device is in the first state, and an instruction to call a first configuration item among at least some of the configuration items is detected, wherein the first configuration item is used to run a first application; obtaining a first key corresponding to the first encrypted version and a second key corresponding to the second encrypted version; decrypting the first configuration item based on the first key and the second key to obtain first configuration data corresponding to the first configuration item, and running the first application based on the first configuration data.

[0007] In some embodiments of the present application, the electronic device can still call data and run the application normally when it is in the second state. It can be understood that after the first application that needs to call the first configuration item is started, the electronic device can obtain two keys before and after the encryption version is updated, namely the first key and the second key, and decrypt the first configuration item through the two keys. Regardless of whether the encryption version of the first configuration item is updated, the decryption can be successful, so as to run the first application based on the first configuration data obtained after decryption.

[0008] In a possible implementation of the first aspect above, at least some of the above configuration items include: a first category of configuration items and a second category of configuration items, wherein the first category of configuration items include a first encryption identifier, and the second category of configuration items include a second encryption identifier, the first encryption identifier is used to identify sensitive data, and the second encryption identifier is used to identify custom data.

[0009] It can be understood that in some embodiments of the present application, before encrypting at least part of the configuration items in the first configuration file, at least part of the configuration items can be identified, for example, a first encryption identifier is added to sensitive data, and a second encryption identifier is added to user-defined configuration items that need to be encrypted, so as to determine which configuration items belong to at least part of the configuration items during the encryption process.

[0010] In a possible implementation of the first aspect above, the above-mentioned detecting an instruction to call a first configuration item in at least some configuration items includes: detecting that the first configuration item has a first encryption identifier or a second encryption identifier, and determining that the first configuration item is a configuration item in at least some configuration items.

[0011] In some embodiments of the present application, the electronic device can determine whether the corresponding configuration item needs to be decrypted, that is, whether the corresponding configuration item belongs to at least part of the configuration items, by whether the configuration item in the first configuration file has the first encryption identifier or the second encryption identifier.

[0012] In a possible implementation of the first aspect, the above-mentioned detection of an update message that updates at least part of the multiple configuration items corresponding to the first configuration file from a first encrypted version to a second encrypted version includes: in response to the update message, decrypting at least part of the configuration file corresponding to the first encrypted version based on the first key; encrypting at least part of the decrypted configuration file based on the second encrypted version, and updating the version identifier of at least part of the configuration file from the version identifier corresponding to the first encrypted version to the version identifier corresponding to the second encrypted version.

[0013] Exemplarily, in some embodiments of the present application, during the process of updating the encrypted version, if the second configuration item in the first configuration file includes the first identifier or the second identifier, it can be determined that the second configuration item belongs to at least a partial configuration item and the second configuration item needs to be encrypted.

[0014] If the second configuration item includes a version identifier, it can be determined that the second configuration item has been encrypted, and the second configuration item can be decrypted according to the key corresponding to the encryption version corresponding to the version identifier, and then the second configuration item can be encrypted based on the encryption method corresponding to the second encryption version, and the version identifier of the second configuration item can be updated to the version identifier corresponding to the second encryption version.

[0015] If the second configuration item has no version identifier, it means that the second configuration item is a newly added configuration item that needs to be encrypted, and the second configuration item can be directly encrypted.

[0016] In a possible implementation of the first aspect above, the decrypting the first configuration item based on the first key and the second key includes: determining a version identifier of the first configuration item, and selecting a pair of the first key and the second key to decrypt the first configuration item based on the version identifier of the first configuration item; corresponding to determining that the version identifier of the first configuration item is a first encrypted version, decrypting the first configuration item based on the first key; corresponding to determining that the version identifier of the first configuration item is a second encrypted version, decrypting the first configuration item based on the second key.

[0017] Illustratively, in some embodiments of the present application, after the electronic device obtains the first configuration item, it can also determine the version identifier of the first configuration item, and then select the corresponding key for decryption according to the encrypted version indicated by the version identifier.

[0018] In a possible implementation of the first aspect, the decrypting the first configuration item based on the first key and the second key to obtain the first configuration data corresponding to the first configuration item includes: decrypting the first configuration item based on the first key or the second key; if the decryption is successful, obtaining the first configuration data; if the decryption fails, re-decrypting the first configuration item based on the second key or the first key to obtain the first configuration data.

[0019] Exemplarily, in some embodiments of the present application, in the process of decrypting the first configuration item, one key can be selected from the first key or the second key to decrypt the first configuration item. If the decryption is successful, the first configuration data can be obtained. If the decryption fails, the first configuration item can be decrypted by the remaining key, thereby ensuring that the first configuration item can be decrypted successfully.

[0020] In a possible implementation of the first aspect above, the method also includes: detecting a completion message that at least some configuration items are updated from the first encrypted version to the second encrypted version, and the electronic device enters the second state from the first state; when the electronic device is in the second state, and detecting an instruction to call a second configuration item in at least some configuration items, wherein the second configuration item is used to run a second application; obtaining a second key corresponding to the second encrypted version; decrypting the second configuration item based on the second key to obtain second configuration data, and running the second application based on the second configuration data.

[0021] In some embodiments of the present application, after the electronic device updates the encrypted version, it can be converted from the second state to the first state. In the first state, only one key needs to be obtained for decryption.

[0022] In a second aspect, an embodiment of the present application provides an encryption and decryption system, the system comprising: a configuration management module, used to store and manage a first configuration file, the first configuration file comprising multiple configuration items, the configuration items being used to run corresponding applications; an encryption and decryption service module, used to update at least some of the multiple configuration items corresponding to the first configuration file from a first encryption version to a second encryption version, and to store a first key corresponding to the first encryption version and a second key corresponding to the second encryption version, and the encryption and decryption service module is also used to send the first key and the second key to the encryption and decryption module when receiving a key acquisition instruction sent by the encryption and decryption module during the update process; the encryption and decryption module is used to send a key acquisition instruction to the encryption and decryption service module when detecting that any configuration item in at least some of the configuration items is called, and to decrypt any configuration item in at least some of the configuration items based on the first key and the second key returned by the encryption and decryption service module to obtain corresponding configuration data.

[0023] For example, in some embodiments of the present application, the encryption and decryption service center can provide various encryption services. During the decryption process, the encryption and decryption service center can provide a key for the encryption and decryption module. The first state or the second state of the electronic device can be, for example, the first state or the second state of the encryption and decryption service center. In the second state, the encryption and decryption service center can provide the first key and the second key for the encryption and decryption module. This allows the first application in the electronic device to normally obtain the first configuration data even when the encrypted version is updated, so that it can run normally.

[0024] The beneficial effects that can be achieved in the second aspect can refer to the beneficial effects of the method provided in any implementation manner of the first aspect, and will not be repeated here.

[0025] In a third aspect, the present application provides an electronic device, comprising: a memory for storing instructions; and at least one processor for executing instructions so that the device implements the first aspect and any possible implementation method of the first aspect. The beneficial effects that can be achieved in the third aspect can refer to the beneficial effects of the method provided in any implementation of the first aspect, and will not be repeated here.

[0026] In a fourth aspect, the present application provides a computer-readable storage medium, in which instructions are stored, and when the instructions are executed by a device, the computer implements the method provided in the first aspect and any possible implementation of the first aspect. The beneficial effects that can be achieved in the fourth aspect can refer to the beneficial effects of the method provided in any implementation of the first aspect, and will not be repeated here.

[0027] In a fifth aspect, the present application provides a computer program product, which, when running on a device, enables the device to implement the method provided in the first aspect and any possible implementation of the first aspect. The beneficial effects that can be achieved in the fifth aspect can refer to the beneficial effects of the method provided in any implementation of the first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 A schematic diagram of an application loading a configuration file is shown;

[0029] Figure 2 According to an embodiment of the present application, a flowchart of an implementation of an encryption and decryption method is shown;

[0030] Figure 3 According to some embodiments of the present application, a schematic diagram of an encryption and decryption system is shown;

[0031] Figure 4 According to some embodiments of the present application, a schematic diagram of updating an encrypted version is shown;

[0032] Figure 5 According to some embodiments of the present application, an interactive flow chart of state transition of an electronic device is shown;

[0033] Figure 6 According to some embodiments of the present application, a flowchart for implementing providing a first configuration item for a first application is shown;

[0034] Figure 7 According to some embodiments of the present application, an encryption process of an encryption and decryption service center is shown;

[0035] Figure 8 According to some embodiments of the present application, a schematic structural diagram of an electronic device 100 is shown. DETAILED DESCRIPTION

[0036] The illustrative embodiments of the present application include but are not limited to encryption and decryption methods, readable storage media, program products, and electronic devices.

[0037] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0038] As described in the background art, during the process of updating the key, the electronic device generally suspends data usage, thereby affecting the user's experience.

[0039] The following describes the process of running an application on an electronic device.

[0040] For example, Figure 1 A schematic diagram showing an application loading a configuration file is shown.

[0041] like Figure 1 As shown, the electronic device 10 is equipped with an application A. When the electronic device 10 runs the application A, it needs to load the corresponding configuration item from the configuration file of the electronic device 10, and then parse the configuration item, and run the application A according to the parsed configuration item data. For example, after the electronic device decrypts the loaded configuration item and determines that the corresponding configuration item data specifies a server address, the application A can be run to use the address to make a network request.

[0042] Exemplarily, in the configuration file of the electronic device 10, some configuration items are encrypted, and the electronic device 10 needs to obtain corresponding keys to decrypt the configuration items, and then run the application A according to the configuration items.

[0043] However, if the encrypted version of the configuration item is being updated, when the electronic device 10 runs the application A, the key obtained may be a new version of the key, but the configuration item has not been encrypted with the new version, which will cause the electronic device to be unable to decrypt the configuration item, that is, the new version of the key cannot decrypt the configuration item encrypted with the old version, thereby making the application unable to run normally. Therefore, in the process of updating the key version, the data use of the electronic device is generally suspended.

[0044] In summary, during the key update process, electronic devices generally suspend data usage, thereby affecting the user experience.

[0045] In order to solve the problem that key version update suspends data usage of an electronic device, the present application proposes an encryption and decryption method, where the electronic device detects a message that at least some configuration items in a first configuration file begin to be updated from a first encryption version to a second encryption version, and enters a second state; in the second state, an instruction of a first application to call the first configuration item is detected; the first configuration item is obtained from at least some configuration items in the first configuration file, and a first key corresponding to the first encryption version and a second key corresponding to the second encryption version are obtained; the first configuration item is decrypted based on the first key and the second key to obtain first configuration data, and the first application is run based on the first configuration data.

[0046] Through the above solution, when the electronic device updates the first configuration file from the first encrypted version to the second encrypted version, it can also run the first application, and can obtain the first key corresponding to the first encrypted version and the second key encrypted by the second version. Therefore, during the decryption process, the electronic device can try to decrypt the first encrypted item based on the two keys to obtain the first configuration item. In this way, when the electronic device updates the encrypted version of the first configuration file, the electronic device can also run the application normally.

[0047] In some embodiments of the present application, an electronic device can provide encryption and decryption services for various configuration items in a configuration file through an encryption and decryption service center. Exemplarily, various encryption and decryption schemes can be configured in the encryption and decryption service center, and multiple configuration files can be encrypted. For example, the encryption scheme that can be provided in the encryption and decryption service center can select advanced encryption standard (AES), national encryption SM and other secure encryption algorithms. The encryption and decryption service center can support various configuration files, including but not limited to yml, ymal, txt, json, xml, properties, etc.

[0048] The following describes the encryption and decryption methods in some embodiments of the present application.

[0049] For example, Figure 2 According to an embodiment of the present application, a flowchart of an implementation of an encryption and decryption method is shown.

[0050] It should be noted that the electronic device in the embodiment of the present application may also be referred to as a terminal, a user terminal, a mobile terminal, a user equipment (UE), a terminal device, a mobile station, a mobile terminal (MT), etc. The terminal device may be a mobile phone, a smart TV, a wearable device, a tablet computer (Pad), a computer with a wireless transceiver function, a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a wireless terminal in industrial control, a wireless terminal in self-driving, a wireless terminal in a smart grid, a wireless terminal in transportation safety, a wireless terminal in a smart city, a wireless terminal in a smart home, etc. The execution subjects of the following processes are all electronic devices. When introducing the following processes, the execution subjects of each process will not be repeated.

[0051] like Figure 2 As shown, the process includes:

[0052] S201: Upon detecting an update message that updates at least some of the multiple configuration items corresponding to the first configuration file from a first encrypted version to a second encrypted version, the electronic device enters a first state.

[0053] It can be understood that the electronic device is configured with a first configuration file, the first configuration file includes a plurality of configuration items, and the configuration items are used to run corresponding application programs.

[0054] For example, in some embodiments of the present application, the electronic device can encrypt sensitive data in the stored configuration file and some configuration items of the custom data (such as the uniform resource locator of the database connection, account number, password, and various keys, etc., which have strong security risks) to avoid data leakage. It can be understood that the custom data can be user-defined configuration data that needs to be encrypted. In order to ensure the security of encryption, the encrypted version of some configuration items needs to be updated regularly.

[0055] For example, in some embodiments, the electronic device may notify the user or relevant manager that the first encryption version needs to be updated at a preset time (e.g., 30 days, 15 days, 7 days, 3 days, 1 day, or any other custom time) before the first encryption version expires, so as to update the first encryption version to the second encryption version. The electronic device may generate a second key corresponding to the second encryption version in advance, and enter the first state when the electronic device detects that the relevant manager begins to update at least some of the configuration items in the configuration file. The first state is used to indicate that the electronic device is currently in the process of updating the encryption version.

[0056] In some embodiments, the message that the electronic device detects that at least some of the configuration items in the first configuration file are starting to be updated from the first encrypted version to the second encrypted version can be manually identified by a relevant manager, for example. For example, after receiving the message that the first encrypted version is about to expire, the relevant manager operates the electronic device (for example, adds an identification of entering the first state to the electronic device), and the electronic device enters the first state in response to the manager's operation.

[0057] In other embodiments, the electronic device may automatically enter the first state after detecting that the first encrypted version has reached a preset period of time. For example, if the first encrypted version has a period of three months, and the electronic device detects that the first encrypted version has not been updated after three months of use, the electronic device may automatically start to update the first encrypted version to the second encrypted version and enter the first state. Exemplarily, the encryption version update process is described in detail below.

[0058] S202: When the electronic device is in a first state and detects an instruction to call a first configuration item in at least some configuration items, wherein the first configuration item is used to run a first application.

[0059] Exemplarily, in some embodiments of the present application, the first state is a state in which the electronic device is updating the first encrypted version to the second encrypted version. In the first state, the electronic device can run a corresponding application, and if the application needs to call a configuration item in at least some of the configuration items, the electronic device can detect a corresponding instruction, for example, detecting an instruction for the application to call the first configuration item.

[0060] S203: Obtain a first key corresponding to the first encryption version and a second key corresponding to the second encryption version.

[0061] For example, in some embodiments of the present application, after the electronic device detects that the first application calls the instruction of the first configuration item, it can obtain the key of the encrypted version corresponding to the first configuration item. Since the electronic device is in the first state of updating the key version, the electronic device can obtain the first key corresponding to the current first encrypted version and the second key corresponding to the updated second version.

[0062] Exemplarily, in some embodiments of the present application, the electronic device includes an encryption and decryption service center, and the electronic device can provide encryption and decryption services for at least part of the configuration items in the configuration file through the encryption and decryption service center. Exemplarily, various encryption and decryption schemes can be configured in the encryption and decryption service center. For example, the encryption scheme that can be provided in the encryption and decryption service center can select advanced encryption standard (AES), national encryption SM and other secure encryption algorithms. The encryption and decryption service center can support various configuration files, including but not limited to yml, ymal, txt, json, xml, properties, etc. The electronic device can parse at least part of the configuration items through the encryption algorithm of the encryption and decryption service center, thereby determining the file format of the corresponding configuration items, and then encrypt at least part of the configuration items through the corresponding encryption algorithm.

[0063] During the decryption process, the first application can obtain the corresponding key from the encryption and decryption service center. When the electronic device is in the first state, the first application can obtain the first key corresponding to the current first encryption version and the second key corresponding to the updated second encryption version from the encryption and decryption service center. It can be understood that during the encryption version update process, the electronic device decryption process is easily affected. For example, the encryption version corresponding to the first configuration item has not been updated. If the electronic device only obtains the second key corresponding to the second encryption version, the electronic device cannot decrypt the first configuration item through the second key. For another example, if the first configuration item has been encrypted by the updated second encryption version, if the electronic device only obtains the first key corresponding to the first encryption version, it cannot decrypt the first configuration item. Therefore, when the electronic device obtains the key in the first state, it can obtain two versions of the key.

[0064] In some other embodiments, at least some of the configuration items also include a version identifier, which is used to indicate the encrypted version of the current configuration item. Therefore, it is also possible to first obtain the first configuration item and determine the corresponding version identifier based on the encrypted version of the first configuration item. In this way, only one key corresponding to the encrypted version needs to be obtained.

[0065] S204, decrypt the first configuration item based on the first key and the second key, obtain first configuration data corresponding to the first configuration item, and run the first application based on the first configuration data.

[0066] Illustratively, in some embodiments of the present application, the electronic device may decrypt the first configuration item after acquiring the first key and the second key.

[0067] For example, the electronic device decrypts the first configuration item based on the first key and the second key to obtain the first configuration data corresponding to the first configuration item, which may be:

[0068] decrypting the first configuration item based on the first key or the second key;

[0069] If the decryption is successful, the first configuration data is obtained;

[0070] If the decryption fails, the first configuration item is re-decrypted based on the second key or the first key to obtain the first configuration data.

[0071] That is, the electronic device may first select any key from the first key and the second key to decrypt the first configuration item. If the decryption is successful, the electronic device may run the first application based on the first configuration data obtained by decryption.

[0072] For example, if the first configuration item has not been updated with the second encrypted version and is still decrypted with the first key, and the electronic device selects the first key to decrypt the first configuration item, the electronic device can successfully obtain the first configuration data and run the first application. Alternatively, if the first configuration item is a configuration item that has been updated with the second encrypted version and the first electronic device just selects the second key to decrypt the first configuration item, the electronic device can still successfully decrypt and obtain the first configuration data and run the first application.

[0073] If the decryption fails, the electronic device may also use another key to decrypt the first configuration item.

[0074] For example, if the first configuration item has not been updated with the second encrypted version and is still decrypted with the first key, but the electronic device selects the second key to decrypt the first configuration item, the electronic device cannot successfully decrypt the first time, and the electronic device can decrypt the first configuration item with another key, that is, the first key, to successfully obtain the first configuration data to run the first application. Alternatively, the first configuration item is a configuration item that has been updated with the second encrypted version, and the first electronic device selects the first key to decrypt the first configuration item for the first time, so the electronic device cannot successfully decrypt it. The electronic device can decrypt the first configuration item with another key, that is, the second key, to successfully decrypt and obtain the first configuration data to run the first application.

[0075] In this way, no matter whether the first configuration item is updated to the second encrypted version, the electronic device can always complete the decryption of the first configuration item, so as to run the first application normally.

[0076] Through the above solution, when the electronic device is updating the encrypted version, the electronic device does not need to suspend the use of data and can run the application normally, thereby improving the user experience.

[0077] Next, an encryption and decryption system is introduced.

[0078] For example, Figure 3 According to some embodiments of the present application, a schematic diagram of an encryption and decryption system is shown.

[0079] like Figure 3 As shown, the encryption and decryption system includes: the system includes: a configuration management center (corresponding to a configuration management module), which is used to store and manage a first configuration file, the first configuration file includes a plurality of configuration items, and the configuration items are used to run a corresponding application program;

[0080] The encryption and decryption service center (corresponding to the encryption and decryption service module) is used to update at least some of the multiple configuration items corresponding to the first configuration file from the first encryption version to the second encryption version, and store the first key corresponding to the first encryption version and the second key corresponding to the second encryption version. The encryption and decryption service module is also used to send the first key and the second key to the encryption and decryption module when receiving a key acquisition instruction sent by the encryption and decryption module during the update process;

[0081] The encryption and decryption module is used to send a key acquisition instruction to the encryption and decryption service module when detecting that any configuration item in at least some of the configuration items is called, and decrypt any configuration item in at least some of the configuration items based on the first key and the second key returned by the encryption and decryption service module to obtain corresponding configuration data.

[0082] For example, in some embodiments of the present application, the configuration management center of the electronic device is used to manage the first configuration file in the electronic device, and the first configuration file includes various configuration items. For at least some configuration items involving sensitive data (for example, uniform resource locators, accounts, passwords, and various keys for database connection, which have strong security risks), the configuration management center can call the encryption and decryption service center to encrypt at least some of the configuration items. In addition, the configuration management center can also call the encryption and decryption service center to update the encrypted version of at least some of the configuration items.

[0083] For example, after the configuration management center in the electronic device detects that the administrator has updated at least some configuration items, it can respond to the administrator's operation and call the encryption and decryption service center to encrypt at least some configuration items based on the first encryption version. The first key corresponding to the first encryption version is stored in the encryption and decryption service center.

[0084] The application programs in the electronic device may be configured in the service cluster, and the application programs in the service cluster may be connected to the encryption and decryption module, so that the corresponding configuration items may be called and the configuration items may be decrypted through the encryption and decryption module.

[0085] Exemplarily, the encryption and decryption center service provides services for the configuration management center and the encryption and decryption module. The encryption scheme can select AES, national encryption SM and other secure encryption algorithms, taking into account both performance and security. The service provides key version acquisition, encryption version update, encryption and decryption and other functions. In some embodiments, the execution of the corresponding function requires token authentication to be used, thereby ensuring security.

[0086] The configuration management center is used to manage the configuration items of all applications. It can enable encryption for the configuration items of applications, provide one-click encryption, one-click decryption, batch encryption, full encryption, key version upgrade and other functions, store the configuration items (encrypted configuration ciphertext storage), and implement it by calling the capabilities provided by the encryption and decryption center service through signature verification.

[0087] The encryption and decryption module is integrated into the application. When the application starts, the application can pull the verification signature (token) and the encryption and decryption center service domain name from the cluster startup parameters, and then pull the key version from the encryption and decryption center service through the verification signature. When the encryption and decryption module loads the configuration items, it uses the corresponding version of the key to decrypt the configuration items. After the decryption is successful, the application starts and runs normally.

[0088] For example, when the first application is started, the encryption and decryption module can obtain the verification signature corresponding to the first application and the domain name of the encryption and decryption service center from the cluster startup parameters. The domain name can, for example, indicate the host that provides encryption services for the corresponding configuration items, so that the encryption and decryption module can obtain the corresponding key from the encryption and decryption service center.

[0089] The server cluster configures the domain name and signature verification of the encryption and decryption center service to avoid the risk of signature leakage caused by the application storing the configuration separately. In some embodiments, the service cluster also uses encrypted storage for signature verification to further ensure security. When the application starts, the encryption and decryption module uniformly obtains relevant data (for example, the domain name of the signature verification and encryption and decryption service center, etc.) to facilitate pulling configuration and starting the service normally.

[0090] The encryption and decryption service supports various forms of text encryption, including encryption of unformatted strings, encryption of the value of a key specified by a key-value pair structure, encryption of single-line data, encryption of multiple-line data, and encryption of files (json, xml, txt, yml, yaml, properties, etc.).

[0091] In some embodiments of the present application, at least some of the configuration items include:

[0092] The second category configuration item includes a first encryption identifier, and the second category configuration item includes a second encryption identifier, the first encryption identifier is used to identify sensitive data, and the second encryption identifier is used to identify custom data.

[0093] In some embodiments of the present application, the first category configuration items corresponding to sensitive data need to be forcibly encrypted. Therefore, before encryption, a first encryption identifier can be added to the first category configuration items in the first configuration file. The first encryption identifier and the first category configuration items can be represented by a key-value pair. For example, key can represent the first encryption identifier, and value represents a first category configuration item. It can be understood that there are some second category configuration items in the first configuration file that do not belong to sensitive data, but the user hopes to encrypt this type of data. Therefore, a second encryption identifier can also be added to the second category configuration item. The second encryption identifier can be the same as the first encryption identifier, and the second encryption identifier and the second category configuration item can also be represented by a key-value pair structure.

[0094] It can be understood that the above-mentioned first-category configuration items and second-category configuration items together constitute at least part of the configuration items in the first configuration file.

[0095] In some embodiments of the present application, in order to ensure the security of encryption of at least some configuration items, the electronic device needs to update the key version according to the reasonable life cycle of the key and other requirements. When the key version is about to expire, the key version will be automatically upgraded according to the configuration, or the upgrade will be manually confirmed. During the key version upgrade process, the operation of the application in the electronic device will not be affected.

[0096] In some embodiments of the present application, an update message is detected that updates at least part of the multiple configuration items corresponding to the first configuration file from the first encrypted version to the second encrypted version. For example, it can also be: in response to the update message, at least part of the configuration file corresponding to the first encrypted version is decrypted based on the first key; at least part of the decrypted configuration file is encrypting based on the second encrypted version, and the version identifier of at least part of the configuration file is updated from the version identifier corresponding to the first encrypted version to the version identifier corresponding to the second encrypted version.

[0097] Exemplarily, since the encrypted version of at least some configuration items needs to be updated periodically, it is necessary to add a version identifier to at least some configuration files to determine the encrypted version of the corresponding configuration files, so as to facilitate the updating of the encrypted version of the configuration files. For example, in the process of updating some configuration items in the first configuration item from the first encrypted version to the second encrypted version, if it is detected that the second configuration item includes the first encryption identifier or the second encryption identifier, it can be determined that the second configuration item needs to be encrypted. If the second configuration item does not have a version identifier, it means that the second configuration item is a newly added configuration item that needs to be encrypted, and the second configuration item can be directly encrypted with the second encrypted version, and the version identifier corresponding to the second encrypted version can be added to the second configuration item. If the second configuration item has a version identifier corresponding to the first encrypted version, it is necessary to first decrypt the second configuration item using the first key, and then encrypt the second configuration item using the encryption scheme of the second encrypted version. Thereby completing the updating process of the encrypted version of at least some configuration items.

[0098] In some embodiments of the present application, decrypting the first configuration item based on the first key and the second key may also be: determining a version identifier of the first configuration item, and selecting a pair of the first key and the second key to decrypt the first configuration item based on the version identifier of the first configuration item; corresponding to determining that the version identifier of the first configuration item is the first encrypted version, decrypting the first configuration item based on the first key; corresponding to determining that the version identifier of the first configuration item is the second encrypted version, decrypting the first configuration item based on the second key.

[0099] It can be understood that in some embodiments of the present application, the first configuration item can be obtained first, and then the encrypted version of the first configuration item can be determined according to the version identifier corresponding to the first configuration item, and then when the key is obtained, the key can be determined according to the encrypted version of the first configuration item.

[0100] For example, the version identifier of the first configuration item indicates that the first configuration item is encrypted by using an encryption scheme of a first encryption version, and then when obtaining the key, the first key can be obtained.

[0101] The version identifier of the first configuration item indicates that the first configuration item is encrypted by using the encryption scheme of the second encryption version, and then when obtaining the key, the second key can be obtained.

[0102] In some embodiments of the present application, the electronic device enters the second state from the first state in response to detecting a message that at least part of the configuration items are updated from the first encrypted version to the second encrypted version;

[0103] When the electronic device is in the second state, and it is detected that the second application program calls an instruction of a second configuration item in at least some of the configuration items, wherein the second configuration item is used to run the second application program;

[0104] Obtaining a second configuration item from at least part of the configuration items, and obtaining a second key corresponding to the second encrypted version;

[0105] The second configuration item is decrypted based on the second key to obtain second configuration data, and the second application is run based on the second configuration data.

[0106] It can be understood that after the electronic device detects that the encrypted version of at least part of the configuration items has been updated to the second encrypted version, it can enter the second state from the first state. The second state is a normal state. In the second state, if the electronic device detects that the second application that calls the second configuration item is started, the encryption and decryption module can obtain the second key from the encryption and decryption service center, and then decrypt the second configuration item based on the second key to obtain the second configuration data. The encryption and decryption module sends the second configuration data to the second application to support the operation of the second application.

[0107] That is to say, when the encryption version of at least some configuration items of the electronic device is not being updated, the encryption and decryption module only needs to obtain the key corresponding to the current encryption version from the encryption and decryption service center.

[0108] In some embodiments of the present application, detecting an instruction to call a first configuration item in at least some configuration items may also be: detecting that the first configuration item has a first encryption identifier or a second encryption identifier, and determining that the first configuration item is a configuration item in at least some configuration items.

[0109] It can be understood that the electronic device can determine whether the configuration item in the first configuration file belongs to at least part of the configuration items according to whether the configuration item has the first encryption identifier or the second encryption identifier.

[0110] The following describes a process in which an electronic device updates at least part of a configuration item from a first encrypted version to a second encrypted version.

[0111] For example, Figure 4 According to some embodiments of the present application, a schematic diagram of updating an encrypted version is shown.

[0112] like Figure 4As shown, since the encrypted version of the electronic device needs to be updated regularly, the electronic device can also be configured with a module corresponding to the scheduled task. The scheduled task can time the current encrypted version and remind the encryption and decryption service center to update the corresponding key of the encrypted version. For example, the encryption and decryption service center is notified 30 days, 15 days, 10 days, 7 days, 3 days, and 1 day before the current encrypted version expires. Then the encryption and decryption service center can generate a new key in advance. For example, the encryption and decryption service center can generate a second key 7 days before the current first encrypted version expires and notify the manager (for example, by email, SMS or other communication methods). After receiving the notification, the manager can call the service of the encryption and decryption service center in the configuration management center to update at least part of the configuration files in the first configuration file from the first encrypted version to the second encrypted version. In addition, the manager can manually adjust the encryption and decryption service center to switch from the second state to the first state, or the encryption and decryption service center can switch from the second state to the first state after monitoring the configuration change event from the configuration management center.

[0113] In the first state, after the application in the service cluster is started, the encryption and decryption module can obtain the verification signature of the corresponding application and the service domain name of the encryption and decryption service center from the startup parameters. Then the encryption and decryption module can pull the key version from the encryption and decryption service center through the signature verification. It can be understood that since the encryption and decryption service center is in the first state, that is, in the state of updating the key version, the encryption and decryption module can obtain two versions of the key, namely the first key and the second key. After obtaining the first key and the second key, the encryption and decryption module can decrypt the corresponding configuration items.

[0114] It can be understood that in the process of updating the encrypted version of at least part of the configuration items by the configuration management center, the encrypted version of the configuration items obtained by the encryption and decryption module may be the first encrypted version or the second encrypted version. Therefore, when the encryption and decryption module obtains the key, it can simultaneously obtain the first key of the current encrypted version and the second key corresponding to the next encrypted version. In this way, the encryption and decryption module can complete the decryption process of the corresponding configuration items through the first key or the second key, thereby ensuring the operation of the application.

[0115] In some embodiments, the encryption and decryption module may store the acquired key in the first storage space (for example, referring to Figure 3 ), therefore, after the electronic device updates the encrypted version, the key in the first storage space may become invalid. The encryption and decryption module can also monitor the status of the configuration management center. After the encryption and decryption module monitors the configuration change event, it no longer obtains the key from the first storage space, but obtains two versions of the key from the encryption and decryption service center based on the signature verification, so as to decrypt the corresponding configuration item.

[0116] Next, the process of the electronic device switching from the second state to the first state is introduced.

[0117] For example, Figure 5 According to some embodiments of the present application, an interactive flow chart of state transition of an electronic device is shown.

[0118] like Figure 5 As shown, the process includes:

[0119] S501, the timing module reminds the encryption and decryption service center of the expiration of the key version.

[0120] For example, in some embodiments of the present application, since the encrypted version of the electronic device needs to be updated regularly, a timing module corresponding to the scheduled task can also be configured in the electronic device. The timing module can perform scheduled tasks, such as timing the current encrypted version and reminding the encryption and decryption service center to update the key corresponding to the encrypted version, for example, notifying the encryption and decryption service center 30 days, 15 days, 10 days, 7 days, 3 days, and 1 day before the current encrypted version expires.

[0121] In some embodiments, the timing module may also notify corresponding management personnel to prepare for updating the encrypted version.

[0122] S502: The encryption and decryption service center generates a second key of a second encrypted version.

[0123] Exemplarily, in some embodiments of the present application, the encryption and decryption service center may generate a new key in advance. For example, the encryption and decryption service center may generate a second key 7 days before the expiration of the current first encryption version and prepare to update the key version.

[0124] In some embodiments of the present application, after the encryption and decryption service center generates the second key, it can notify the corresponding management personnel to prepare for the encryption version update, or the encryption and decryption service center can notify the configuration management center to update the encryption version.

[0125] S503: The configuration management center detects a message for updating the encrypted version.

[0126] In some embodiments of the present application, after receiving the notification, the administrator can perform corresponding operations in the configuration management center, such as determining to start updating the encrypted version. After the configuration management center of the electronic device detects the administrator's operation, it determines to detect the message of updating the encrypted version. Or after the configuration management center detects the message of the encryption and decryption service center generating the second key, it determines that the encrypted version can be updated. In other words, the notification of generating the second key sent by the encryption and decryption service center to the configuration management center can be used as the message of updating the encrypted version.

[0127] S504: The configuration management center notifies the encryption and decryption service center to enter the first state.

[0128] Exemplarily, in some embodiments of the present application, after the configuration management center detects a message of updating the encrypted version, it may notify the encryption and decryption service center to enter the first state.

[0129] S505: The encryption and decryption service center enters the first state.

[0130] Exemplarily, after the encryption and decryption service center detects a message from the configuration management center notifying the center to enter the first state, the encryption and decryption service center enters the first state.

[0131] In some embodiments, the administrator can manually operate the configuration management center to update the encrypted version, and the administrator can adjust the encryption and decryption service center to enter the first state through the operation interface configured in the configuration management center. For example, a corresponding true flag can be added to the encryption and decryption service center, which indicates that the encryption and decryption service center enters the first state.

[0132] Exemplarily, when the encryption and decryption service center enters the first state, the encryption and decryption module can obtain the first key corresponding to the current first encryption version and the second key corresponding to the updated second encryption version from the encryption and decryption service center.

[0133] S506: The configuration management center calls the encryption and decryption service center to encrypt at least part of the configuration items based on the encryption scheme of the second encryption version.

[0134] For example, in some embodiments of the present application, after notifying the encryption and decryption service center to enter the first state, the configuration management center can call the encryption service provided in the encryption and decryption service center to update the encryption version of at least part of the configuration files in the first configuration file from the first encryption version to the second encryption version. For example, the process of updating the encryption version is described in detail below.

[0135] S507, the configuration management center notifies the encryption and decryption service center to complete the update of the encryption version.

[0136] Illustratively, in some embodiments of the present application, after the configuration management center completes updating the encrypted version of at least part of the configuration items, the encryption and decryption service center may complete the updating of the encrypted version.

[0137] S508, the encryption and decryption service center enters the second state.

[0138] Exemplarily, the encryption and decryption service center may enter the second state after receiving a message from the configuration management center indicating that encryption is completed.

[0139] It is understandable that the encryption and decryption service center may enter the second state by, for example, manual adjustment by an administrator. For example, the administrator may adjust the state flag of the encryption and decryption service center from true to false. False indicates that the encryption and decryption service center is in the second state.

[0140] In other embodiments, the encryption and decryption service center may also automatically update from the first state to the second state after receiving the update of the encrypted version completed by the configuration management center.

[0141] It can be understood that when the encryption and decryption service center is in the second state, the encryption and decryption module obtains a key from the encryption and decryption service center.

[0142] Through the conversion between the second state and the first state, the encryption and decryption service center of the electronic device can update the encrypted version of the configuration item without suspending data acquisition, thereby ensuring the normal operation of the application and improving the user experience.

[0143] The following describes the process of the first application program acquiring configuration data.

[0144] For example, Figure 6 According to some embodiments of the present application, a flowchart for implementing providing a first configuration item for a first application is shown.

[0145] It can be understood that the execution entities of the following processes are all electronic devices.

[0146] like Figure 6 As shown, the process includes:

[0147] S601: Detecting that a first application is started.

[0148] Exemplarily, in some embodiments of the present application, the encryption and decryption module in the electronic device can detect the startup of the first application in the application cluster, and prepare corresponding resources for the first application to start, such as configuration data that the first application needs to load.

[0149] S602, determining whether the first application program is to be decrypted.

[0150] In some embodiments of the present application, the encryption and decryption module of the electronic device can determine from the service cluster whether the first application needs to be decrypted when it is started. Exemplarily, the applications in the service cluster can pre-set a preset flag in the service cluster to indicate whether to decrypt when starting. When the first application is started, the encryption and decryption module can determine from the service cluster whether the preset flag of the first application indicates whether the first application needs to be decrypted.

[0151] If the judgment result is yes, then execute S603 to obtain the verification signature and domain name.

[0152] If the judgment result is no, then S615 is executed to load the first configuration item.

[0153] S603, obtain the verification signature and domain name.

[0154] In some embodiments of the present application, after the encryption and decryption module of the electronic device determines that the configuration item to be loaded by the first application needs to be decrypted, the verification signature and domain name of the corresponding encryption and decryption service center can be obtained from the startup parameters of the first application. The verification signature is used by the encryption and decryption service module to obtain the key from the encryption and decryption service center, and the domain name is used by the encryption and decryption module to determine the host of the encryption and decryption service corresponding to the key version.

[0155] S604: Request a key version interface from the encryption and decryption service center based on the signature verification.

[0156] Illustratively, in some embodiments of the present application, the encryption and decryption module in the electronic device may request an interface corresponding to the key version from the encryption and decryption service center based on the signature verification.

[0157] S605, determining whether the key version interface request is successful.

[0158] For example, in some embodiments of the present application, the encryption and decryption module of the electronic device can determine whether the interface corresponding to the key version is successfully obtained. It can be understood that when the encryption and decryption module requests the key version interface from the encryption and decryption service center, the encryption and decryption module may not be able to obtain the key version interface due to network or other reasons (such as interface problems, etc.), so the electronic device needs to determine whether the key version interface is successfully requested.

[0159] If the judgment result is yes, then execute S606 to obtain the key and cache it in the first storage space.

[0160] If the judgment result is no, then S615 is executed to load the first configuration item.

[0161] It can be understood that if the judgment result is no, it can be determined that the encryption and decryption module of the electronic device has not obtained the key version interface, and therefore cannot obtain the corresponding key through the key version interface, but the first configuration item corresponding to the first application may not need to be decrypted. Therefore, the encryption and decryption module of the electronic device can directly load the first configuration item corresponding to the first application.

[0162] S606, obtaining a key and caching it in the first storage space.

[0163] Exemplarily, in some embodiments of the present application, after obtaining the interface of the corresponding key version, the encryption / decryption module of the electronic device can obtain the corresponding key through the interface and cache the key to the first storage space.

[0164] It can be understood that if the first electronic device (or the encryption and decryption service center) is in the first state, that is, in the state of updating the first encryption version to the second encryption version, the encryption and decryption module can obtain the first key corresponding to the current first encryption version and the second key corresponding to the second encryption version.

[0165] S607: Load the first configuration item.

[0166] Illustratively, in some embodiments of the present application, after the encryption / decryption module of the electronic device obtains the key, it can load the first configuration item corresponding to the first application.

[0167] It is understandable that in other embodiments, the encryption and decryption module of the electronic device can load the first configuration item after detecting that the application is started. The execution order of each process in this embodiment is not limited.

[0168] S608: Determine whether the first configuration item needs to be decrypted.

[0169] For example, in some embodiments of the present application, after the encryption and decryption module of the electronic device obtains the first configuration item, it is also necessary to determine whether the first configuration item needs to be decrypted, for example, by determining whether the first configuration item has a version identifier, or whether it is a first encryption identifier, a second encryption identifier, etc. That is, determining whether the first configuration item belongs to a configuration item in at least some configuration items.

[0170] If the judgment result is yes, then S609 is executed to decrypt the first configuration item according to the obtained key.

[0171] If the judgment result is no, then execute S616 to send the first configuration item to the first application program.

[0172] S609: decrypt the first configuration item according to the acquired key.

[0173] Exemplarily, after the encryption / decryption module of the electronic device obtains the first configuration item, it may decrypt the first configuration item based on the obtained key.

[0174] For example, in the second state, the encryption and decryption module of the electronic device obtains the first key, and the first configuration item can be directly decrypted by the first key.

[0175] In the first state, the encryption and decryption module of the electronic device can obtain the first key and the second key, and then select one of the keys for decryption. If the decryption fails, the other key can be selected for decryption. It can be understood that since the first configuration item also has a version identifier (for example, a version identifier corresponding to the first encrypted version or a version identifier corresponding to the second encrypted version), the encryption and decryption module of the electronic device can also determine the version identifier corresponding to the first configuration item after obtaining the first configuration item, and then decrypt using the first key or the second key corresponding to the version identifier.

[0176] S610, determining whether the decryption is successful.

[0177] Illustratively, in some embodiments of the present application, after the encryption / decryption module of the electronic device decrypts the first configuration item, it can be determined whether the decryption is successful.

[0178] If the judgment result is yes, then S614 is executed to send the first configuration data corresponding to the first configuration item to the first application.

[0179] If the judgment result is no, execute S611 to obtain the key again.

[0180] S611, re-obtain the key.

[0181] For example, in some embodiments of the present application, after the encryption / decryption module decrypts the first configuration item based on the key for the first time, if the decryption fails, the encryption / decryption module may try again to obtain the key for decryption.

[0182] S612, decryption is performed based on the newly acquired key.

[0183] S613, determine whether the decryption is successful.

[0184] It is understandable that after the electronic device reacquires the key for decryption, it is still necessary to determine whether the decryption is successful.

[0185] If the judgment result is yes, then S614 is executed to send the first configuration data corresponding to the first configuration item to the first application.

[0186] If the judgment result is no, then execute S616 to send the first configuration item to the first application.

[0187] S614: Send first configuration data corresponding to the first configuration item to the first application.

[0188] Illustratively, in some embodiments of the present application, after the encryption / decryption module of the electronic device completes decryption of the first configuration item and obtains the first configuration data, the first configuration data can be sent to the first application to support the startup of the first application.

[0189] S615: Load the first configuration item.

[0190] Exemplarily, in some embodiments of the present application, if the preset identifier corresponding to the first application indicates that the first application does not need to be decrypted, or the encryption and decryption module of the electronic device fails to request the key version interface, the encryption and decryption module of the electronic device can directly obtain the first configuration item, that is, the first configuration item does not need to be decrypted.

[0191] S616: Send the first configuration item to the first application.

[0192] It can be understood that when the first configuration item does not need to be decrypted, or when the decryption of the first configuration item fails, the encryption and decryption module of the electronic device can directly send the first configuration item to the first application, and the first application runs according to the first configuration item. If the first application can run normally, it means that the first configuration item does not need to be decrypted. If the first application cannot run, it means that there is a problem in the encryption and decryption process of the first configuration item, and an error can be reported for subsequent processing.

[0193] Through the above decryption process, the normal operation of the application program of the electronic device can be guaranteed, and at the same time, the sensitive data in the configuration file of the electronic device can be prevented from being leaked, thereby ensuring the security of the data.

[0194] Next, the encryption process of the encryption and decryption service center is introduced.

[0195] For example, Figure 7 According to some embodiments of the present application, an encryption process of an encryption and decryption service center is shown.

[0196] For example, in some embodiments of the present application, the encryption and decryption service center can be configured in the same electronic device as the configuration management center, the encryption and decryption module, and the service cluster, or the encryption and decryption service center can be configured in an electronic device alone. The execution subject of each of the following implementation processes is an electronic device configured with the encryption and decryption service center.

[0197] like Figure 7 As shown, the process includes:

[0198] S701, obtain signature verification.

[0199] Exemplarily, the encryption and decryption service center of the electronic device encrypts each configuration item in the first configuration file, and needs to obtain a verification signature for verification.

[0200] It can be understood that the process of the encryption and decryption service center encrypting the configuration items in the first configuration file is to configure the background to call the encryption interface of the encryption and decryption service center to encrypt the configuration items. Therefore, it is necessary to obtain signature verification when calling the interface. For example, a signature can be generated based on parameters such as token, time stamp, source, etc., and the encryption and decryption service center authenticates the signature.

[0201] S702, determine whether the signature verification is successful.

[0202] If the judgment result is yes, then S703 is executed to parse the data type of the configuration item.

[0203] If the judgment result is no, the process ends.

[0204] S703, parsing the data type of the configuration item.

[0205] Exemplarily, after the encryption and decryption service center completes the signature verification, it can parse the data of the configuration item, which includes the file format. For example, for configuration items in yml, txt and other formats, the encryption process can be directly executed. For configuration items in JSON format, it is necessary to parse the JSON, obtain each sub-data in the JSON, and then perform the encryption process on each sub-data.

[0206] S704: Determine the identifier of each configuration item.

[0207] Exemplarily, after the data type of each configuration item is determined, the version identifier, the first encryption identifier, the second encryption identifier, etc. corresponding to each configuration item may be parsed out.

[0208] S705: Determine whether the configuration item belongs to the first category of configuration items.

[0209] Exemplarily, in some embodiments of the present application, the electronic device may determine whether the corresponding configuration item belongs to the first category of configuration items according to whether the configuration item has the first encryption identifier.

[0210] If the judgment result is yes, then S707 is executed to determine whether the configuration item has been encrypted.

[0211] If the judgment result is no, then S706 is executed to judge whether the configuration item belongs to the second category of configuration items.

[0212] S706: Determine whether the configuration item belongs to the second category of configuration items.

[0213] Exemplarily, in some embodiments of the present application, the electronic device may determine whether the corresponding configuration item belongs to the second category of configuration items according to whether the configuration item has the second encryption identifier.

[0214] If the judgment result is yes, then S707 is executed to determine whether the configuration item has been encrypted.

[0215] If the judgment result is no, the process ends.

[0216] It can be understood that if the configuration item does not have the first encryption identifier or the second encryption identifier, it means that the configuration item does not belong to sensitive data and user-defined encrypted data, so there is no need to encrypt the configuration item.

[0217] S707, determine whether the configuration item has been encrypted.

[0218] Exemplarily, the encryption and decryption service center in the electronic device may determine whether the configuration item has been encrypted based on whether the configuration item has a version identifier.

[0219] If the judgment result is yes, then execute S708 to determine whether the key corresponding to the encrypted version of the configuration item exists.

[0220] If the judgment result is no, execute S711 and use the current encryption version for encryption.

[0221] S708, determine whether the key corresponding to the encrypted version of the configuration item exists.

[0222] If the configuration item has a version identifier, the encryption version corresponding to the configuration item can be determined according to the version identifier, and it can be determined whether the key corresponding to the encryption version exists.

[0223] If the judgment result is yes, execute S709 and use the corresponding key for decryption.

[0224] If the judgment result is no, S712 is executed, decryption fails, and an exception is reported.

[0225] S709, decrypt using the corresponding key.

[0226] S710, determining whether the decryption is successful.

[0227] If the judgment result is yes, execute S711 and use the current encryption version for encryption.

[0228] If the judgment result is no, S712 is executed, decryption fails, and an exception is reported.

[0229] S711, encrypt using the current encryption version.

[0230] Exemplarily, if the corresponding configuration item has not been encrypted or after decryption of a previous encrypted version is completed, the electronic device may encrypt the current encrypted version of the configuration item.

[0231] S712, unable to decrypt, reporting exception.

[0232] Exemplarily, if the encryption and decryption service center of the electronic device determines that the key corresponding to the encrypted version of the current configuration item does not exist or the current configuration item is not decrypted successfully, the exception may be reported for further processing.

[0233] Exemplarily, through the above encryption process, it can be ensured that sensitive data in the configuration file of the electronic device and the user-defined encrypted data are all in ciphertext state, so relatively important information in the electronic device will not be leaked, thereby ensuring data security.

[0234] The electronic devices involved in the above embodiments are introduced below.

[0235] For example, Figure 8 According to some embodiments of the present application, a schematic structural diagram of an electronic device 100 is shown.

[0236] The electronic device 100 can be used to implement the encryption and decryption methods provided in the aforementioned embodiments.

[0237] like Figure 8 As shown, the electronic device 100 includes one or more processors 101, a system memory 102, a non-volatile memory (NVM) 103, a communication interface 104, an input / output device 105, and a system control logic 106 for coupling the processor 101, the system memory 102, the non-volatile memory 103, the communication interface 104 and the input / output (I / O) device 105. Among them:

[0238] The processor 101 may include one or more processing units, for example, a central processing unit (CPU), a graphics processing unit (GPU), a digital signal processor (DSP), a microprocessor (MCU), an artificial intelligence (AI) processor or a programmable logic device (field programmable gate array, FPGA), a neural network processor (neural-network processing unit, NPU), etc. The processing module or processing circuit may include one or more single-core or multi-core processors. In some embodiments, the CPU can be used to optimize the neural network model to be run, and the NPU can be used to run the neural network model to be run.

[0239] The system memory 102 is a volatile memory, such as a random-access memory (RAM), a double data rate synchronous dynamic random access memory (DDR SDRAM), etc. The system memory is used to temporarily store data and / or instructions. For example, in some embodiments, the system memory 102 can be used to store the aforementioned first configuration file, keys, etc., and can also be used to store instructions of the encryption and decryption methods provided in the aforementioned embodiments, etc.

[0240] The non-volatile memory 103 may include one or more tangible, non-transitory computer-readable media for storing data and / or instructions. In some embodiments, the non-volatile memory 103 may include any suitable non-volatile memory such as flash memory and / or any suitable non-volatile storage device, such as a hard disk drive (HDD), a compact disc (CD), a digital versatile disc (DVD), a solid-state drive (SSD), etc. In some embodiments, the non-volatile memory 103 may also be a removable storage medium, such as a secure digital (SD) memory card, etc. In other embodiments, the non-volatile memory 103 may be used to store instructions of the encryption and decryption methods provided in the aforementioned embodiments, etc.

[0241] In particular, the system memory 102 and the non-volatile memory 103 may respectively include: a temporary copy and a permanent copy of the instruction 107. The instruction 107 may include: when executed by at least one of the processors 101, the electronic device 100 implements the encryption and decryption methods provided in various embodiments of the present application.

[0242] The communication interface 104 may include a transceiver for providing a wired or wireless communication interface for the electronic device 100, and then communicating with any other suitable device through one or more networks. In some embodiments, the communication interface 104 may be integrated into other components of the electronic device 100, for example, the communication interface 104 may be integrated into the processor 101. In some embodiments, the electronic device 100 may communicate with other devices through the communication interface 104, for example, the electronic device 100 may obtain demand data from other electronic devices through the communication interface 104.

[0243] The input / output (I / O) device 105 may include input devices such as a keyboard, a mouse, etc., and output devices such as a display, etc. A user may interact with the electronic device 100 through the input / output (I / O) device 105 .

[0244] System control logic 106 may include any suitable interface controller to provide any suitable interface with other modules of electronic device 100. For example, in some embodiments, system control logic 106 may include one or more memory controllers to provide interfaces to system memory 102 and non-volatile memory 103.

[0245] In some embodiments, at least one of the processors 101 may be packaged together with the logic of one or more controllers for the system control logic 106 to form a system in package (SiP). In other embodiments, at least one of the processors 101 may also be integrated with the logic of one or more controllers for the system control logic 106 on the same chip to form a system-on-chip (SoC).

[0246] Understandably, Figure 8 The structure of the electronic device 100 shown is only an example. In other embodiments, the electronic device 100 may include more or fewer components than shown, or combine some components, or separate some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0247] It is understandable that the electronic device 100 can be any electronic device, including but not limited to a mobile phone, a tablet computer, a desktop computer, a laptop computer, a handheld computer, a notebook computer, an ultra-mobile personal computer (UMPC), a netbook, etc., and the embodiments of the present application are not limited thereto.

[0248] The embodiments of the present application also provide a program product, which, when executed on an electronic device, can enable the electronic device to implement the methods provided in the aforementioned embodiments.

[0249] An embodiment of the present application further provides a readable storage medium, in which one or more programs are stored. When the one or more programs are executed by an electronic device, the electronic device implements the methods provided in the aforementioned embodiments.

[0250] The various embodiments of the mechanism disclosed in the present application can be implemented in hardware, software, firmware or a combination of these implementation methods. The embodiments of the present application can be implemented as a computer program or program code executed on a programmable system, which includes at least one processor, a storage system (including volatile and non-volatile memory and / or storage elements), at least one input device and at least one output device.

[0251] Program code can be applied to input instructions to perform the functions described in this application and generate output information. The output information can be applied to one or more output devices in a known manner. For the purposes of this application, a processing system includes any system having a processor such as, for example, a digital signal processor, a microcontroller, an application specific integrated circuit, or a microprocessor.

[0252] Program code can be implemented with high-level programming language or object-oriented programming language to communicate with the processing system. When necessary, program code can also be implemented with assembly language or machine language. In fact, the mechanism described in this application is not limited to the scope of any specific programming language. In either case, the language can be a compiled language or an interpreted language.

[0253] In some cases, the disclosed embodiments may be implemented in hardware, firmware, software, or any combination thereof. The disclosed embodiments may also be implemented as instructions carried by or stored on one or more temporary or non-temporary machine-readable (e.g., computer-readable) storage media, which may be read and executed by one or more processors. For example, the instructions may be distributed over a network or through other computer-readable media. Therefore, the machine-readable medium may include any mechanism for storing or transmitting information in a form readable by a machine (e.g., a computer), including but not limited to floppy disks, optical disks, optical discs, compact disc-read only memory (CD-ROMs), magneto-optical disks, read-only memory (ROM), random-access memory (RAM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), magnetic or optical cards, flash memory, or tangible machine-readable storage for transmitting information using the Internet in electrical, optical, acoustic or other forms of propagation signals (e.g., carrier waves, infrared signals, digital signals, etc.). Therefore, the machine-readable medium includes any type of machine-readable medium suitable for storing or transmitting electronic instructions or information in a form readable by a machine (e.g., a computer).

[0254] In the accompanying drawings, some structural or method features may be shown in a specific arrangement and / or order. However, it should be understood that such a specific arrangement and / or order may not be required. Instead, in some embodiments, these features may be arranged in a manner and / or order different from that shown in the illustrative drawings. In addition, the inclusion of structural or method features in a particular figure does not mean that such features are required in all embodiments, and in some embodiments, these features may not be included or may be combined with other features.

[0255] It should be noted that the units / modules mentioned in the various device embodiments of the present application are all logical units / modules. Physically, a logical unit / module can be a physical unit / module, or a part of a physical unit / module, or can be implemented as a combination of multiple physical units / modules. The physical implementation method of these logical units / modules themselves is not the most important. The combination of functions implemented by these logical units / modules is the key to solving the technical problems proposed by the present application. In addition, in order to highlight the innovative part of the present application, the above-mentioned device embodiments of the present application do not introduce units / modules that are not closely related to solving the technical problems proposed by the present application, which does not mean that there are no other units / modules in the above-mentioned device embodiments.

[0256] It should be noted that in the examples and description of this patent, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "including one" do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0257] Although the present application has been illustrated and described with reference to certain preferred embodiments thereof, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the scope of the present application.

Claims

1. An encryption and decryption method, applied to electronic equipment, characterized in that: The electronic device is configured with a first configuration file, the first configuration file includes a plurality of configuration items, the configuration items are used to run corresponding application programs, and the method includes: Upon detecting an update message that updates at least some of the multiple configuration items corresponding to the first configuration file from a first encrypted version to a second encrypted version, the electronic device enters a first state; When the electronic device is in the first state and detects an instruction to call a first configuration item among the at least some configuration items, wherein the first configuration item is used to run a first application; Obtaining a first key corresponding to the first encryption version and a second key corresponding to the second encryption version; The first configuration item is decrypted based on the first key and the second key to obtain first configuration data corresponding to the first configuration item, and the first application is run based on the first configuration data.

2. The method according to claim 1, characterized in that: The at least some configuration items include: a first category of configuration items and a second category of configuration items, wherein the first category of configuration items includes a first encryption identifier, the second category of configuration items includes a second encryption identifier, the first encryption identifier is used to identify sensitive data, and the second encryption identifier is used to identify custom data.

3. The method according to claim 2, characterized in that The detecting an instruction to call a first configuration item in the at least some configuration items comprises: It is detected that the first configuration item has the first encryption identifier or the second encryption identifier, and it is determined that the first configuration item is a configuration item in the at least some configuration items.

4. The method according to claim 3, characterized in that The detecting that at least some of the configuration items corresponding to the first configuration file are updated from a first encrypted version to a second encrypted version includes: In response to the update message, decrypting the at least part of the configuration file corresponding to the first encrypted version based on the first key; The decrypted at least part of the configuration file is encrypted based on the second encrypted version, and the version identifier of the at least part of the configuration file is updated from the version identifier corresponding to the first encrypted version to the version identifier corresponding to the second encrypted version.

5. The method according to claim 1, characterized in that The decrypting the first configuration item based on the first key and the second key includes: Determine a version identifier of the first configuration item, and select one of the first key and the second key to decrypt the first configuration item based on the version identifier of the first configuration item; Corresponding to determining that the version identifier of the first configuration item is a first encrypted version, decrypting the first configuration item based on the first key; Corresponding to determining that the version identifier of the first configuration item is the second encrypted version, the first configuration item is decrypted based on the second key.

6. The method according to claim 1, characterized in that The decrypting the first configuration item based on the first key and the second key to obtain first configuration data corresponding to the first configuration item includes: decrypting the first configuration item based on the first key or the second key; If the decryption is successful, the first configuration data is obtained; If the decryption fails, the first configuration item is re-decrypted based on the second key or the first key to obtain the first configuration data.

7. The method according to claim 1, characterized in that The method further comprises, Upon detecting a completion message that at least part of the configuration items are updated from the first encrypted version to the second encrypted version, the electronic device enters the second state from the first state; When the electronic device is in the second state, and an instruction to call a second configuration item in the at least some of the configuration items is detected, wherein the second configuration item is used to run a second application; Obtaining a second key corresponding to the second encrypted version; The second configuration item is decrypted based on the second key to obtain second configuration data, and the second application is run based on the second configuration data.

8. An encryption and decryption system, characterized in that: The system comprises: A configuration management module, used to store and manage a first configuration file, wherein the first configuration file includes a plurality of configuration items, and the configuration items are used to run corresponding application programs; an encryption and decryption service module, configured to update at least some of the multiple configuration items corresponding to the first configuration file from a first encryption version to a second encryption version, and to store a first key corresponding to the first encryption version and a second key corresponding to the second encryption version, and the encryption and decryption service module is further configured to send the first key and the second key to the encryption and decryption module when receiving a key acquisition instruction sent by the encryption and decryption module during the update process; The encryption and decryption module is used to send the key acquisition instruction to the encryption and decryption service module when detecting that any configuration item in the at least part of the configuration items is called, and decrypt any configuration item in the at least part of the configuration items based on the first key and the second key returned by the encryption and decryption service module to obtain corresponding configuration data.

9. An electronic device, characterized in that: The invention comprises: a memory for storing instructions; At least one processor is used to execute the instructions so that the electronic device implements the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The readable storage medium stores instructions, and when the instructions are executed on a computer, the computer is caused to execute the method according to any one of claims 1 to 7.

11. A computer program product, characterized in that When the computer program product is executed on a device, the device is caused to perform the method according to any one of claims 1 to 7.

Images