Encryption and decryption methods, readable storage media, program products and electronic devices

Abstract

This application relates to the field of computer technology, and particularly to an encryption / decryption method, a readable storage medium, a program product, and an electronic device. The encryption / decryption method is applied to an electronic device and includes: detecting an update message that updates at least some configuration items among a plurality of configuration items corresponding to a first configuration file from a first encrypted version to a second encrypted version, and the electronic device entering a first state; while the electronic device is in the first state, and an instruction to invoke the first configuration item among the at least some configuration items is detected, wherein the first configuration item is used to run a first application; obtaining a first key corresponding to the first encrypted version and a second key corresponding to the second encrypted version; decrypting the first configuration item based on the first key and the second key to obtain first configuration data corresponding to the first configuration item; and running the first application based on the first configuration data. This method ensures the normal operation of the application when updating the encrypted version of at least some configuration items.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to an encryption / decryption method, a readable storage medium, a program product, and an electronic device. Background Technology

[0002] In some electronic device systems and applications, variable parameters or data are required to support the dynamic operation of the system or application. Such parameters or data are typically stored as configuration items in configuration files, thereby enabling the dynamic control of the system or application's operation.

[0003] In some cases, configuration items in electronic devices are in plaintext, but some of these configuration items are sensitive (such as Uniform Resource Locators for database connections, usernames, passwords, and various keys, which pose strong security risks). Therefore, these sensitive configuration items need to be encrypted, and the corresponding configuration items can be decrypted using the appropriate key when the application loads them.

[0004] In some cases, to further ensure encryption security, electronic devices need to update their keys according to requirements such as a reasonable key lifecycle. After a key update, the old and new keys contain different information, and the new key cannot decrypt configuration items encrypted with the old key. Therefore, during the key update process, electronic devices typically pause data usage, thus affecting the user experience. Summary of the Invention

[0005] This application provides an encryption / decryption method, a readable storage medium, a program product, and an electronic device. This encryption / decryption method enables applications to run normally even when the encrypted version is updated, thereby improving the user experience.

[0006] In a first aspect, embodiments of this application provide an encryption / decryption method applied to an electronic device. The electronic device is configured with a first configuration file, which includes multiple configuration items. Each configuration item is used to run a corresponding application. The method includes: detecting an update message that updates at least some of the configuration items corresponding to the multiple configuration items of the first configuration file from a first encrypted version to a second encrypted version, and the electronic device entering a first state; when the electronic device is in the first state, and an instruction to call the first configuration item among the at least some configuration items is detected, wherein the first configuration item is used to run a first application; obtaining a first key corresponding to the first encrypted version and a second key corresponding to the second encrypted version; decrypting the first configuration item based on the first key and the second key to obtain first configuration data corresponding to the first configuration item, and running the first application based on the first configuration data.

[0007] In some embodiments of this application, the electronic device can still call data and run applications normally even when it is in the second state. It is understood that after the first application, which requires calling the first configuration item, starts, the electronic device can obtain two keys: one before the encryption version update and one after the encryption version update, namely the first key and the second key. These two keys are used to decrypt the first configuration item, and decryption is successful regardless of whether the encryption version of the first configuration item has been updated. Thus, the first application runs based on the first configuration data obtained after decryption.

[0008] In one possible implementation of the first aspect above, at least some of the configuration items include: a first type of configuration item and a second type of configuration item, wherein the first type of configuration item includes a first encryption identifier, the second type of configuration item includes a second encryption identifier, the first encryption identifier is used to identify sensitive data, and the second encryption identifier is used to identify custom data.

[0009] It is understood that in some embodiments of this application, at least some configuration items in the first configuration file may be identified before encryption. For example, a first encryption identifier may be added to sensitive data, and a second encryption identifier may be added to user-defined configuration items that need to be encrypted, so as to determine which configuration items belong to at least some configuration items during the encryption process.

[0010] In one possible implementation of the first aspect above, detecting the instruction to invoke the first configuration item among at least some configuration items includes: detecting that the first configuration item has a first encryption identifier or a second encryption identifier, and determining that the first configuration item is a configuration item among at least some configuration items.

[0011] In some embodiments of this application, an electronic device can determine whether a configuration item needs to be decrypted by whether the configuration item in the first configuration file has a first encryption identifier or a second encryption identifier, that is, whether the corresponding configuration item belongs to at least some configuration items.

[0012] In one possible implementation of the first aspect above, detecting an update message that updates at least some of the configuration items among a plurality of configuration items corresponding to the first configuration file from the first encrypted version to the second encrypted version includes: in response to the update message, decrypting at least some of the configuration files corresponding to the first encrypted version based on the first key; encrypting the decrypted at least some of the configuration files based on the second encrypted version, and updating the version identifier of at least some of the configuration files from the version identifier corresponding to the first encrypted version to the version identifier corresponding to the second encrypted version.

[0013] For example, in some embodiments of this application, during the process of updating the encrypted version, if the second configuration item in the first configuration file includes a first identifier or a second identifier, it can be determined that the second configuration item belongs to at least some configuration items and needs to be encrypted.

[0014] If the second configuration item includes a version identifier, it can be determined that the second configuration item has been encrypted. The second configuration item can then be decrypted using the key corresponding to the encrypted version of the version identifier. After that, the second configuration item can be encrypted again based on the encryption method corresponding to the second encrypted version, and the version identifier of the second configuration item can be updated to the version identifier corresponding to the second encrypted version.

[0015] If the second configuration item does not have a version identifier, it means that the second configuration item is a newly added configuration item that needs to be encrypted, and the second configuration item can be encrypted directly.

[0016] In one possible implementation of the first aspect above, the decryption of the first configuration item based on the first key and the second key includes: determining the version identifier of the first configuration item; selecting a pair of the first key and the second key to decrypt the first configuration item based on the version identifier of the first configuration item; decrypting the first configuration item based on the first key when the version identifier of the first configuration item is determined to be a first encrypted version; and decrypting the first configuration item based on the second key when the version identifier of the first configuration item is determined to be a second encrypted version.

[0017] For example, in some embodiments of this application, after the electronic device obtains the first configuration item, it can also determine the version identifier of the first configuration item, and then select the corresponding key for decryption through the encryption version indicated by the version identifier.

[0018] In one possible implementation of the first aspect above, the above-mentioned method of decrypting the first configuration item based on the first key and the second key to obtain the first configuration data corresponding to the first configuration item includes: decrypting the first configuration item based on the first key or the second key; if the decryption is successful, obtaining the first configuration data; if the decryption fails, re-decrypting the first configuration item based on the second key or the first key to obtain the first configuration data.

[0019] For example, in some embodiments of this application, during the decryption of the first configuration item, either the first key or the second key can be selected to decrypt the first configuration item. If the decryption is successful, the first configuration data can be obtained. If the decryption fails, the remaining key can be used to decrypt the first configuration item, thereby ensuring that the first configuration item can be successfully decrypted.

[0020] In one possible implementation of the first aspect above, the method further includes: detecting a completion message that at least some configuration items have been updated from a first encrypted version to a second encrypted version, and the electronic device transitioning from a first state to a second state; when the electronic device is in the second state, and an instruction to invoke the second configuration item among at least some configuration items is detected, wherein the second configuration item is used to run a second application; obtaining a second key corresponding to the second encrypted version; decrypting the second configuration item based on the second key to obtain second configuration data, and running the second application based on the second configuration data.

[0021] In some embodiments of this application, after the electronic device updates the encrypted version, it can switch from the second state to the first state. In the first state, only one key needs to be obtained for decryption.

[0022] Secondly, embodiments of this application provide an encryption / decryption system, comprising: a configuration management module for storing and managing a first configuration file, the first configuration file including multiple configuration items, the configuration items being used to run corresponding applications; an encryption / decryption service module for updating at least some of the configuration items corresponding to the multiple configuration items in the first configuration file from a first encrypted version to a second encrypted version, and storing a first key corresponding to the first encrypted version and a second key corresponding to the second encrypted version; furthermore, the encryption / decryption service module is used to send the first key and the second key to the encryption / decryption module when it receives a key acquisition instruction sent by the encryption / decryption module during the update process; and the encryption / decryption module is used to send a key acquisition instruction to the encryption / decryption service module and decrypt any of the configuration items based on the first key and the second key returned by the encryption / decryption service module when it detects that any of the configuration items in the at least some configuration items are invoked, to obtain the corresponding configuration data.

[0023] For example, in some embodiments of this application, the encryption / decryption service center can provide various encryption services. During the decryption process, the encryption / decryption service center can provide keys to the encryption / decryption module. The first or second state of the electronic device can, for example, be the first or second state of the encryption / decryption service center. In the second state, the encryption / decryption service center can provide a first key and a second key to the encryption / decryption module. This allows the first application in the electronic device to obtain the first configuration data normally even when the encryption version is updated, thus enabling it to operate normally.

[0024] The beneficial effects achievable in the second aspect can be referred to in the beneficial effects of the method provided in any embodiment of the first aspect, and will not be repeated here.

[0025] Thirdly, this application provides an electronic device, comprising: a memory for storing instructions; and at least one processor for executing the instructions to cause the device to implement the methods provided in the first aspect and any possible implementation of the first aspect. The beneficial effects achievable in the third aspect can be referred to the beneficial effects of the methods provided in any embodiment of the first aspect, and will not be repeated here.

[0026] Fourthly, this application provides a computer-readable storage medium storing instructions that, when executed by a device, cause a computer to implement the methods provided in the first aspect and any possible implementation of the first aspect. The beneficial effects achievable in the fourth aspect can be found in the beneficial effects of the methods provided in any embodiment of the first aspect, and will not be repeated here.

[0027] Fifthly, this application provides a computer program product that, when run on a device, enables the device to implement the methods provided in the first aspect and any possible implementation of the first aspect. The beneficial effects achievable in the fifth aspect can be referenced to the beneficial effects of the methods provided in any embodiment of the first aspect, and will not be repeated here. Attached Figure Description

[0028] Figure 1 A schematic diagram of an application loading a configuration file is shown;

[0029] Figure 2 An implementation flowchart of an encryption / decryption method is shown according to an embodiment of this application;

[0030] Figure 3 According to some embodiments of this application, a schematic diagram of an encryption / decryption system is shown;

[0031] Figure 4 According to some embodiments of this application, a schematic diagram of an updated encrypted version is shown;

[0032] Figure 5 According to some embodiments of this application, an interactive flowchart of state transitions of an electronic device is shown;

[0033] Figure 6 According to some embodiments of this application, an implementation flowchart for providing a first configuration item for a first application is shown;

[0034] Figure 7 According to some embodiments of this application, an encryption process for an encryption / decryption service center is illustrated;

[0035] Figure 8 According to some embodiments of this application, a schematic diagram of the structure of an electronic device 100 is shown. Detailed Implementation

[0036] The illustrative embodiments of this application include, but are not limited to, encryption / decryption methods, readable storage media, program products, and electronic devices.

[0037] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions in the embodiments of this application will be described in detail below with reference to the accompanying drawings and specific implementation methods.

[0038] As described in the background section, during the key update process, electronic devices typically pause data usage, thus affecting the user experience.

[0039] The following describes the process of running applications on electronic devices.

[0040] For example, Figure 1 A schematic diagram of an application loading a configuration file is shown.

[0041] like Figure 1 As shown, electronic device 10 is equipped with application A. During the execution of application A, electronic device 10 needs to load corresponding configuration items from its configuration file, parse these configuration items, and then run application A based on the parsed configuration item data. For example, after decrypting the loaded configuration items, the electronic device determines that the corresponding configuration item data specifies a server address, and then application A can use this address to make network requests.

[0042] For example, in the configuration file of electronic device 10, some configuration items are encrypted. Electronic device 10 needs to obtain the corresponding key to decrypt the configuration items and then run application A according to the configuration items.

[0043] However, if the encryption version of the configuration item is being updated, and the electronic device 10 obtains the new key when running application A, but the configuration item has not yet been encrypted with the new version, the electronic device will be unable to decrypt the configuration item. In other words, the new key cannot decrypt the old version of the encrypted configuration item, thus preventing the application from running properly. Therefore, during the key update process, data usage on the electronic device is generally paused.

[0044] In summary, during the key update process, electronic devices typically pause data usage, thus affecting the user experience.

[0045] To address the issue of data usage in electronic devices being suspended during key version updates, this application proposes an encryption / decryption method. The electronic device detects a message indicating that at least some configuration items in a first configuration file have begun updating from a first encrypted version to a second encrypted version, and enters a second state. In the second state, it detects an instruction from a first application to call a first configuration item. The device then retrieves the first configuration item from at least some of the configuration items in the first configuration file, and obtains a first key corresponding to the first encrypted version and a second key corresponding to the second encrypted version. Based on the first and second keys, it decrypts the first configuration item to obtain first configuration data, and runs the first application based on the first configuration data.

[0046] Using the above scheme, the electronic device can still run the first application even when the first encrypted version of the first configuration file is updated to the second encrypted version. It can obtain the first key corresponding to the first encrypted version and the second key for the second encrypted version. Therefore, during the decryption process, the electronic device can attempt to decrypt the first encrypted item based on both keys, thereby obtaining the first configuration item. Thus, the electronic device can still run the application normally while updating the encrypted version of the first configuration file.

[0047] In some embodiments of this application, the electronic device can provide encryption and decryption services for various configuration items in the configuration file through an encryption / decryption service center. For example, the encryption / decryption service center can be configured with various encryption / decryption schemes to encrypt multiple configuration files. For instance, the encryption schemes provided by the encryption / decryption service center can include advanced encryption standard (AES), Chinese national standard cryptography (SM), and other secure encryption algorithms. The encryption / decryption service center can hold various configuration files, including but not limited to yml, ymal, txt, json, xml, and properties files.

[0048] The encryption and decryption methods in some embodiments of this application are described below.

[0049] For example, Figure 2 An implementation flowchart of an encryption / decryption method is shown according to an embodiment of this application.

[0050] It should be noted that the electronic devices in the embodiments of this application may also be referred to as terminals, user terminals, mobile terminals, user equipment (UE), terminal devices, mobile stations, mobile terminals (MT), etc. Terminal devices can be mobile phones, smart TVs, wearable devices, tablets, computers with wireless transceiver capabilities, virtual reality (VR) terminal devices, augmented reality (AR) terminal devices, wireless terminals in industrial control, wireless terminals in self-driving vehicles, wireless terminals in smart grids, wireless terminals in transportation safety, wireless terminals in smart cities, wireless terminals in smart homes, etc. The executing entities of each of the following processes are all electronic devices; therefore, the executing entities of each process will not be elaborated upon when describing the processes below.

[0051] like Figure 2 As shown, the process includes:

[0052] S201, upon detecting an update message that updates at least some of the configuration items among the multiple configuration items corresponding to the first configuration file from the first encrypted version to the second encrypted version, the electronic device enters the first state.

[0053] It is understandable that an electronic device is configured with a first configuration file, which includes multiple configuration items, and these configuration items are used to run the corresponding applications.

[0054] For example, in some embodiments of this application, electronic devices can encrypt sensitive data and certain configuration items of custom data (such as Uniform Resource Locators for database connections, accounts, passwords, and various keys, which pose strong security risks) in stored configuration files, thereby preventing data leakage. It is understood that custom data can be user-defined configuration data that needs to be encrypted. To ensure encryption security, the encrypted versions of some configuration items need to be updated periodically.

[0055] For example, in some embodiments, the electronic device can notify the user or relevant administrators that the first encrypted version needs to be updated to a second encrypted version at a preset time before the first encrypted version expires (e.g., 30 days, 15 days, 7 days, 3 days, 1 day, or other arbitrary custom time). The electronic device can generate a second key corresponding to the second encrypted version in advance. When the electronic device detects that the relevant administrators have started updating at least some of the configuration items in the configuration file, it enters a first state. The first state indicates that the electronic device is currently in the process of updating the encrypted version.

[0056] In some embodiments, the electronic device detects a message that at least some configuration items in the first configuration file have begun to be updated from a first encrypted version to a second encrypted version, which may be manually identified by a relevant administrator. For example, after receiving a message that the first encrypted version is about to expire, the relevant administrator performs an operation on the electronic device (e.g., adds an identifier to the electronic device indicating that it is entering a first state), and the electronic device responds to the administrator's operation by entering the first state.

[0057] In other embodiments, the electronic device can automatically enter the first state after detecting that the usage period of the first encrypted version has reached a preset period. For example, if the usage period of the first encrypted version is three months, and the electronic device detects that the first encrypted version has not been updated after three months of use, the electronic device can automatically start updating the first encrypted version to the second encrypted version and enter the first state. Exemplarily, the encrypted version update process is described in detail below.

[0058] S202, when the electronic device is in a first state and an instruction to invoke at least a first configuration item among the configuration items is detected, wherein the first configuration item is used to run a first application.

[0059] For example, in some embodiments of this application, the first state is a state in which the electronic device is updating a first encrypted version to a second encrypted version. In the first state, the electronic device can run a corresponding application, and if the application needs to call at least some of the configuration items, the electronic device can detect the corresponding instruction, for example, detect the instruction of the application to call the first configuration item.

[0060] S203, obtain the first key corresponding to the first encrypted version and the second key corresponding to the second encrypted version.

[0061] For example, in some embodiments of this application, after the electronic device detects an instruction from the first application to call the first configuration item, it can obtain the key for the encrypted version of the first configuration item. Since the electronic device is in a first state of updating the key version, it can obtain the first key corresponding to the current first encrypted version and the second key corresponding to the updated second version.

[0062] Exemplarily, in some embodiments of this application, the electronic device includes an encryption / decryption service center, which can provide encryption and decryption services for at least some configuration items in the configuration file. Exemplarily, the encryption / decryption service center can be configured with various encryption / decryption schemes; for example, the encryption schemes provided by the encryption / decryption service center can be selected from secure encryption algorithms such as Advanced Encryption Standard (AES) and the Chinese national cryptographic standard SM. The encryption / decryption service center can hold various configuration files, including but not limited to yml, ymal, txt, json, xml, properties, etc. The electronic device can parse at least some configuration items using the encryption algorithms of the encryption / decryption service center to determine the file format of the corresponding configuration items, and then encrypt at least some configuration items using the corresponding encryption algorithm.

[0063] During the decryption process, the first application can obtain the corresponding key from the encryption / decryption service center. When the electronic device is in its first state, the first application can obtain the first key corresponding to the current first encryption version and the second key corresponding to the updated second encryption version from the encryption / decryption service center. It is understandable that the decryption process of the electronic device is easily affected during encryption version updates. For example, if the encryption version corresponding to the first configuration item has not yet been updated, and the electronic device only obtains the second key corresponding to the second encryption version, the electronic device cannot decrypt the first configuration item using the second key. Similarly, if the first configuration item has already been encrypted with the updated second encryption version, and the electronic device only obtains the first key corresponding to the first encryption version, it also cannot decrypt the first configuration item. Therefore, in its first state, the electronic device can obtain keys for both versions.

[0064] In other embodiments, at least some configuration items also include a version identifier, which is used to indicate the encrypted version of the current configuration item. Therefore, it is also possible to first obtain the first configuration item and determine the corresponding version identifier based on the encrypted version of the first configuration item. In this way, only one key corresponding to the encrypted version needs to be obtained.

[0065] S204, decrypt the first configuration item based on the first key and the second key to obtain the first configuration data corresponding to the first configuration item, and run the first application based on the first configuration data.

[0066] For example, in some embodiments of this application, the electronic device can decrypt the first configuration item after obtaining the first key and the second key.

[0067] For example, an electronic device can obtain the first configuration data corresponding to the first configuration item by decrypting the first configuration item based on the first key and the second key.

[0068] Decrypt the first configuration item based on the first key or the second key;

[0069] If decryption is successful, the first configuration data will be obtained;

[0070] If decryption fails, the first configuration item will be decrypted again based on the second key or the first key to obtain the first configuration data.

[0071] In other words, the electronic device can first choose any one of the first key and the second key to decrypt the first configuration item. If the decryption is successful, the electronic device can run the first application based on the first configuration data obtained from the decryption.

[0072] For example, if the first configuration item has not been updated with the second encryption version and is still decrypted using the first key, and the electronic device selects the first key to decrypt the first configuration item, then the electronic device can successfully obtain the first configuration data and run the first application. Alternatively, if the first configuration item has been updated with the second encryption version, and the first electronic device happens to select the second key to decrypt the first configuration item, then the electronic device can still successfully decrypt and obtain the first configuration data to run the first application.

[0073] If decryption fails, the electronic device can use another key to decrypt the first configuration item.

[0074] For example, if the first configuration item has not been updated with the second encryption version and is still decrypted using the first key, but the electronic device chooses the second key to decrypt the first configuration item, the electronic device will fail to decrypt it on the first attempt. The electronic device can then use the other key, i.e., the first key, to successfully decrypt the first configuration item and obtain the first configuration data to run the first application. Alternatively, if the first configuration item has been updated with the second encryption version, and the first electronic device chooses the first key to decrypt it on the first attempt, it will also fail to decrypt it on the first attempt. The electronic device can then use the other key, i.e., the second key, to successfully decrypt the first configuration item, obtain the first configuration data, and run the first application.

[0075] Thus, regardless of whether the first configuration item is updated to the second encrypted version, the electronic device can always decrypt the first configuration item and thus run the first application normally.

[0076] With the above solution, the electronic device does not need to pause data usage during the process of updating the encrypted version, and the application can continue to run normally, thereby improving the user experience.

[0077] Below, we will introduce an encryption / decryption system.

[0078] For example, Figure 3 A schematic diagram of an encryption / decryption system is shown according to some embodiments of this application.

[0079] like Figure 3 As shown, the encryption / decryption system includes: a configuration management center (corresponding to a configuration management module) for storing and managing a first configuration file, which includes multiple configuration items for running corresponding applications;

[0080] The encryption / decryption service center (corresponding to the encryption / decryption service module) is used to update at least some of the configuration items in the multiple configuration items corresponding to the first configuration file from the first encrypted version to the second encrypted version, and to store the first key corresponding to the first encrypted version and the second key corresponding to the second encrypted version. In addition, the encryption / decryption service module is also used to send the first key and the second key to the encryption / decryption module when it receives a key acquisition instruction sent by the encryption / decryption module during the update process.

[0081] The encryption / decryption module is used to send a key acquisition instruction to the encryption / decryption service module when it detects that any of the configuration items in at least some of the configuration items have been called, and to decrypt any of the configuration items in at least some of the configuration items based on the first key and the second key returned by the encryption / decryption service module to obtain the corresponding configuration data.

[0082] For example, in some embodiments of this application, the configuration management center of the electronic device is used to manage a first configuration file in the electronic device. The first configuration file includes various configuration items. For at least some configuration items involving sensitive data (e.g., configuration items with strong security risks such as Uniform Resource Locators for database connections, accounts, passwords, and various keys), the configuration management center can call the encryption / decryption service center to encrypt the at least some configuration items. Furthermore, the configuration management center can also call the encryption / decryption service center to update the encrypted version of the at least some configuration items.

[0083] For example, after the configuration management center in the electronic device detects that the administrator has updated at least some configuration items, it can respond to the administrator's operation by calling the encryption and decryption service center to encrypt at least some configuration items based on the first encryption version. The first key corresponding to the first encryption version is stored in the encryption and decryption service center.

[0084] Applications in electronic devices can be configured in a service cluster. Applications in the service cluster can connect to an encryption / decryption module, thereby calling and decrypting the corresponding configuration items through the encryption / decryption module.

[0085] For example, the encryption / decryption center service provides services to the configuration management center and encryption / decryption modules. Encryption schemes can be selected from secure encryption algorithms such as AES and the Chinese national standard SM, balancing performance and security. The service provides functions such as key version acquisition, encryption version update, encryption, and decryption. In some embodiments, token authentication is required to perform the corresponding functions, thereby ensuring security.

[0086] The configuration management center manages the configuration items of all applications. It can enable encryption for application configuration items and provides functions such as one-click encryption, one-click decryption, batch encryption, full encryption, and key version upgrade. The configuration items are stored (encrypted configuration ciphertext storage) and the encryption and decryption center service is invoked for verification.

[0087] The encryption / decryption module is integrated within the application. When the application starts, it can retrieve the token and the encryption / decryption center service domain name from the cluster startup parameters, and then retrieve the key version from the encryption / decryption center service through token verification. After loading the configuration items, the encryption / decryption module decrypts the configuration items using the corresponding version of the key. After successful decryption, the application starts and runs normally.

[0088] For example, when the first application starts, the encryption / decryption module can obtain the signature corresponding to the first application and the domain name of the encryption / decryption service center from the cluster startup parameters. This domain name can, for example, indicate the host that performs encryption services for the corresponding configuration items, so that the encryption / decryption module can obtain the corresponding key from the encryption / decryption service center.

[0089] The server cluster is configured with the domain name and signature verification of the encryption / decryption center service to avoid increasing the risk of signature leakage due to separate storage of configuration by the application. In some embodiments, the service cluster also uses encrypted storage for signature verification to further ensure security. When the application starts, the encryption / decryption module uniformly obtains relevant data (e.g., the domain name of the signature verification encryption / decryption service center) to facilitate configuration retrieval and normal service startup.

[0090] The encryption and decryption service supports various forms of text encryption, including unformatted string encryption, key-value pair encryption (key-value structure) with specified key-value values, single-line data encryption, multi-line data encryption, and file encryption (json, xml, txt, yml, yaml, properties, etc.).

[0091] In some embodiments of this application, at least some configuration items include:

[0092] The second type of configuration item includes a first encryption identifier and a second encryption identifier. The first encryption identifier is used to identify sensitive data, and the second encryption identifier is used to identify custom data.

[0093] In some embodiments of this application, the first type of configuration items corresponding to sensitive data need to be forcibly encrypted. Therefore, before encryption, a first encryption identifier can be added to the first type of configuration items in the first configuration file. The first encryption identifier and the first type of configuration item can be represented by key-value pairs, for example, the key can represent the first encryption identifier and the value can represent a first type of configuration item. It is understood that there are also some second type of configuration items in the first configuration file that are not sensitive data, but the user wants to encrypt this type of data. Therefore, a second encryption identifier can also be added to the second type of configuration items. The second encryption identifier can be the same as the first encryption identifier, and the second encryption identifier and the second type of configuration item can also be represented by a key-value pair structure.

[0094] It is understood that the first type of configuration items and the second type of configuration items mentioned above together constitute at least a portion of the configuration items in the first configuration file.

[0095] In some embodiments of this application, to ensure the security of encryption of at least some configuration items, the electronic device needs to update the key version according to requirements such as a reasonable key lifespan. When the key version is about to expire, it will choose to automatically upgrade the key version or manually confirm the upgrade, depending on the configuration. During the key version upgrade process, the operation of the application in the electronic device will not be affected.

[0096] In some embodiments of this application, detecting an update message that updates at least some of the configuration items among a plurality of configuration items corresponding to the first configuration file from the first encrypted version to the second encrypted version may also involve: in response to the update message, decrypting at least some of the configuration files corresponding to the first encrypted version based on the first key; encrypting the decrypted at least some of the configuration files based on the second encrypted version, and updating the version identifier of at least some of the configuration files from the version identifier corresponding to the first encrypted version to the version identifier corresponding to the second encrypted version.

[0097] For example, since the encrypted versions of at least some configuration items need to be updated periodically, version identifiers need to be added to at least some configuration files to determine the encrypted version of the corresponding configuration file, thereby facilitating the updating of the encrypted version of the configuration file. For instance, during the process of updating some configuration items in the first configuration item from the first encrypted version to the second encrypted version, if the second configuration item is detected to include either the first encryption identifier or the second encryption identifier, it can be determined that the second configuration item needs to be encrypted. If the second configuration item does not have a version identifier, it indicates that the second configuration item is a newly added configuration item that needs to be encrypted, and the second configuration item can be directly encrypted with the second encrypted version, and a version identifier corresponding to the second encrypted version can be added to the second configuration item. If the second configuration item has a version identifier corresponding to the first encrypted version, it is necessary to first decrypt the second configuration item using the first key, and then encrypt the second configuration item using the encryption scheme of the second encrypted version. This completes the update process of the encrypted versions of at least some configuration items.

[0098] In some embodiments of this application, decrypting the first configuration item based on the first key and the second key may also involve: determining the version identifier of the first configuration item, selecting a pair of the first key and the second key to decrypt the first configuration item based on the version identifier of the first configuration item; corresponding to determining that the version identifier of the first configuration item is a first encrypted version, decrypting the first configuration item based on the first key; corresponding to determining that the version identifier of the first configuration item is a second encrypted version, decrypting the first configuration item based on the second key.

[0099] It is understood that in some embodiments of this application, the first configuration item can be obtained first, and then the encrypted version of the first configuration item can be determined according to the version identifier corresponding to the first configuration item. Then, when obtaining the key, the key can be determined according to the encrypted version of the first configuration item.

[0100] For example, if the version identifier of the first configuration item indicates that the first configuration item is encrypted using the encryption scheme of the first encryption version, then the first key can be obtained when obtaining the key.

[0101] If the version identifier of the first configuration item indicates that the first configuration item is encrypted using the encryption scheme of the second encryption version, then the second key can be obtained when obtaining the key.

[0102] In some embodiments of this application, the electronic device transitions from a first state to a second state in response to a message indicating that at least some configuration items have been updated from a first encrypted version to a second encrypted version.

[0103] When the electronic device is in the second state, and it is detected that the second application calls an instruction of at least some of the second configuration items, wherein the second configuration items are used to run the second application;

[0104] Obtain the second configuration item from at least some of the configuration items, and obtain the second key corresponding to the second encrypted version;

[0105] The second configuration data is obtained by decrypting the second configuration item using the second key, and the second application is run based on the second configuration data.

[0106] It is understandable that after the electronic device detects that at least some of the configuration items have been updated from the encrypted version to the second encrypted version, it can transition from the first state to the second state. The second state is the normal state. In the second state, if the electronic device detects that a second application calling the second configuration item has started, the encryption / decryption module can obtain the second key from the encryption / decryption service center, and then decrypt the second configuration item based on the second key to obtain the second configuration data. The encryption / decryption module then sends the second configuration data to the second application to support its operation.

[0107] In other words, if at least some configuration items of the electronic device are not being updated with encrypted versions, the encryption / decryption module only needs to obtain the key corresponding to the current encrypted version from the encryption / decryption service center.

[0108] In some embodiments of this application, detecting an instruction to invoke a first configuration item among at least some configuration items may also involve: detecting that the first configuration item has a first encryption identifier or a second encryption identifier, and determining that the first configuration item is a configuration item among at least some configuration items.

[0109] It is understandable that electronic devices can determine whether a configuration item belongs to at least some configuration items by whether the configuration item in the first configuration file has a first encryption identifier or a second encryption identifier.

[0110] The following describes the process by which an electronic device updates at least some configuration items from a first encrypted version to a second encrypted version.

[0111] For example, Figure 4 According to some embodiments of this application, a schematic diagram of an updated encrypted version is shown.

[0112] like Figure 4As shown, since the encrypted version of electronic devices needs to be updated periodically, a module corresponding to a scheduled task can also be configured in the electronic device. The scheduled task can time the current encrypted version and remind the encryption / decryption service center to update the corresponding key. For example, it can notify the encryption / decryption service center 30 days, 15 days, 10 days, 7 days, 3 days, and 1 day before the current encrypted version expires. The encryption / decryption service center can then generate a new key in advance. For example, it can generate a second key 7 days before the current first encrypted version expires and notify the administrator (e.g., via email, SMS, or other communication methods). After receiving the notification, the administrator can call the encryption / decryption service center's service in the configuration management center to update at least a portion of the configuration files in the first configuration file from the first encrypted version to the second encrypted version. Furthermore, the administrator can manually switch the encryption / decryption service center from the second state to the first state, or the encryption / decryption service center can switch from the second state to the first state after listening for a configuration change event in the configuration management center.

[0113] In the first state, after the application in the service cluster starts, the encryption / decryption module can obtain the corresponding application's signature and the service domain name of the encryption / decryption service center from the startup parameters. Then, the encryption / decryption module can retrieve the key version from the encryption / decryption service center through signature verification. It can be understood that since the encryption / decryption service center is in the first state, i.e., updating the key version, the encryption / decryption module can obtain two versions of the key: the first key and the second key. After obtaining the first and second keys, the encryption / decryption module can decrypt the corresponding configuration items.

[0114] It's understandable that during the process of updating the encrypted versions of at least some configuration items in the configuration management center, the encrypted version of the configuration item obtained by the encryption / decryption module could be either the first encrypted version or the second encrypted version. Therefore, when the encryption / decryption module obtains the key, it can simultaneously obtain the first key for the current encrypted version and the second key corresponding to the next encrypted version. In this way, the encryption / decryption module can complete the decryption process of the corresponding configuration item using either the first key or the second key, thereby ensuring the operation of the application.

[0115] In some embodiments, the encryption / decryption module may store the acquired key in a first storage space (e.g., refer to...). Figure 3 Therefore, the key in the first storage space may become invalid after the encrypted version of the electronic device is updated. The encryption / decryption module can also monitor the status of the configuration management center. After detecting a configuration change event, the encryption / decryption module will no longer retrieve the key from the first storage space, but will instead retrieve two versions of the key from the encryption / decryption service center based on signature verification, etc., in order to decrypt the corresponding configuration items.

[0116] The process of an electronic device transitioning from the second state to the first state is described below.

[0117] For example, Figure 5 According to some embodiments of this application, an interactive flowchart of state transitions of an electronic device is shown.

[0118] like Figure 5 As shown, the process includes:

[0119] S501, the timing module sends a key version expiration reminder to the encryption / decryption service center.

[0120] For example, in some embodiments of this application, since the encrypted version of the electronic device needs to be updated periodically, a timing module corresponding to the scheduled task can also be configured in the electronic device. The timing module can execute the scheduled task, such as timing the current encrypted version and reminding the encryption / decryption service center to update the key corresponding to the encrypted version. For example, it can notify the encryption / decryption service center 30 days, 15 days, 10 days, 7 days, 3 days, and 1 day before the current encrypted version expires.

[0121] In some embodiments, the timing module may also notify the relevant administrators to prepare for an encrypted version update.

[0122] S502, the encryption / decryption service center generates a second key for the second encrypted version.

[0123] For example, in some embodiments of this application, the encryption / decryption service center may generate a new key in advance. For instance, the encryption / decryption service center may generate a second key 7 days before the current first encryption version expires and prepare to update the key version.

[0124] In some embodiments of this application, after the encryption / decryption service center generates the second key, it can notify the relevant administrators to prepare for an encrypted version update, or the encryption / decryption service center can notify the configuration management center to update the encrypted version.

[0125] S503, the configuration management center detected a message indicating an updated encrypted version.

[0126] In some embodiments of this application, after receiving a notification, the administrator can perform corresponding operations in the configuration management center, such as determining to start updating the encrypted version. The configuration management center of the electronic device detects the administrator's operation and then determines that it has detected a message to update the encrypted version. Alternatively, the configuration management center detects a message from the encryption / decryption service center that a second key has been generated and determines that the encrypted version can be updated. In other words, the notification from the encryption / decryption service center to the configuration management center regarding the generation of the second key can serve as a message to update the encrypted version.

[0127] S504, the configuration management center notifies the encryption / decryption service center to enter the first state.

[0128] For example, in some embodiments of this application, after the configuration management center detects a message about an updated encrypted version, it can notify the encryption / decryption service center to enter the first state.

[0129] S505, the encryption / decryption service center has entered the first state.

[0130] For example, after the encryption / decryption service center detects the notification from the configuration management center that it has entered the first state, it enters the first state.

[0131] In some embodiments, administrators can manually operate the configuration management center to update the encrypted version, and administrators can adjust the encryption and decryption service center to enter the first state through the operation interface of the configuration management center. For example, a corresponding true flag can be added to the encryption and decryption service center, which indicates that the encryption and decryption service center has entered the first state.

[0132] For example, when the encryption / decryption service center enters the first state, the encryption / decryption module can obtain the first key corresponding to the current first encryption version and the second key corresponding to the updated second encryption version from the encryption / decryption service center.

[0133] S506, the configuration management center calls the encryption / decryption service center to encrypt at least some configuration items based on the encryption scheme of the second encryption version.

[0134] For example, in some embodiments of this application, after the configuration management center notifies the encryption / decryption service center to enter the first state, it can invoke the encryption service provided by the encryption / decryption service center to update the encryption scheme of at least a portion of the configuration files in the first configuration file from the first encryption version to the second encryption version. For example, the process of updating the encryption version is described in detail below.

[0135] S507, the configuration management center notifies the encryption / decryption service center to complete the encryption version update.

[0136] For example, in some embodiments of this application, after the configuration management center completes the encrypted version update of at least some configuration items, the encrypted version update can be completed through the encryption / decryption service center.

[0137] S508, the encryption / decryption service center has entered the second state.

[0138] For example, after receiving the message from the configuration management center that encryption has been completed, the encryption / decryption service center can enter the second state.

[0139] It is understandable that the encryption / decryption service center can enter the second state, for example, through manual adjustment by administrators. For instance, administrators can change the state flag of the encryption / decryption service center from true to false. False indicates that the encryption / decryption service center is in the second state.

[0140] In other embodiments, the encryption / decryption service center may automatically update from the first state to the second state after receiving the updated encryption version from the configuration management center.

[0141] It is understandable that when the encryption / decryption service center is in the second state, the encryption / decryption module obtains a key from the encryption / decryption service center.

[0142] By using the transition between the second and first states described above, the encryption / decryption service center for electronic devices can ensure that data acquisition is not interrupted during the process of updating the encrypted version of configuration items, thereby improving the user experience and ensuring that the application can run normally.

[0143] The following describes the process by which the first application obtains configuration data.

[0144] For example, Figure 6 According to some embodiments of this application, an implementation flowchart for providing a first configuration item for a first application is shown.

[0145] It is understandable that the following processes are all executed by electronic devices.

[0146] like Figure 6 As shown, the process includes:

[0147] S601, the first application has been detected to be launched.

[0148] For example, in some embodiments of this application, the encryption / decryption module in the electronic device can detect the startup of the first application in the application cluster and prepare the corresponding resources for the startup of the first application, such as the configuration data that the first application needs to load.

[0149] S602, determine whether the first application performs decryption.

[0150] In some embodiments of this application, the encryption / decryption module of the electronic device can determine from the service cluster whether decryption is required upon startup of the first application. For example, the application in the service cluster can be pre-set with a preset flag indicating whether decryption is required upon startup. When the first application starts, the encryption / decryption module can determine from the service cluster whether the preset flag indicates whether decryption is required.

[0151] If the judgment result is yes, then execute S603 to obtain the signature verification and domain name.

[0152] If the judgment result is negative, then execute S615 to load the first configuration item.

[0153] S603, obtain signature verification and domain name.

[0154] In some embodiments of this application, after the encryption / decryption module of the electronic device determines that the configuration items to be loaded by the first application need to be decrypted, it can obtain the signature verification and domain name of the corresponding encryption / decryption service center from the startup parameters of the first application. The signature verification is used by the encryption / decryption service module to obtain the key from the encryption / decryption service center, and the domain name is used by the encryption / decryption module to determine the host of the encryption / decryption service corresponding to the key version.

[0155] S604 is an interface for requesting key versions from the encryption / decryption service center based on signature verification.

[0156] For example, in some embodiments of this application, the encryption / decryption module in an electronic device can request the corresponding key version interface from the encryption / decryption service center based on signature verification.

[0157] S605, the interface for determining whether the key version request was successful.

[0158] For example, in some embodiments of this application, the encryption / decryption module of the electronic device can determine whether it has successfully obtained the interface for the corresponding key version. It is understood that when the encryption / decryption module requests the key version interface from the encryption / decryption service center, it may fail to obtain the key version interface due to network or other reasons (such as interface problems). Therefore, the electronic device needs to determine whether the request for the key version interface was successful.

[0159] If the judgment result is yes, then execute S606 to obtain the key and cache it in the first storage space.

[0160] If the judgment result is negative, then execute S615 to load the first configuration item.

[0161] It is understandable that if the judgment result is negative, it can be determined that the encryption and decryption module of the electronic device has not obtained the key version interface, and therefore cannot obtain the corresponding key through the key version interface. However, the first configuration item corresponding to the first application may not need to be decrypted. Therefore, the encryption and decryption module of the electronic device can directly load the first configuration item corresponding to the first application.

[0162] S606, obtain the key and cache it in the first storage space.

[0163] For example, in some embodiments of this application, the encryption / decryption module of the electronic device can obtain the corresponding key through the interface after obtaining the interface of the corresponding key version, and cache the key in the first storage space.

[0164] It is understandable that if the first electronic device (or encryption / decryption service center) is in the first state, that is, in the state of updating the first encrypted version to the second encrypted version, the encryption / decryption module can obtain the first key corresponding to the current first encrypted version and the second key corresponding to the second encrypted version.

[0165] S607, loading the first configuration item.

[0166] For example, in some embodiments of this application, after the encryption / decryption module of the electronic device obtains the key, it can load the first configuration item corresponding to the first application.

[0167] It is understood that in some other embodiments, the encryption / decryption module of the electronic device can load the first configuration item after detecting that the application has started. The execution order of the various processes is not limited in this embodiment.

[0168] S608 determines whether the first configuration item needs to be decrypted.

[0169] For example, in some embodiments of this application, after the encryption / decryption module of the electronic device obtains the first configuration item, it also needs to determine whether the first configuration item needs to be decrypted. For example, it can be determined by whether the first configuration item has a version identifier, or whether it is a first encryption identifier, a second encryption identifier, etc. That is, it is determined whether the first configuration item belongs to at least some of the configuration items.

[0170] If the judgment result is yes, then execute S609 to decrypt the first configuration item according to the obtained key.

[0171] If the judgment result is negative, then execute S616 to send the first configuration item to the first application.

[0172] S609, decrypt the first configuration item based on the obtained key.

[0173] For example, after the encryption / decryption module of the electronic device obtains the first configuration item, it can decrypt the first configuration item based on the obtained key.

[0174] For example, in the second state, if the encryption / decryption module of the electronic device obtains the first key, it can directly decrypt the first configuration item using the first key.

[0175] In the first state, the encryption / decryption module of the electronic device can obtain the first key and the second key, and then select one of the keys for decryption. If decryption fails, the other key can be selected for decryption. It can be understood that since the first configuration item also has a version identifier (e.g., the version identifier corresponding to the first encrypted version or the version identifier corresponding to the second encrypted version), the encryption / decryption module of the electronic device can also determine the version identifier corresponding to the first configuration item after obtaining it, and then perform decryption using the first key or the second key corresponding to the version identifier.

[0176] S610, determine whether decryption was successful.

[0177] For example, in some embodiments of this application, after the encryption / decryption module of the electronic device decrypts the first configuration item, it can determine whether the decryption was successful.

[0178] If the judgment result is yes, then execute S614 to send the first configuration data corresponding to the first configuration item to the first application.

[0179] If the result is negative, execute S611 to obtain the key again.

[0180] S611, Reacquire the key.

[0181] For example, in some embodiments of this application, if the encryption / decryption module fails to decrypt the first configuration item based on the key for the first time, it can try to obtain the key again for decryption.

[0182] S612, decryption is performed based on the newly acquired key.

[0183] S613, determines whether decryption was successful.

[0184] It is understandable that after the electronic device obtains the key again for decryption, it is still necessary to determine whether the decryption was successful.

[0185] If the judgment result is yes, then execute S614 to send the first configuration data corresponding to the first configuration item to the first application.

[0186] If the judgment result is negative, then execute S616 to send the first configuration item to the first application.

[0187] S614, send the first configuration data corresponding to the first configuration item to the first application.

[0188] For example, in some embodiments of this application, after the encryption / decryption module of the electronic device completes the decryption of the first configuration item and obtains the first configuration data, it can send the first configuration data to the first application to support the startup of the first application.

[0189] S615, loading the first configuration item.

[0190] For example, in some embodiments of this application, if a preset identifier corresponding to the first application indicates that the first application does not need to be decrypted, or the encryption / decryption module of the electronic device fails to request the key version interface, the encryption / decryption module of the electronic device can directly obtain the first configuration item, that is, the first configuration item does not need to be decrypted.

[0191] S616, sends the first configuration item to the first application.

[0192] It is understandable that if the first configuration item does not need to be decrypted, or if decryption of the first configuration item fails, the encryption / decryption module of the electronic device can directly send the first configuration item to the first application, which will then run according to the first configuration item. If the first application runs normally, it means that the first configuration item does not need to be decrypted; if the first application cannot run, it means that there is a problem with the encryption / decryption process of the first configuration item, and an error can be reported for subsequent processing.

[0193] The above decryption process ensures the normal operation of applications on electronic devices and also prevents the leakage of sensitive data in configuration files, thus guaranteeing data security.

[0194] The following describes the encryption process of the encryption / decryption service center.

[0195] For example, Figure 7 According to some embodiments of this application, an encryption process for an encryption / decryption service center is illustrated.

[0196] For example, in some embodiments of this application, the encryption / decryption service center may be configured in the same electronic device as the configuration management center, encryption / decryption module, and service cluster, or the encryption / decryption service center may be configured in a separate electronic device. The execution entities of the following implementation processes are all electronic devices configured with the encryption / decryption service center.

[0197] like Figure 7 As shown, the process includes:

[0198] S701, obtain verification.

[0199] For example, when encrypting each configuration item in the first configuration file in the encryption / decryption service center of the electronic device, a signature verification is required.

[0200] It's understandable that the encryption / decryption service center encrypts the configuration items in the first configuration file by having the configuration backend call the encryption / decryption service center's encryption interface to encrypt the configuration items. Therefore, signature verification is required when calling the interface. For example, a signature can be generated based on parameters such as token, indirect stamp, and source, and the encryption / decryption service center can then authenticate the signature.

[0201] S702, determine whether the signature verification is successful.

[0202] If the judgment result is yes, then execute S703 to parse the data type of the configuration item.

[0203] If the result is negative, the process ends.

[0204] S703, parses the data type of configuration items.

[0205] For example, after the encryption / decryption service center completes the signature verification, it can parse the configuration item data. The configuration item data includes file formats such as yml and txt, which can be directly encrypted. For JSON format configuration items, the JSON needs to be parsed to obtain the individual sub-data, and then each sub-data needs to be encrypted.

[0206] S704 identifies the identifiers of each configuration item.

[0207] For example, after determining the data type of each configuration item, the version identifier, first encryption identifier, and second encryption identifier corresponding to each configuration item can be parsed out.

[0208] S705 determines whether a configuration item belongs to the first category of configuration items.

[0209] For example, in some embodiments of this application, an electronic device can determine whether a configuration item belongs to a first type of configuration item based on whether the configuration item has a first encryption identifier.

[0210] If the result is yes, then execute S707 to determine whether the configuration item has been encrypted.

[0211] If the result is negative, then execute S706 to determine whether the configuration item belongs to the second type of configuration item.

[0212] S706, determine whether the configuration item belongs to the second type of configuration item.

[0213] For example, in some embodiments of this application, an electronic device can determine whether a configuration item belongs to the second type of configuration item based on whether the configuration item has a second encryption identifier.

[0214] If the result is yes, then execute S707 to determine whether the configuration item has been encrypted.

[0215] If the result is negative, the process ends.

[0216] It is understandable that if a configuration item does not have a first encryption identifier or a second encryption identifier, it means that the configuration item is not sensitive data or user-defined encrypted data, and therefore does not need to be encrypted.

[0217] S707 checks whether configuration items have been encrypted.

[0218] For example, an encryption / decryption service center in an electronic device can determine whether a configuration item has been encrypted based on whether the configuration item has a version identifier.

[0219] If the result is yes, then execute S708 to determine whether the key corresponding to the encrypted version of the configuration item exists.

[0220] If the result is negative, then execute S711 to encrypt using the current encryption version.

[0221] S708 checks if the key corresponding to the encrypted version of the configuration item exists.

[0222] If the configuration item has a version identifier, the encryption version corresponding to the configuration item can be determined based on the version identifier, and it can be determined whether the key corresponding to the encryption version exists.

[0223] If the judgment result is yes, then execute S709 and use the corresponding key to decrypt.

[0224] If the judgment result is negative, then S712 is executed. If decryption fails, an exception is reported.

[0225] S709, decrypt using the corresponding key.

[0226] S710, determine whether decryption was successful.

[0227] If the judgment result is yes, then execute S711 to encrypt using the current encryption version.

[0228] If the judgment result is negative, then S712 is executed. If decryption fails, an exception is reported.

[0229] S711, use the current encryption version for encryption.

[0230] For example, if the corresponding configuration item has not been encrypted or the previous encrypted version has been decrypted, the electronic device can encrypt the configuration item with the current encrypted version.

[0231] S712 cannot be decrypted, and an error is reported.

[0232] For example, if the encryption / decryption service center of the electronic device determines that the key corresponding to the encrypted version of the current configuration item does not exist or the current configuration item has not been successfully decrypted, it can report an exception for further processing.

[0233] For example, through the above encryption process, it can be ensured that sensitive data in the configuration files of electronic devices and user-defined encrypted data are in a ciphertext state. Therefore, relatively important information in electronic devices will not be leaked, thereby ensuring data security.

[0234] The electronic devices involved in the above embodiments are described below.

[0235] For example, Figure 8 According to some embodiments of this application, a schematic diagram of the structure of an electronic device 100 is shown.

[0236] The electronic device 100 can be used to implement the encryption and decryption methods provided in the foregoing embodiments.

[0237] like Figure 8 As shown, the electronic device 100 includes one or more processors 101, system memory 102, non-volatile memory (NVM) 103, communication interface 104, input / output device 105, and system control logic 106 for coupling the processor 101, system memory 102, non-volatile memory 103, communication interface 104, and input / output (I / O) device 105. Wherein:

[0238] Processor 101 may include one or more processing units, such as processing modules or circuits that include a central processing unit (CPU), graphics processing unit (GPU), digital signal processor (DSP), microprocessor (MCU), artificial intelligence (AI) processor, field programmable gate array (FPGA), neural network processing unit (NPU), etc., and may include one or more single-core or multi-core processors. In some embodiments, the CPU may be used to optimize a neural network model to be run, and the NPU may be used to run the neural network model to be run.

[0239] System memory 102 is volatile memory, such as random-access memory (RAM), double-data-rate synchronous dynamic random access memory (DDR SDRAM), etc. System memory is used for temporary storage of data and / or instructions. For example, in some embodiments, system memory 102 can be used to store the aforementioned first configuration file, key, etc., or it can be used to store instructions for the encryption and decryption methods provided in the foregoing embodiments.

[0240] The non-volatile memory 103 may include one or more tangible, non-transitory computer-readable media for storing data and / or instructions. In some embodiments, the non-volatile memory 103 may include any suitable non-volatile memory and / or any suitable non-volatile storage device, such as a hard disk drive (HDD), compact disc (CD), digital versatile disc (DVD), solid-state drive (SSD), etc. In some embodiments, the non-volatile memory 103 may also be a removable storage medium, such as a secure digital (SD) memory card. In other embodiments, the non-volatile memory 103 may be used to store instructions for the encryption and decryption methods provided in the foregoing embodiments.

[0241] Specifically, system memory 102 and non-volatile memory 103 may each include a temporary copy and a permanent copy of instruction 107. Instruction 107 may include, when executed by at least one of processors 101, causing electronic device 100 to implement the encryption / decryption methods provided in the embodiments of this application.

[0242] The communication interface 104 may include a transceiver for providing a wired or wireless communication interface for the electronic device 100, thereby enabling communication with any other suitable device via one or more networks. In some embodiments, the communication interface 104 may be integrated into other components of the electronic device 100, for example, the communication interface 104 may be integrated into the processor 101. In some embodiments, the electronic device 100 may communicate with other devices through the communication interface 104, for example, the electronic device 100 may obtain required data from other electronic devices through the communication interface 104.

[0243] Input / output (I / O) device 105 can be an input device such as a keyboard or mouse, and an output device such as a monitor. Users can interact with electronic device 100 through input / output (I / O) device 105.

[0244] System control logic 106 may include any suitable interface controller to provide any suitable interface to other modules of electronic device 100. For example, in some embodiments, system control logic 106 may include one or more memory controllers to provide an interface to system memory 102 and non-volatile memory 103.

[0245] In some embodiments, at least one of the processors 101 may be packaged together with the logic of one or more controllers for system control logic 106 to form a system-in-package (SiP). In other embodiments, at least one of the processors 101 may also be integrated on the same chip with the logic of one or more controllers for system control logic 106 to form a system-on-chip (SoC).

[0246] Understandable. Figure 8 The structure of the electronic device 100 shown is merely an example. In other embodiments, the electronic device 100 may include more or fewer components than illustrated, or combine some components, or split some components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0247] It is understood that electronic device 100 can be any electronic device, including but not limited to mobile phones, tablets, desktops, laptops, handheld computers, notebook computers, ultra-mobile personal computers (UMPCs), netbooks, etc., and this application embodiment does not limit it.

[0248] This application also provides a program product that, when executed on an electronic device, enables the electronic device to implement the methods provided in the foregoing embodiments.

[0249] This application also provides a readable storage medium storing one or more programs, which, when executed by an electronic device, enable the electronic device to implement the methods provided in the foregoing embodiments.

[0250] The various embodiments of the mechanisms disclosed in this application can be implemented in hardware, software, firmware, or a combination of these implementation methods. Embodiments of this application can be implemented as computer programs or program code executable on a programmable system, the programmable system including at least one processor, a storage system (including volatile and non-volatile memory and / or storage elements), at least one input device, and at least one output device.

[0251] Program code can be applied to input instructions to execute the functions described in this application and generate output information. The output information can be applied to one or more output devices in a known manner. For the purposes of this application, the processing system includes any system having a processor such as, for example, a digital signal processor, a microcontroller, an application-specific integrated circuit, or a microprocessor.

[0252] The program code can be implemented using a high-level procedural language or an object-oriented programming language to communicate with the processing system. Assembly language or machine language can also be used when needed. In fact, the mechanisms described in this application are not limited to any particular programming language. In either case, the language can be a compiled language or an interpreted language.

[0253] In some cases, the disclosed embodiments may be implemented in hardware, firmware, software, or any combination thereof. The disclosed embodiments may also be implemented as instructions carried on or stored thereon on one or more transient or non-transitory machine-readable (e.g., computer-readable) storage media, which may be read and executed by one or more processors. For example, the instructions may be distributed via a network or through other computer-readable media. Therefore, machine-readable media can include any mechanism for storing or transmitting information in a machine-readable (e.g., computer-readable) form, including but not limited to floppy disks, optical disks, CD-ROMs, compact disc-read-only memory (CD-ROMs), magneto-optical disks, read-only memory (ROM), random-access memory (RAM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), magnetic cards or optical cards, flash memory, or tangible machine-readable storage for transmitting information (e.g., carrier waves, infrared signals, digital signals, etc.) using the Internet in the form of electrical, optical, acoustic, or other forms of propagation signals. Therefore, machine-readable media includes any type of machine-readable medium suitable for storing or transmitting electronic instructions or information in a machine-readable (e.g., computer-readable) form.

[0254] In the accompanying drawings, some structural or methodological features may be shown in a specific arrangement and / or order. However, it should be understood that such a specific arrangement and / or order may not be necessary. Rather, in some embodiments, these features may be arranged in a manner and / or order different from that shown in the illustrative drawings. Furthermore, the inclusion of structural or methodological features in a particular figure does not imply that such features are required in all embodiments, and in some embodiments, these features may be omitted or may be combined with other features.

[0255] It should be noted that all units / modules mentioned in the device embodiments of this application are logical units / modules. Physically, a logical unit / module can be a physical unit / module, a part of a physical unit / module, or a combination of multiple physical units / modules. The physical implementation of these logical units / modules themselves is not the most important factor; the combination of functions implemented by these logical units / modules is the key to solving the technical problems proposed in this application. Furthermore, to highlight the innovative aspects of this application, the above-described device embodiments of this application have not introduced units / modules that are not closely related to solving the technical problems proposed in this application. This does not mean that the above-described device embodiments do not contain other units / modules.

[0256] It should be noted that in the examples and description of this patent, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one" does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0257] Although this application has been illustrated and described with reference to certain preferred embodiments thereof, those skilled in the art will understand that various changes in form and detail may be made thereto without departing from the scope of this application.

Claims

1. An encryption / decryption method applied to electronic devices, characterized in that, The electronic device is configured with a first configuration file, which includes multiple configuration items. These configuration items are used to run corresponding applications. The method includes: Upon detecting an update message that updates at least some of the configuration items corresponding to the first configuration file from the first encrypted version to the second encrypted version, the electronic device enters the first state. When the electronic device is in the first state, and an instruction to invoke the first configuration item among the at least some configuration items is detected, wherein the first configuration item is used to run the first application; Obtain the first key corresponding to the first encrypted version and the second key corresponding to the second encrypted version; The first configuration item is decrypted based on the first key and the second key to obtain the first configuration data corresponding to the first configuration item, and the first application is run based on the first configuration data; Upon detecting a completion message indicating that at least some configuration items have been updated from a first encrypted version to a second encrypted version, the electronic device transitions from the first state to the second state. When the electronic device is in the second state, and an instruction to invoke the second configuration item among the at least some configuration items is detected, wherein the second configuration item is used to run a second application; Obtain the second key corresponding to the second encrypted version; The second configuration item is decrypted using the second key to obtain the second configuration data, and the second application is run based on the second configuration data; The step of decrypting the first configuration item based on the first key and the second key to obtain the first configuration data corresponding to the first configuration item includes: Determine the version identifier of the first configuration item, and select a pair from the first key and the second key based on the version identifier of the first configuration item to decrypt the first configuration item; Corresponding to determining that the version identifier of the first configuration item is the first encrypted version, the first configuration item is decrypted based on the first key to obtain the first configuration data; Corresponding to determining that the version identifier of the first configuration item is the second encrypted version, the first configuration item is decrypted based on the second key to obtain the first configuration data; Alternatively, the first configuration item can be decrypted based on the first key or the second key; If the decryption is successful, the first configuration data is obtained; If the decryption fails, the first configuration item is re-decrypted based on the second key or the first key to obtain the first configuration data.

2. The method according to claim 1, characterized in that, The at least some configuration items include: a first type of configuration item and a second type of configuration item, wherein the first type of configuration item includes a first encryption identifier, and the second type of configuration item includes a second encryption identifier, wherein the first encryption identifier is used to identify sensitive data, and the second encryption identifier is used to identify custom data.

3. The method according to claim 2, characterized in that, The detected instruction to invoke the first configuration item among the at least some configuration items includes: If the first configuration item is detected to have the first encryption identifier or the second encryption identifier, the first configuration item is determined to be a configuration item among the at least some configuration items.

4. The method according to claim 3, characterized in that, The detection of an update message that updates at least some of the configuration items corresponding to the first configuration file from the first encrypted version to the second encrypted version includes: In response to the update message, at least some of the configuration items corresponding to the first encrypted version are decrypted based on the first key; The decrypted at least some configuration items are encrypted based on the second encryption version, and the version identifier of the at least some configuration items is updated from the version identifier corresponding to the first encryption version to the version identifier corresponding to the second encryption version.

5. An encryption / decryption system, characterized in that, The system includes: A configuration management module is used to store and manage a first configuration file, which includes multiple configuration items, each of which is used to run a corresponding application. An encryption / decryption service module is configured to update at least a portion of the configuration items corresponding to the first configuration file from a first encrypted version to a second encrypted version, and to store a first key corresponding to the first encrypted version and a second key corresponding to the second encrypted version. Furthermore, the encryption / decryption service module is configured to send the first key and the second key to the encryption / decryption module when it receives a key retrieval instruction from the encryption / decryption module during the update process; and to send the second key to the encryption / decryption module when it detects a completion message indicating that at least a portion of the configuration items have been updated from the first encrypted version to the second encrypted version and receives a key retrieval instruction from the encryption / decryption module. An encryption / decryption module is configured to, upon detecting a call to any of the at least some configuration items, send a key acquisition instruction to the encryption / decryption service module and decrypt any of the at least some configuration items based on a first key and a second key returned by the encryption / decryption service module to obtain corresponding configuration data; or decrypt any of the at least some configuration items based on the second key data returned by the encryption / decryption service module to obtain corresponding configuration data. The step of decrypting any one of the at least some configuration items based on the first key and the second key returned by the encryption / decryption service module to obtain the corresponding configuration data includes: Determine the version identifier of any one of the at least some configuration items, and select a pair of the first key and the second key based on the version identifier of any one of the at least some configuration items to decrypt any one of the at least some configuration items; Corresponding to determining the version identifier of any one of the at least some configuration items as the first encrypted version, the configuration item is decrypted based on the first key to obtain the configuration data corresponding to any one of the at least some configuration items; The version identifier of any one of the at least some configuration items is determined to be the second encrypted version. Based on the second key, any one of the at least some configuration items is decrypted to obtain the configuration data corresponding to any one of the at least some configuration items. Alternatively, any one of the at least some configuration items can be decrypted based on the first key or the second key; If the decryption is successful, the configuration data corresponding to any one of the at least some configuration items is obtained; If the decryption fails, then any one of the at least some configuration items is re-decrypted based on the second key or the first key to obtain the configuration data corresponding to any one of the at least some configuration items.

6. An electronic device, characterized in that, include: Memory, used to store instructions; At least one processor is configured to execute the instructions to cause the electronic device to implement the method of any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that, The readable storage medium stores instructions that, when executed on a computer, cause the computer to perform the method of any one of claims 1 to 4.

8. A computer program product, characterized in that, The computer program product stores instructions that, when executed on the device, cause the device to perform the method of any one of claims 1 to 4.

Images