Configuration data processing method, system, equipment and medium

Abstract

The invention provides a configuration file processing method, system, device and medium, the processing method comprises data storage and data reading: the data storage comprises: acquiring initial data, encrypting the initial data by using a symmetric encryption algorithm to obtain encrypted data, the encrypted data being associated with a corresponding key; calculating a first hash value of the encrypted data by using a password hash function algorithm, integrating the first hash value with the encrypted data to obtain storage data, and storing the storage data; the data reading comprises the steps of reading and analyzing data to obtain a first hash value and to-be-verified data; calculating a second hash value of the to-be-verified data by using a password hash function algorithm; and comparing the second hash value with the first hash value to obtain a comparison result, and processing the to-be-verified data based on the comparison result. The security of the configuration data can be improved, and the configuration data is prevented from being tampered or damaged.

Description

Technical Field

[0001] The present invention relates to the technical field of data security storage, and in particular to a configuration data processing method, system, equipment and medium. Background Art

[0002] In the nuclear power digital control system (DCS), configuration data refers to the data set used to define and configure system operating parameters, control logic, equipment status and system behavior. Configuration data plays a vital role in the safe, stable and efficient operation of nuclear power plants. Once the above configuration data is tampered with or destroyed, it will bring serious safety hazards and production risks, and may even cause production interruptions and accidents. At present, the protection of nuclear power instrumentation and control systems for configuration data storage is insufficient and vulnerable to attacks and destruction, so there is room for improvement. Summary of the invention

[0003] In view of the above-mentioned shortcomings of the prior art, an object of the present invention is to provide a method, system, device and medium for processing configuration data, so as to solve the problem that the configuration data storage in the prior art is insufficiently protected and vulnerable to attacks and destruction.

[0004] To achieve the above-mentioned purpose and other related purposes, the present invention provides a method for processing configuration data, characterized in that the processing method includes data storage and data reading:

[0005] The data storage includes:

[0006] Acquire initial data, and encrypt the initial data using a symmetric encryption algorithm to obtain encrypted data, wherein the encrypted data is associated with a corresponding key;

[0007] Calculating a first hash value of the encrypted data using a cryptographic hash function algorithm, integrating the first hash value with the encrypted data to obtain storage data, and storing the storage data;

[0008] The data reading includes:

[0009] Read and parse the data to obtain a first hash value and data to be verified;

[0010] Calculating a second hash value of the data to be verified using a cryptographic hash function algorithm;

[0011] The second Hash value is compared with the first Hash value to obtain a comparison result, and the data to be verified is processed based on the comparison result.

[0012] In one embodiment of the present invention, the step of encrypting the initial data using a symmetric encryption algorithm to obtain encrypted data includes:

[0013] Selecting a data filling mode corresponding to the initial data, and performing data filling on the initial data under the data filling mode to obtain filling data, wherein the amount of the filling data is an integer multiple of the amount of the data block processed by the symmetric encryption algorithm;

[0014] According to the symmetric encryption algorithm, a key and a random initialization vector are generated, and the padding data are encrypted using the key and the initialization vector to obtain encrypted data.

[0015] In one embodiment of the present invention, the step of integrating the first hash value with the encrypted data to obtain storage data includes:

[0016] The first hash value is used to form a file header, and the file header is added to the front end of the encrypted data to obtain storage data.

[0017] In one embodiment of the present invention, the step of forming a file header with the first hash value and adding it to the front end of the encrypted data to obtain the stored data includes:

[0018] Obtaining the encoding format identifier, encryption algorithm identifier, filling method identifier, file format identifier, original file length, and version data associated with the initial data, and recording them as basic data;

[0019] Obtaining the creation time, creator, modification time, and modifier associated with the initial data, and recording them as metadata;

[0020] The first hash value, the basic data and the metadata are integrated to obtain a file header, and the file header is added to the front end of the encrypted data to obtain storage data.

[0021] In one embodiment of the present invention, the step of comparing the second Hash value with the first Hash value to obtain a comparison result includes:

[0022] Determine the second hash value and the first hash value:

[0023] When the second Hash value is the same as the first Hash value, the data to be verified is the same as the encrypted data, and it is determined that the encrypted data has not been tampered with;

[0024] When the second Hash value is different from the first Hash value, the data to be verified is different from the encrypted data, and it is determined that the encrypted data has been tampered with.

[0025] In one embodiment of the present invention, the step of processing the data to be verified based on the comparison result includes:

[0026] When the second Hash value is the same as the first Hash value, decrypting the data to be verified using the key associated with the encrypted data to obtain the initial data;

[0027] When the second Hash value is different from the first Hash value, a warning mark is added to the data to be verified.

[0028] In one embodiment of the present invention, the symmetric encryption algorithm adopts the SM4 block cipher algorithm, and the cryptographic hash function algorithm adopts the third part of the SM3 commercial cryptographic algorithm.

[0029] The present invention also provides a configuration data processing system, the processing system comprising a storage subsystem and a reading subsystem:

[0030] The storage subsystem comprises:

[0031] An acquisition unit, used to acquire initial data, and encrypt the initial data using a symmetric encryption algorithm to obtain encrypted data, wherein the encrypted data is associated with a corresponding key;

[0032] A storage unit, configured to calculate a first hash value of the encrypted data using a cryptographic hash function algorithm, integrate the first hash value with the encrypted data to obtain storage data, and store the storage data;

[0033] The reading subsystem comprises:

[0034] A parsing unit, used for reading and parsing data to obtain a first hash value and data to be verified;

[0035] A calculation unit, used for calculating a second hash value of the data to be verified by using a cryptographic hash function algorithm;

[0036] A processing unit is used to compare the second Hash value with the first Hash value to obtain a comparison result, and process the data to be verified based on the comparison result.

[0037] The present invention further provides an electronic device, comprising:

[0038] one or more processors;

[0039] A storage device is used to store one or more programs. When the one or more programs are executed by the one or more processors, the electronic device implements the configuration data processing method as described in any one of the above items.

[0040] The present invention further provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor of a computer, the computer implements any of the above-mentioned configuration data processing methods.

[0041] As described above, a configuration file processing method, system, device and medium of the present invention can improve the security of configuration data and prevent the configuration data from being tampered with or destroyed. Even if the configuration data is illegally obtained, it can still be presented in ciphertext form, thereby ensuring the confidentiality of the configuration data to a certain extent. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 A schematic diagram of a flow chart of storing configuration data in a configuration data processing method provided by an embodiment of the present invention.

[0043] Figure 2 A schematic diagram of a flow chart of reading configuration data in a configuration data processing method provided by an embodiment of the present invention.

[0044] Figure 3 A schematic diagram of the steps of storing configuration data in a configuration data processing method provided by an embodiment of the present invention.

[0045] Figure 4 A schematic diagram of the steps of reading configuration data in a configuration data processing method provided by an embodiment of the present invention.

[0046] Figure 5 A structural block diagram of a system framework corresponding to a method for processing configuration data provided in an embodiment of the present invention.

[0047] Figure 6 The configuration data provided in an embodiment of the present invention is stored after being encrypted.

[0048] Figure 7 A structural block diagram of a system for processing configuration data provided by an embodiment of the present invention.

[0049] Figure 8 The figure is a schematic diagram of the structure of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0050] The following describes the embodiments of the present invention by specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict.

[0051] It should be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present invention, and thus the drawings only show components related to the present invention rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed arbitrarily, and the component layout may also be more complicated.

[0052] In the following description, numerous details are discussed to provide a more thorough explanation of the embodiments of the present invention. However, it is obvious to those skilled in the art that the embodiments of the present invention can be implemented without these specific details. In other embodiments, well-known structures and devices are shown in the form of block diagrams rather than in detail to avoid making the embodiments of the present invention difficult to understand.

[0053] See also Figures 1 to 8 The present invention proposes a configuration data processing method, system, device and medium, which can be applied to the field of data security storage technology, such as encryption, encoding, parsing and decryption of configuration data about system configuration and parameter settings in a nuclear power digital control system (DCS). The present invention can improve the security of configuration data and prevent configuration data from being tampered with or destroyed. Even if configuration data is illegally obtained, it can still be presented in ciphertext form, thereby ensuring the confidentiality of configuration data to a certain extent. The following is a detailed description through specific embodiments.

[0054] See also Figure 1 and Figure 2 In one embodiment of the present invention, the present invention provides a method for processing configuration data, which may include a method for storing configuration data and a method for extracting configuration data. Figure 1 The corresponding configuration data storage method is Figure 1 The general process may include obtaining initial data, encrypting the initial data, calculating hash values, encoding the data, storing the data, and recording the file path of the stored data. Figure 2 The corresponding method is the extraction method of configuration data. Figure 2 The general process may include finding the file path of the stored data, parsing the stored data, verifying and judging, decrypting the stored data, and restoring the data format to obtain the initial data. Figure 1 , Figure 2 The processing flow in is analyzed in detail.

[0055] See also Figure 3 and Figure 4 In one embodiment of the present invention, a method for processing configuration data is provided, and the processing method includes data storage and data reading. Figure 3 Specifically corresponding to the data storage method of configuration data, it may include the following steps.

[0056] Step S10: Acquire initial data, and encrypt the initial data using a symmetric encryption algorithm to obtain encrypted data, wherein the encrypted data is associated with a corresponding key.

[0057] Step S20: Calculate a first hash value of the encrypted data using a cryptographic hash function algorithm, integrate the first hash value with the encrypted data to obtain storage data, and store the storage data.

[0058] Figure 4 Specifically corresponding to the method for reading configuration data, it may include the following steps.

[0059] Step S30: read and parse the data to obtain a first hash value and data to be verified.

[0060] Step S40: Calculate a second hash value of the data to be verified using a cryptographic hash function algorithm.

[0061] Step S50: compare the second Hash value with the first Hash value to obtain a comparison result, and process the data to be verified based on the comparison result.

[0062] The following is a detailed analysis through specific examples.

[0063] Step S10: Acquire initial data, and encrypt the initial data using a symmetric encryption algorithm to obtain encrypted data, wherein the encrypted data is associated with a corresponding key.

[0064] Specifically, the initial data is obtained, and the initial data is the configuration data that has not been encrypted. The symmetric encryption algorithm uses the same key in encryption and decryption. The symmetric encryption algorithm is usually much faster than the asymmetric encryption algorithm, so it is suitable for encrypting a large amount of data. The initial data is encrypted by the symmetric encryption algorithm to obtain encrypted data 102, and the encrypted data 102 is associated with the corresponding key.

[0065] For example, the symmetric encryption algorithm may be the SM4 block cipher algorithm, which is a commercial encryption standard issued by the China National Cryptography Administration. The SM4 block cipher algorithm is a cryptographic technology independently developed by China to meet domestic information security needs and has been widely used in various scenarios requiring high security.

[0066] Specifically, Figure 5 and Figure 6As shown, the application layer 10 may be responsible for issuing read operations and write operations, and the security layer 20 provides encryption, encoding, parsing and decryption functions to ensure the safe storage of files in the storage layer 30. The storage layer 30 is used to store the encrypted configuration data, wherein the encrypted configuration data is recorded as encrypted data 102.

[0067] Specifically, when the application layer 10 issues a write operation, the configuration data is encrypted to be stored in the storage layer 30. After the application layer 10 issues a write operation, the security layer 20 encrypts the configuration data to obtain encrypted data 102. The security layer 20 also performs an encoding operation on the encrypted data 102, and forms the encrypted data 103 after encoding processing into storage data 100, and then stores the storage data 100 in the storage layer 30.

[0068] Step S20: Calculate a first hash value of the encrypted data using a cryptographic hash function algorithm, integrate the first hash value with the encrypted data to obtain storage data, and store the storage data.

[0069] Specifically, a cryptographic hash function algorithm, also known as a hash function or a hash function, is an algorithm that converts input data of arbitrary length into an output of fixed length (usually called a hash value or digest). The conversion operation corresponding to the cryptographic hash function algorithm is one-way, which means that it is easy to calculate the hash value from the input data, but it is difficult (computationally infeasible) to reverse the original input data from the hash value. The cryptographic hash function algorithm always produces the same hash value for the same input data, and a slight change in the input data will cause a significant change in the output hash value.

[0070] For example, the cryptographic hash function algorithm may be Commercial Cryptography Algorithm Part 3, which is a commercial cryptography standard issued by the China National Cryptography Administration. Commercial Cryptography Algorithm Part 3 is a cryptography technology independently developed by China to meet domestic information security needs and has been widely used in various scenarios requiring high security.

[0071] In this embodiment, the hash value of the encrypted data is calculated using a cryptographic hash function algorithm and recorded as a first hash value, and the first hash value corresponds to the encrypted data. If the encrypted data is illegally tampered with in the subsequent storage process, the hash value corresponding to the tampered encrypted data is different from the first hash value. Therefore, by setting the first hash value, a determination condition can be provided for whether the encrypted data has been illegally tampered with.

[0072] See also Figure 4 and Figure 5 In one embodiment of the present invention, a method for processing configuration data is proposed, which specifically corresponds to a method for reading configuration data and may include the following steps.

[0073] Step S30: read and parse the data to obtain a first hash value and data to be verified.

[0074] Specifically, Figure 5 As shown, the application layer 10 issues a read operation, which corresponds to extracting data from the storage layer 30. The data is a combination of the file header 101 and the encrypted data 102, and the security layer 20 needs to decrypt the encrypted data 102 to obtain the initial data. After that, the security layer 20 passes the initial data to the application layer 10.

[0075] In addition, the data extracted from the storage layer 30 includes a file header 101 and encrypted data 102, but it is unclear whether the encrypted data 102 has been illegally tampered with, so the encrypted data 102 can be recorded as data to be verified.

[0076] In the present application, the configuration data (initial data) is encrypted, encoded, parsed and decrypted by setting the application layer 10, the security layer 20 and the storage layer 30, and the key management system 40 is introduced to realize the unified management of the key. This embodiment not only effectively isolates the direct interaction between the user of the application layer 10 and the data 100 stored in the storage layer 30, but also provides multiple levels of security protection for the entire system. The functions of the application layer 10, the security layer 20 and the storage layer 30 are as follows.

[0077] The security of the application layer 10, the application layer 10 is responsible for initiating read and write operations, and processing file requests through the interface with the security layer 20. This design ensures that users of the application layer 10 can only interact with files in the security layer 20 through the specified interface, effectively preventing illegal operations and attempts to bypass security mechanisms.

[0078] Security layer 20 is powerful. It undertakes encryption, encoding, parsing and decryption tasks, and adopts the unified management of SM4 algorithm and key management system to provide efficient and powerful security protection for files. The application of key management system ensures the reasonable generation, distribution and update of keys, and enhances the robustness of the entire encryption system.

[0079] Security of storage layer 30,Storage layer 30 is responsible for the actual file storage, but since direct interaction is limited to security layer 20, even if illegal visitors directly access storage layer 30, they cannot understand the actual content of the file because they lack the necessary decryption information and knowledge of the file storage format, thereby improving the security of the file.

[0080] Step S40: Calculate a second hash value of the data to be verified using a cryptographic hash function algorithm.

[0081] Specifically, since the conversion operation corresponding to the cryptographic hash function algorithm is one-way, it means that it is easy to calculate the hash value from the input data, but it is difficult (computationally infeasible) to infer the original input data from the hash value. The cryptographic hash function algorithm always produces the same hash value for the same input data, and a slight change in the input data will cause a significant change in the output hash value. Therefore, the cryptographic hash function algorithm is used again to calculate the hash value of the data to be verified, and it is recorded as the second hash value.

[0082] Step S50: compare the second Hash value with the first Hash value to obtain a comparison result, and process the data to be verified based on the comparison result.

[0083] Specifically, if the second hash value is the same as the first hash value, it means that the encrypted data 102 has not been illegally tampered with, and the data to be verified is safe data, that is, the data to be verified is the same as the encrypted data 102, and the data to be verified can be parsed and extracted to obtain the initial data. If the second hash value is different from the first hash value, it means that the encrypted data 102 has been illegally tampered with, that is, the data to be verified is different from the encrypted data 102, even if the data to be verified is parsed and extracted, the initial data cannot be obtained, and the data extracted from the data to be verified may cause harm and attack.

[0084] See also Figure 3 In one embodiment of the present invention, in step S10, the step of obtaining initial data, encrypting the initial data using a symmetric encryption algorithm, and obtaining encrypted data includes the following steps.

[0085] Step S110, selecting a data filling mode corresponding to the initial data, and filling the initial data with data under the data filling mode to obtain filling data, wherein the amount of the filling data is an integer multiple of the amount of data in the data block processed by the symmetric encryption algorithm.

[0086] Specifically, symmetric encryption algorithms process fixed-size data blocks (usually 128 bits), where a data block refers to the basic unit used for data transmission and storage in the fields of computer science and communications. When the amount of the initial data to be encrypted is not an integer multiple of the data block (128 bits), a padding method is required to supplement the initial data so that the amount of the initial data after supplementation is an integer multiple of the data block (128 bits).

[0087] Step S120: Generate a key and a random initialization vector according to the symmetric encryption algorithm, and use the key and the initialization vector to encrypt the padding data to obtain encrypted data.

[0088] Specifically, in the symmetric encryption algorithm, a 128-bit (16-byte) key needs to be generated. This key must be kept confidential and is usually distributed to relevant users or systems in a secure manner in practical applications. Figure 4 As shown, the key can be distributed by the key management system 40. In a symmetric encryption algorithm, in order to increase security, a randomly generated initialization vector (IV) is usually used. The initialization vector does not need to be kept secret, but a different initialization vector (IV) should be used for each encryption.

[0089] Specifically, the encryptor of the symmetric encryption algorithm is initialized with the selected key and initialization vector (IV), and the padding data is encrypted using the encryptor of the symmetric encryption algorithm to obtain the encrypted data 102 .

[0090] See also Figure 3 , Figure 5 and Figure 6 In one embodiment of the present invention, in step S20, the step of integrating the first hash value with the encrypted data to obtain the stored data may include the following steps.

[0091] Step S210: Form a file header with the first hash value, and add the file header to the front end of the encrypted data to obtain stored data.

[0092] Furthermore, in step S210, the first hash value is formed into a file header, and the file header is added to the front end of the encrypted data to obtain a step of storing data, which may include the following steps.

[0093] Step S211, obtain the encoding format identifier, encryption algorithm identifier, filling method identifier, file format identifier, original file length, and version data associated with the initial data, and record them as basic data.

[0094] Step S212: Obtain the creation time, creator, modification time, and modifier associated with the initial data, and record them as metadata.

[0095] Step S213: Integrate the first hash value, basic data and metadata to obtain a file header, and add the file header to the front end of the encrypted data to obtain stored data.

[0096] Specifically, from the above analysis, it can be seen that the first hash value corresponds to the encrypted data, and the encrypted data corresponds to the initial data. Figure 6 As shown, the first hash value, the basic data corresponding to the initial data, and the metadata are integrated to obtain a file header, and the file header contains relevant information of the initial data, thereby providing complete information related to the initial data.

[0097] Specifically, in the stored data, on the one hand, the encrypted data 102 is obtained by encrypting the initial data through a symmetric encryption algorithm, so that the initial data has a certain degree of security. On the other hand, since the encrypted data 102 is calculated under the cryptographic hash function algorithm to obtain the first hash value, the first hash value corresponds to the encrypted data 102, and the first hash value is added to the front end of the encrypted data 102 to obtain the stored data 100. If the encrypted data 102 in the stored data 100 is illegally tampered with during the subsequent storage and call process of the stored data, the hash value corresponding to the illegally tampered encrypted data 102 will change.

[0098] It can be seen that the symmetric encryption algorithm encrypts the initial data to increase the security of the initial data, and the cryptographic hash function algorithm performs hash calculation on the encrypted data 102 to identify whether the encrypted data 102 has been illegally tampered with. In the case that the encrypted data 102 has been illegally tampered with, corresponding processing measures can be taken to avoid using the illegally tampered data, thereby effectively preventing malicious attacks.

[0099] In the present application, the confidentiality of the configuration data (initial data) is improved. By encrypting and encoding the configuration data, even if an unauthorized person obtains the data, only the encrypted data 102 can be obtained, and it is difficult to decrypt the configuration data, thereby ensuring the confidentiality of the configuration data. The integrity of the configuration data is guaranteed, and the encrypted data 102 is verified using the SM3 hash value in the file header 101 to ensure that the configuration data has not been tampered with or damaged during storage and transmission, thereby improving the integrity of the configuration data. The difficulty of parsing the configuration data is increased. If an unauthorized user does not understand the storage format of the storage data 100, it will be difficult to parse the encrypted data 102 in the storage data 100, thereby increasing the difficulty of decrypting the configuration data and improving the security of the configuration data.

[0100] See also Figure 4 , Figure 5 and Figure 6 In one embodiment of the present invention, in step S50, the step of comparing the second Hash value with the first Hash value to obtain a comparison result includes the following steps.

[0101] Step S501: When the second Hash value is the same as the first Hash value, the data to be verified is the same as the encrypted data, and it is determined that the encrypted data has not been tampered with.

[0102] Step S502: When the second Hash value is different from the first Hash value, the data to be verified is different from the encrypted data, and it is determined that the encrypted data has been tampered with.

[0103] See also Figure 4 , Figure 5 and Figure 6In one embodiment of the present invention, in step S300, the step of processing the data to be verified based on the comparison result includes the following steps.

[0104] Step S511: When the second Hash value is the same as the first Hash value, the data to be verified is decrypted using the secret key associated with the encrypted data to obtain the initial data.

[0105] Step S521: When the second Hash value is different from the first Hash value, an alarm process is performed on the data to be verified to generate corresponding alarm data.

[0106] Specifically, when the encrypted data 102 has not been illegally tampered with, the data to be verified is safe data, and the key associated with the encrypted data can be used to decrypt the data to be verified, thereby obtaining the initial data. When the encrypted data 102 has been illegally tampered with, the data to be verified is marked as an alarm, and corresponding alarm data can be generated.

[0107] See also Figure 7 In one embodiment of the present invention, a configuration data processing system 1000 is proposed, which may include a storage subsystem 1001 and a reading subsystem 1002. The storage subsystem 1001 may include an acquisition unit 110 and a storage unit 120, and the reading subsystem 1002 may include a parsing unit 130, a computing unit 140 and a processing unit 150.

[0108] The acquisition unit 110 is used to acquire initial data, and encrypt the initial data using a symmetric encryption algorithm to obtain encrypted data, wherein the encrypted data is associated with a corresponding key.

[0109] The storage unit 120 is used to calculate a first hash value of the encrypted data using a cryptographic hash function algorithm, integrate the first hash value with the encrypted data to obtain storage data, and store the storage data.

[0110] The parsing unit 130 is used to read and parse data to obtain a first hash value and data to be verified.

[0111] The calculation unit 140 is used to calculate a second hash value of the data to be verified by using a cryptographic hash function algorithm.

[0112] The processing unit 150 is configured to compare the second Hash value with the first Hash value to obtain a comparison result, and process the data to be verified based on the comparison result.

[0113] See also Figure 8 In one embodiment of the present invention, the electronic device 1 may include a memory 12, a processor 13 and a bus, and may also include a computer program stored in the memory 12 and executable on the processor 13, such as a configuration file processing program.

[0114] Among them, the memory 12 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, mobile hard disk, multimedia card, card-type memory (for example: SD or DX memory, etc.), magnetic memory, disk, optical disk, etc. The memory 12 can be an internal storage unit of the electronic device 1 in some embodiments, such as a mobile hard disk of the electronic device 1. The memory 12 can also be an external storage device of the electronic device 1 in other embodiments, such as a plug-in mobile hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the electronic device 1. Further, the memory 12 can also include both an internal storage unit of the electronic device 1 and an external storage device. The memory 12 can not only be used to store application software and various types of data installed in the electronic device 1, such as the code for processing configuration files, etc., but also can be used to temporarily store data that has been output or is to be output.

[0115] In some embodiments, the processor 13 may be composed of an integrated circuit, for example, a single packaged integrated circuit, or a plurality of packaged integrated circuits with the same or different functions, including one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and combinations of various control chips. The processor 13 is the control core (Control Unit) of the electronic device 1, and uses various interfaces and lines to connect various components of the entire electronic device 1, and executes or executes programs or modules (such as configuration file processing programs, etc.) stored in the memory 12, and calls data stored in the memory 12 to execute various functions of the electronic device 1 and process data.

[0116] The processor 13 executes the operating system and various installed application programs of the electronic device 1. The processor 13 executes the application programs to implement the steps in the above configuration file processing method.

[0117] Exemplarily, the computer program may be divided into one or more modules, which are stored in the memory 12 and executed by the processor 13 to complete the present application. The one or more modules may be a series of computer program instruction segments capable of completing specific functions, which are used to describe the execution process of the computer program in the electronic device 1. For example, the computer program may be divided into an acquisition unit 110, a calculation unit 120, an integration unit 130, and a generation unit 140.

[0118] The above-mentioned integrated unit implemented in the form of a software function module can be stored in a computer-readable storage medium, and the computer-readable storage medium can be non-volatile or volatile. The above-mentioned software function module is stored in a storage medium, including several instructions for enabling a computer device (which can be a personal computer, a computer device, or a network device, etc.) or a processor to perform part of the functions of the configuration file processing method described in each embodiment of the present application.

[0119] In summary, the configuration file processing method, system, device and medium disclosed in the present invention can improve the security of configuration data, prevent configuration data from being tampered with or destroyed, and even if the configuration data is illegally obtained, it can still be presented in a ciphertext form, thereby ensuring the confidentiality of the configuration data to a certain extent. Therefore, the present invention effectively overcomes various shortcomings in the prior art and has a high industrial utilization value.

[0120] The above embodiments are merely illustrative of the principles and effects of the present invention, and are not intended to limit the present invention. Anyone familiar with the art may modify or alter the above embodiments without departing from the spirit and scope of the present invention. Therefore, all equivalent modifications or alterations made by a person of ordinary skill in the art without departing from the spirit and technical concept disclosed by the present invention shall still be covered by the claims of the present invention.

Claims

1. A method for processing configuration data, characterized in that: The processing method includes data storage and data reading: The data storage includes: Acquire initial data, and encrypt the initial data using a symmetric encryption algorithm to obtain encrypted data, wherein the encrypted data is associated with a corresponding key; Calculating a first hash value of the encrypted data using a cryptographic hash function algorithm, integrating the first hash value with the encrypted data to obtain storage data, and storing the storage data; The data reading includes: Read and parse the data to obtain a first hash value and data to be verified; Calculating a second hash value of the data to be verified using a cryptographic hash function algorithm; The second Hash value is compared with the first Hash value to obtain a comparison result, and the data to be verified is processed based on the comparison result.

2. The method for processing configuration data according to claim 1, characterized in that: The step of encrypting the initial data using a symmetric encryption algorithm to obtain encrypted data includes: Selecting a data filling mode corresponding to the initial data, and performing data filling on the initial data under the data filling mode to obtain filling data, wherein the amount of the filling data is an integer multiple of the amount of the data block processed by the symmetric encryption algorithm; According to the symmetric encryption algorithm, a key and a random initialization vector are generated, and the padding data are encrypted using the key and the initialization vector to obtain encrypted data.

3. The method for processing configuration data according to claim 1, characterized in that: The step of integrating the first hash value with the encrypted data to obtain storage data includes: The first hash value is used to form a file header, and the file header is added to the front end of the encrypted data to obtain storage data.

4. The method for processing configuration data according to claim 1, characterized in that: The step of forming a file header with the first hash value and adding it to the front end of the encrypted data to obtain the stored data includes: Obtaining the encoding format identifier, encryption algorithm identifier, filling method identifier, file format identifier, original file length, and version data associated with the initial data, and recording them as basic data; Obtaining the creation time, creator, modification time, and modifier associated with the initial data, and recording them as metadata; The first hash value, the basic data and the metadata are integrated to obtain a file header, and the file header is added to the front end of the encrypted data to obtain storage data.

5. The method for processing configuration data according to claim 1, characterized in that: The step of comparing the second Hash value with the first Hash value to obtain a comparison result includes: Determine the second hash value and the first hash value: When the second Hash value is the same as the first Hash value, the data to be verified is the same as the encrypted data, and it is determined that the encrypted data has not been tampered with; When the second Hash value is different from the first Hash value, the data to be verified is different from the encrypted data, and it is determined that the encrypted data has been tampered with.

6. The method for processing configuration data according to claim 5, characterized in that: The step of processing the data to be verified based on the comparison result includes: When the second Hash value is the same as the first Hash value, decrypting the data to be verified using the key associated with the encrypted data to obtain the initial data; When the second Hash value is different from the first Hash value, a warning mark is added to the data to be verified.

7. The method for processing configuration data according to claim 1, characterized in that: The symmetric encryption algorithm adopts the SM4 block cipher algorithm, and the cryptographic hash function algorithm adopts the third part of the SM3 commercial cryptographic algorithm.

8. A configuration data processing system, characterized in that: The processing system includes a storage subsystem and a reading subsystem: The storage subsystem comprises: An acquisition unit, used to acquire initial data, and encrypt the initial data using a symmetric encryption algorithm to obtain encrypted data, wherein the encrypted data is associated with a corresponding key; A storage unit, configured to calculate a first hash value of the encrypted data using a cryptographic hash function algorithm, integrate the first hash value with the encrypted data to obtain storage data, and store the storage data; The reading subsystem comprises: A parsing unit, used for reading and parsing data to obtain a first hash value and data to be verified; A calculation unit, used for calculating a second hash value of the data to be verified by using a cryptographic hash function algorithm; A processing unit is used to compare the second Hash value with the first Hash value to obtain a comparison result, and process the data to be verified based on the comparison result.

9. An electronic device, characterized in that: The electronic device comprises: one or more processors; A storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, enables the electronic device to implement the configuration data processing method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed by a processor of a computer, the computer is caused to execute the method for processing configuration data as claimed in any one of claims 1 to 7.

Images