Encryption method and decryption method of trusted identity information, equipment and medium

Abstract

The embodiment of the invention discloses a trusted identity information encryption method, decryption method, equipment and medium, and the method comprises the steps: triggering an encryption event, obtaining encryption application information and trusted identity information, generating a file identifier and a plaintext check code of the trusted identity information, and sending the file identifier and the plaintext check code to a server; combining the file identifier, the plaintext check code and the encryption application information to obtain file information and generate a file check code, sending the file identifier and the plaintext check code to each secret key application address corresponding to a secret key address list in the encryption application information to generate and feed back encryption secret keys, receiving each encryption secret key, and sending the encryption secret keys to the file information; and according to the sequence of the key application addresses, encrypting the credible identity information and the file check code based on the corresponding encryption keys in sequence to obtain encrypted content data, and combining the encrypted content data with the file information to obtain an interactive file. According to the scheme, the credibility of the personal identity information can be improved, the transmission security of the personal identity information in the Internet is improved, the personal identity information is prevented from being abused, and data leakage is prevented.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer technology, and in particular to an encryption method, a decryption method, a device, and a medium for trusted identity information. Background Art

[0002] With the development of science and technology, smart terminal devices have become the main carrier of daily life. In most cases, people do not carry their ID cards. On the one hand, there are security risks, and on the other hand, it is not conducive to the convenience of travel. Once the physical ID card is lost, there will be high information security and personal property risks. As a result, the electronic ID card came into being. The electronic ID card is also called electronic certificate, network ID card, network identity authentication, network certificate, network ID number, network number, virtual ID card, identity authentication, CTID, eID, PID, etc. It solves the disadvantages of carrying physical certificates when going out, but how to ensure the legitimacy of the data of the electronic certificate and how to recognize each other after intercommunication needs to be solved urgently.

[0003] The current electronic ID card technology uses QR codes or NFC as media to resolve the corresponding personal identity, but there is no good solution or identification method to determine whether the data is legal in different provinces and regions, between different departments, and whether the data transmission process will be tampered with. With the increasing popularity of electronic ID cards, the scenarios and frequency of use have reached a very large order of magnitude, and the above problems need to be solved urgently. Summary of the invention

[0004] The embodiments of the present application provide an encryption method, a decryption method, a device and a medium for trusted identity information to solve the problems of the lack of legitimacy of electronic certificates in different regions and departments, the easy tampering of the data transmission process, and mutual recognition after intercommunication. It can improve the credibility of personal identity information, improve the security of its transmission on the Internet, prevent the abuse of personal identity information, and prevent data leakage.

[0005] In a first aspect, an embodiment of the present application provides a method for encrypting trusted identity information, including:

[0006] When an encryption event is triggered, encryption application information and trusted identity information to be encrypted are obtained, wherein the encryption application information includes a key address list, and the key address list includes at least two key application addresses recorded in order;

[0007] Generate a file identifier and a plaintext verification code for the trusted identity information;

[0008] Combining the file identifier, the plain text verification code and the encrypted application information to obtain file information, and generating a file verification code for the file information;

[0009] Sending the file identifier and the plaintext verification code to the key party device corresponding to each key application address, so that the key party device generates an encryption key associated with the file identifier and the plaintext verification code and provides feedback, wherein different encryption keys generated by different key party devices are different;

[0010] receiving the encryption keys fed back by the key party devices, and encrypting the trusted identity information and the file verification code based on the corresponding encryption keys in order of the key application addresses recorded in the key address list to obtain encrypted content data;

[0011] The encrypted content data is combined with the file information to obtain an interactive file.

[0012] Optionally, before obtaining the encryption application information and the trusted identity information to be encrypted, the process further includes:

[0013] Sending an encrypted application information acquisition request to a server, so that the server can feed back the encrypted application information, where the encrypted application information is configured by the server;

[0014] The encrypted application information sent by the server is received and stored.

[0015] Optionally, the generating of the file identifier and the plain text verification code of the trusted identity information includes:

[0016] Obtaining the file identification of the trusted identity information randomly or by applying to an external device;

[0017] Performing computation on the trusted identity information based on a set first verification code generation algorithm to obtain a plaintext verification code;

[0018] The step of generating a file verification code for the file information includes:

[0019] The file information is processed based on a set second verification code generation algorithm to obtain a file verification code.

[0020] Optionally, when sending the file identifier and the plain text verification code to the key party device corresponding to each key application address, it also includes:

[0021] Synchronously sending the set version number to the key party device corresponding to each of the key application addresses;

[0022] Correspondingly, the key party device generates an encryption key associated with the file identifier and the plaintext verification code, including:

[0023] The key party device determines an encryption algorithm corresponding to the version number, and generates an encryption key associated with the file identifier and the plaintext check code based on the encryption algorithm;

[0024] Correspondingly, the file information also includes the version number.

[0025] Optionally, when sending the file identifier and the plain text verification code to the key party device corresponding to each key application address, it also includes:

[0026] Synchronously sending the ID verification information to the key party device corresponding to each of the key application addresses;

[0027] Accordingly, the generating of the encryption key associated with the file identifier and the plaintext verification code includes:

[0028] When the ID verification information is verified successfully, an encryption key associated with the file identifier and the plain text verification code is generated.

[0029] Optionally, the file information includes any one or more of a version number, a file identifier, a plain text check code, a key address list, a storage mode, a storage address list, a log mode, a log address list, and retrieval information.

[0030] Optionally, the encryption application information further includes a storage mode and a storage address list, and after the encrypted content data is combined with the file information to obtain the interactive file, it further includes:

[0031] When the storage mode is distributed storage, the interaction file is sent to each device recorded in the storage address list for storage.

[0032] Optionally, the encryption application information further includes a log mode and a log address list, and after the encrypted content data is combined with the file information to obtain the interactive file, it further includes:

[0033] generating a log record based on the encryption date of the trusted identity information and the associated information data, the information data including any one or more of a version number, ID verification information, the file identifier, the plaintext checksum, the storage mode, the storage address list, the log mode, the log address list, the key address list, and the retrieval information;

[0034] When the log mode is distributed storage, the log record is sent to each device recorded in the log address list for storage.

[0035] Optionally, the retrieval information includes any one or more of copyright information, creation time information, project information, regional information, department information, desensitized personal identity information, and custom information.

[0036] In a second aspect, the embodiment of the present application further provides a method for decrypting trusted identity information, including:

[0037] When a decryption event is triggered, the interactive file to be decrypted is obtained, and the interactive file is parsed to obtain encrypted content data and file information, wherein the file information includes a file identifier, a plaintext checksum, and a key address list, wherein the key address list includes at least two key application addresses recorded in order;

[0038] Sending the file identifier and the plaintext verification code to the key party device corresponding to each of the key application addresses, so that the key party device feeds back a decryption key associated with the file identifier and the plaintext verification code;

[0039] Receive the decryption key fed back by each of the key party devices, and decrypt the encrypted content data in reverse order based on the corresponding decryption key according to the order of the key application addresses recorded in the key address list to obtain decrypted content data, wherein the decrypted content data includes trusted identity information and a file verification code.

[0040] Optionally, the decrypted content data further includes a first encryption verification code, and after obtaining the decrypted content data, the following further includes:

[0041] Calculating a second encrypted verification code of the trusted identity information and the file verification code;

[0042] When the first encryption verification code is inconsistent with the second encryption verification code, decryption error information is generated.

[0043] Optionally, the decrypted content data further includes a first file verification code, and when the first encryption verification code is consistent with the second encryption verification code, the method further includes:

[0044] Calculating a second file verification code of the file information;

[0045] When the first file verification code is inconsistent with the second file verification code, decryption error information is generated.

[0046] Optionally, when the first file verification code is consistent with the second file verification code, the method further includes:

[0047] Calculating a second plaintext verification code of the trusted identity information;

[0048] If the plaintext verification code in the file information is inconsistent with the second plaintext verification code, generating a decryption error message;

[0049] When the plaintext verification code in the file information is consistent with the second plaintext verification code, the trusted identity information is fed back.

[0050] Optionally, when the plaintext verification code in the file information is consistent with the second plaintext verification code, the method further includes:

[0051] Generate a log record based on the decryption date of the trusted identity information and the associated information data, wherein the information data includes any one or more of a file identifier, a plain text checksum, a key address list, a storage mode, a storage address list, a log mode, a log address list, and retrieval information;

[0052] When the log mode is distributed storage, the log record is sent to each device recorded in the log address list for storage.

[0053] Optionally, obtaining the interactive file to be decrypted includes:

[0054] In the case where the decryption instruction generated when the decryption event is triggered is a fileless decryption instruction, obtaining first file information currently associated with the fileless decryption instruction, the first file information including a first file identifier and a first plaintext check code;

[0055] Sending the first file identifier and the first plaintext verification code to each storage device, and selecting any device storing the corresponding interactive file from among the storage devices to perform feedback of the interactive file;

[0056] Receive feedback on the interaction document.

[0057] In a third aspect, an embodiment of the present application further provides a device for encrypting trusted identity information, including:

[0058] A communication module, used for obtaining encryption application information and trusted identity information to be encrypted when an encryption event is triggered, wherein the encryption application information includes a key address list, and the key address list includes at least two key application addresses recorded in order;

[0059] A data encryption module, used to generate a file identifier and a plaintext verification code of the trusted identity information, combine the file identifier, the plaintext verification code and the encryption application information to obtain file information, and generate a file verification code for the file information;

[0060] The communication module is further used to send the file identifier and the plaintext verification code to the key party device corresponding to each of the key application addresses, so that the key party device generates an encryption key associated with the file identifier and the plaintext verification code and provides feedback, wherein different encryption keys generated by different key party devices are different;

[0061] The communication module is further used to receive encryption keys fed back by each of the key party devices;

[0062] The data encryption module is also used to encrypt the trusted identity information and the file verification code based on the corresponding encryption keys in the order of the key application addresses recorded in the key address list to obtain encrypted content data, and combine the encrypted content data with the file information to obtain an interactive file.

[0063] In a fourth aspect, an embodiment of the present application further provides a decryption device for trusted identity information, including:

[0064] The communication module is used to obtain the interactive file to be decrypted when a decryption event is triggered;

[0065] A data decryption module, used to parse the interactive file to obtain encrypted content data and file information, wherein the file information includes a file identifier, a plain text check code, and a key address list, wherein the key address list includes at least two key application addresses recorded in order;

[0066] The communication module is further used to send the file identifier and the plaintext verification code to the key party device corresponding to each of the key application addresses, so that the key party device feeds back a decryption key associated with the file identifier and the plaintext verification code;

[0067] The communication module is further used to receive the decryption key fed back by each of the key party devices;

[0068] The data decryption module is further used to decrypt the encrypted content data based on the corresponding decryption key in reverse order according to the order of the key application addresses recorded in the key address list to obtain decrypted content data, wherein the decrypted content data includes trusted identity information.

[0069] In a fifth aspect, an embodiment of the present application further provides a trusted identity information encryption and decryption device, the device comprising:

[0070] one or more processors;

[0071] a storage device for storing one or more programs,

[0072] When the one or more programs are executed by the one or more processors, the one or more processors implement the encryption method or decryption method of the trusted identity information described in the embodiments of the present application.

[0073] In a fourth aspect, an embodiment of the present application further provides a storage medium storing computer executable instructions, wherein the computer executable instructions, when executed by a computer processor, are used to execute the encryption method or decryption method of the trusted identity information described in the embodiment of the present application.

[0074] In the embodiment of the present application, when an encryption event is triggered, the encryption application information and the trusted identity information to be encrypted are obtained, the encryption application information includes a key address list, the key address list includes at least two key application addresses recorded in order, the file identifier and the plaintext verification code of the trusted identity information are generated, the file identifier, the plaintext verification code and the encryption application information are combined to obtain the file information, and the file verification code of the file information is generated, the file identifier and the plaintext verification code are sent to the key party device corresponding to each key application address, and the key party device generates an encryption key associated with the file identifier and the plaintext verification code and feedbacks it, wherein different key party devices generate different encryption keys, receive the encryption keys fed back by each key party device, and encrypt the trusted identity information and the file verification code based on the corresponding encryption key in sequence according to the order of the key application addresses recorded in the key address list to obtain encrypted content data, and combine the encrypted content data with the file information to obtain an interactive file. This solution solves the problem that electronic certificates are not legitimate in different regions and departments, the data transmission process is easily tampered with, and how to recognize each other after intercommunication, and can improve the credibility of personal identity information, improve the security of its transmission on the Internet, prevent the abuse of personal identity information, and prevent data leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] Figure 1 A flowchart of a method for encrypting trusted identity information provided in an embodiment of the present application;

[0076] Figure 2 A flowchart of another method for encrypting trusted identity information provided in an embodiment of the present application;

[0077] Figure 3 A flowchart of another method for encrypting trusted identity information provided in an embodiment of the present application;

[0078] Figure 4 A flowchart of another method for encrypting trusted identity information provided in an embodiment of the present application;

[0079] Figure 5 A flowchart of a method for decrypting trusted identity information provided in an embodiment of the present application;

[0080] Figure 6 A flowchart of another method for decrypting trusted identity information provided in an embodiment of the present application;

[0081] Figure 7 A flowchart of another method for decrypting trusted identity information provided in an embodiment of the present application;

[0082] Figure 8 A block diagram of the module structure of a device for encrypting trusted identity information provided in an embodiment of the present application;

[0083] Fig. 9 A module structure block diagram of a decryption device for trusted identity information provided in an embodiment of the present application;

[0084] Fig.10 A schematic diagram of the structure of a trusted identity information encryption and decryption device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0085] The embodiments of the present application are further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the embodiments of the present application, rather than to limit the embodiments of the present application. It should also be noted that, for ease of description, only parts related to the embodiments of the present application are shown in the accompanying drawings, rather than all structures.

[0086] The terms "first", "second", etc. in the specification and claims of this application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character "or" generally indicates that the objects associated before and after are in an "or" relationship.

[0087] The embodiments of the present application provide an encryption method and a decryption method for trusted identity information, which can be applied to electronic certificate readers (electronic ID cards, electronic medical insurance cards, electronic academic certificates, electronic driver's licenses, electronic vehicle registration certificates, electronic birth certificates, electronic marriage certificates, electronic real estate certificates, etc.), self-service terminals, smart ATMs, smart access control systems, smart robots, smart panel machines, handheld devices, mobile phones, tablets, and other devices that require the use of electronic certificates.

[0088] Figure 1 A flowchart of a method for encrypting trusted identity information provided in an embodiment of the present application, such as Figure 1 As shown, specifically including:

[0089] Step S101: when an encryption event is triggered, encryption application information and trusted identity information to be encrypted are obtained, wherein the encryption application information includes a key address list, and the key address list includes at least two key application addresses recorded in order.

[0090] Among them, the encryption event is used to represent the event that the user authorizes the encryption of the physical certificate. For example, the user places the physical certificate on the sensing area of ​​the certificate reading module of the device, and the control module of the device controls the certificate reading module to read the information of the physical certificate. The user reads the consultation and authorization agreement related to the certificate encryption on the device, and clicks the "I know and agree to the authorization" button to complete the authorization of the physical certificate encryption. Before the encryption event is triggered, it is necessary to take a picture of the user's face and / or collect the user's fingerprint for person-to-person verification to ensure the credibility and legitimacy of the identity information. After the encryption event is triggered, the encryption application information and the trusted identity information to be encrypted can be automatically obtained. The encryption application information can be related data information for applying for an encryption key. The encryption application information may include a key address list, which is used to represent a list of at least two ordered key application addresses, and the key application address is used to represent the address of the key party that receives the key application and generates the key. The trusted identity information is used to represent the relevant information of the physical certificate authorized by the user for encryption, and may include any one or more of the information such as name, ID number, gender, ethnicity, date of birth, address, photo, fingerprint, issuing authority, validity period, telephone number, and education. In one embodiment, a storage method of encrypted application information may be to obtain encrypted application information stored in a storage area, where the encrypted application information is pre-entered by a staff member and stored in the storage area. Optionally, a storage method of encrypted application information may be to send an encrypted application information acquisition request to a server before obtaining the encrypted application information and the trusted identity information to be encrypted, so that the server feeds back the encrypted application information, where the encrypted application information is configured by the server, receives the encrypted application information sent by the server, and stores it.

[0091] Step S102: Generate a file identifier and a plaintext verification code for the trusted identity information, combine the file identifier, the plaintext verification code and the encrypted application information to obtain file information, and generate a file verification code for the file information.

[0092] Among them, the file identifier is a globally unique file identifier of the trusted identity information. The file identifier can be used to perform related information retrieval, log management, file management and other operations. The plaintext check code is used to represent the check code obtained by calculating the trusted certificate information. Since personal identity information is prohibited from being transmitted over the network, the check code (i.e., the plaintext check code) obtained by calculating the personal identity information is desensitized information, and the plaintext check code can be used to determine whether the decrypted trusted certificate information is correct to prevent data counterfeiting attacks by others. The file identifier, the plaintext check code and the obtained encrypted application information are combined to obtain the file information and generate the file check code of the file information. The file check code is used to represent the check code obtained by calculating the file information. The file check code can be used to check whether the file information has been tampered with.

[0093] In one embodiment, a method for generating a file identifier of trusted identity information may be to randomly select a unique identifier from a pre-stored unique identifier list to determine it as the file identifier of the trusted identity information, and the unique identifier list includes multiple different unique identifiers. Optionally, a method for generating a file identifier of trusted identity information and a plaintext verification code may be to obtain the file identifier of the trusted identity information randomly or by applying to an external device, and to obtain the plaintext verification code by performing calculation processing on the trusted identity information based on a set first verification code generation algorithm. A method for generating a file verification code of file information may be to obtain the file verification code by performing calculation processing on the file information based on a set second verification code generation algorithm. By generating the file identifier of the trusted identity information, the plaintext verification code, and the file verification code of the file information, the security of the trusted identity information is improved.

[0094] Step S103: Send the file identifier and the plaintext verification code to the key party device corresponding to each key application address, so that the key party device generates an encryption key associated with the file identifier and the plaintext verification code and provides feedback, wherein different encryption keys generated by different key party devices are different.

[0095] Among them, the key party device is used to represent a device that receives a key application request and generates a key. The key party device can generate an encryption key associated with the received file identifier and plaintext check code and provide feedback. An encryption key is a set of characters or numbers used to encrypt data in cryptography, and is a variable data that is fed into an encryption algorithm as input to perform encryption operations. In one embodiment, a method for generating an encryption key can be that while sending the file identifier and the plaintext check code to the key party device corresponding to each key application address, the set version number is synchronously sent to the key party device corresponding to each key application address, the key party device determines the encryption algorithm corresponding to the version number, and generates an encryption key associated with the file identifier and the plaintext check code based on the encryption algorithm. Correspondingly, the file information also includes a version number. Determining the encryption algorithm by the version number can prevent the use of an incorrect algorithm for calculation. An exemplary example may be that after the key party device receives the file identifier, plaintext verification code and version number, it queries the encryption algorithm and decryption algorithm corresponding to the version number, generates corresponding encryption key and decryption key according to the encryption algorithm and decryption algorithm, saves the file identifier, plaintext verification code, encryption key and decryption key to the corresponding positions of the relational data table, and returns the encryption key.

[0096] In another embodiment, a method for generating an encryption key may be that, while sending the file identifier and the plaintext verification code to the key party device corresponding to each key application address, the ID verification information is synchronously sent to the key party device corresponding to each key application address, and when the ID verification information is verified, an encryption key associated with the file identifier and the plaintext verification code is generated. Among them, the ID verification information may be an ID used to verify whether there is encryption authority, and may be the ID of the user of the encryption service. By determining whether to generate an encryption key based on the verification result of the ID verification information, it can be determined whether the user has sufficient authority, thereby improving the security of encryption key generation. An exemplary example may be that after the key party device receives the file identifier, the plaintext verification code and the ID verification information, it verifies whether the ID verification information has encryption authority. When the verification is passed, the corresponding encryption key and decryption key are generated according to the pre-set encryption algorithm and decryption algorithm, and the file identifier, the plaintext verification code, the encryption key and the decryption key are saved in the corresponding position of the relational data table, and the encryption key is returned.

[0097] Step S104: receiving the encryption keys fed back by each of the key party devices, encrypting the trusted identity information and the file verification code based on the corresponding encryption keys in the order of the key application addresses recorded in the key address list to obtain encrypted content data, and combining the encrypted content data with the file information to obtain an interactive file.

[0098] The encrypted content data is used to represent the content data obtained after the trusted identity information and the file verification code are encrypted. In one embodiment, after receiving the encryption keys fed back by each key party device, the trusted identity information and the file verification code are encrypted based on the corresponding encryption key in turn according to the order of the key application addresses recorded in the key address list and the encryption algorithm corresponding to the current version number to obtain the encrypted content data, and the encrypted content data and the file information are generated into an interactive file according to the file format specified by the current version number. The version number can be a number or a string used to identify the operation version to prevent operations such as using an incorrect algorithm or file format. The encrypted content data includes encrypted data, an encryption verification code and an encrypted data length. The encrypted data can include trusted identity information and a file verification code. The encryption verification code is used to confirm whether the encrypted data content has been tampered with. The encrypted data length is used to represent the length of the encrypted data. An exemplary example may be that the key application addresses of the key address list are arranged in order as address a-address b-address c-address d, address a corresponds to encryption key 1, address b corresponds to encryption key 2, address c corresponds to encryption key 3, address d corresponds to encryption key 4, the current version number is 1.2.3, and the corresponding encryption algorithm is algorithm A. Then, the trusted identity information and the file verification code are encrypted in the order of encryption key 1, encryption key 2, encryption key 3, and encryption key 4 by encryption algorithm A to obtain the corresponding encrypted data, encryption verification code, and encrypted data length (i.e., encrypted content data), and the encrypted content data and file information are generated into an interactive file according to the file format corresponding to the current version number 1.2.3. Through the joint encryption of each key party device, the trusted identity information can be made into a trusted source, jointly owned, jointly supervised, jointly managed, collaboratively operated, and mutually corroborated information property. In one embodiment, the encryption application information also includes a storage mode and a storage address list. An interactive file storage method may be that, when the storage mode is distributed storage, the interactive file is sent to each device recorded in the storage address list for storage. By storing the interactive file in multiple storage parties, the interactive file can be downloaded and compared with each other, further solving the problem of data source credibility. In another embodiment, an interactive file storage method can be, when the storage mode is all storage party mode, sending the interactive file to all currently trusted storage party devices for storage.

[0099] In one embodiment, the encrypted application information also includes a log mode and a log address list. A method for generating and storing log records may be to generate log records based on the encryption date of the trusted identity information and the associated information data. The information data includes any one or more of the version number, ID verification information, file identification, plain text checksum, storage mode, storage address list, log mode, log address list, key address list, and retrieval information. When the log mode is distributed storage, the log record is sent to each device recorded in the log address list for storage. By storing log records in multiple log parties, mutual verification can be performed to further solve the problem of data source credibility. In another embodiment, a log record storage method may be to send the interactive file to all currently trusted log party devices for storage when the log mode is all log party mode.

[0100] In one embodiment, the file information of the interactive file includes any one or more of a version number, a file identifier, a plaintext check code, a storage mode, a storage address list, a log mode, a log address list, a key address list, and retrieval information, wherein the storage mode and the storage address list are used to determine the storage device that downloads the interactive file and performs mutual proofreading of the interactive file, the key address list is used to determine the key device that applies for the decryption key when decrypting the interactive file, and the log mode and the log address list are used to determine the mode and log device for storing the log records generated when decrypting the interactive file.

[0101] In one embodiment, the retrieval information includes any one or more of copyright information, creation time information, project information, regional information, department information, desensitized personal identity information, and custom information, so as to facilitate retrieval and tracing of the source when the file is leaked, wherein the copyright information is used to characterize the relevant information of the production unit that has the copyright of the interactive file. When retrieving the production unit of the interactive file, the production unit of the interactive file can be determined by the copyright information in the retrieval information. The creation time information is used to characterize the creation time of the interactive file. The project information is used to characterize the relevant information of the project to which the interactive file belongs. When retrieving the project to which the interactive file belongs, the project to which the interactive file belongs can be determined by the project information in the retrieval information. The regional information is used to characterize the relevant information of the region to which the interactive file belongs. When retrieving the region to which the interactive file belongs, the region to which the interactive file belongs can be determined by the regional information in the retrieval information. The department information is used to characterize the relevant information of the department to which the interactive file belongs. When retrieving the department to which the interactive file belongs, the department to which the interactive file belongs can be determined by the department information in the retrieval information. Desensitized personal identity information is used to represent the desensitized personal information of the user corresponding to the interactive file. The desensitized personal identity information can prevent the leakage of the user's personal identity information. When retrieving the user information of the interactive file, the user information of the interactive file can be determined by retrieving the desensitized personal identity information in the information, such as any one or more of name, ID number, mobile phone number, etc. Customized information is information that is set autonomously according to the actual application scenario.

[0102] As can be seen from the above, when an encryption event is triggered, encryption application information and trusted identity information to be encrypted are obtained, the encryption application information includes a key address list, the key address list includes at least two key application addresses recorded in order, a file identifier and a plaintext verification code of the trusted identity information are generated, the file identifier, the plaintext verification code and the encryption application information are combined to obtain the file information, and a file verification code of the file information is generated, the file identifier and the plaintext verification code are sent to the key party device corresponding to each key application address, so that the key party device generates an encryption key associated with the file identifier and the plaintext verification code and provides feedback, wherein different key party devices generate different encryption keys, receive the encryption keys fed back by each key party device, and encrypt the trusted identity information and the file verification code based on the corresponding encryption key in sequence according to the order of the key application addresses recorded in the key address list to obtain encrypted content data, and the encrypted content data is combined with the file information to obtain an interactive file. This solution solves the problems of electronic certificates not being legal in different regions and departments, the data transmission process being easily tampered with, and how to recognize each other after intercommunication. It can improve the credibility of personal identity information, improve the security of its transmission on the Internet, prevent the abuse of personal identity information, and prevent data leakage.

[0103] Figure 2 A flowchart of another method for encrypting trusted identity information provided in an embodiment of the present application is provided, which provides an optional specific method for generating a file identifier, a plaintext verification code, and a file verification code, such as Figure 2 As shown, specifically including:

[0104] Step S201: when an encryption event is triggered, encryption application information and trusted identity information to be encrypted are obtained, wherein the encryption application information includes a key address list, and the key address list includes at least two key application addresses recorded in order.

[0105] Step S202: randomly or by applying to an external device to obtain a file identifier of the trusted identity information, perform calculations on the trusted identity information based on a set first verification code generation algorithm to obtain a plaintext verification code, combine the file identifier, the plaintext verification code and the encrypted application information to obtain file information, and perform calculations on the file information based on a set second verification code generation algorithm to obtain a file verification code.

[0106] Among them, the external device may be a related service party device that receives the file identification application request, and the external device may assign a globally unique file identification to the trusted identity information. The first verification code generation algorithm is used to characterize the algorithm used when performing operation processing on the trusted identity information, and may be a verification code generation algorithm such as a hash algorithm, a digital signature algorithm, etc. The first verification code generation algorithm may be used to generate a plain text verification code for the trusted identity information. The second verification code generation algorithm is used to characterize the algorithm used when performing operation processing on the file information, and may be a verification code generation algorithm such as a hash algorithm, a digital signature algorithm, etc. The file verification code for the file information that may be generated using the first verification code generation algorithm may be a verification code generation algorithm such as a hash algorithm, a digital signature algorithm, etc. An exemplary example may be that the file identification of the trusted identity information applied to the external device is "1AbC", the plain text verification code obtained by performing operation processing on the trusted identity information based on the set first verification code generation algorithm is f0b61cb3, after the file identification, the plain text verification code and the encrypted application information are combined to obtain the file information, the file information is operated based on the set second verification code generation algorithm to obtain the file verification code of da39a3ee5.

[0107] Step S203: Send the file identifier and the plaintext verification code to the key party device corresponding to each key application address, so that the key party device generates an encryption key associated with the file identifier and the plaintext verification code and provides feedback, wherein different encryption keys generated by different key party devices are different.

[0108] Step S204: receiving the encryption keys fed back by each of the key party devices, encrypting the trusted identity information and the file verification code based on the corresponding encryption keys in the order of the key application addresses recorded in the key address list to obtain encrypted content data, and combining the encrypted content data with the file information to obtain an interactive file.

[0109] As can be seen from the above, the file identifier of the trusted identity information is obtained randomly or by applying to an external device, the trusted identity information is processed based on the set first verification code generation algorithm to obtain a plain text verification code, the file identifier, the plain text verification code and the encrypted application information are combined to obtain the file information, and the file information is processed based on the set second verification code generation algorithm to obtain the file verification code. This solution improves the security of the trusted identity information by generating the file identifier of the trusted identity information, the plain text verification code and the file verification code of the file information.

[0110] Figure 3 A flowchart of another method for encrypting trusted identity information provided in an embodiment of the present application is provided, which provides an optional specific method for storing interactive files, such as Figure 3 As shown, specifically including:

[0111] Step S301: when an encryption event is triggered, encryption application information and trusted identity information to be encrypted are obtained, wherein the encryption application information includes a key address list, a storage mode and a storage address list, and the key address list includes at least two key application addresses recorded in order.

[0112] Step S302: Generate a file identifier and a plaintext verification code for the trusted identity information, combine the file identifier, the plaintext verification code and the encrypted application information to obtain file information, and generate a file verification code for the file information.

[0113] Step S303: Send the file identifier and the plaintext verification code to the key party device corresponding to each key application address, so that the key party device generates an encryption key associated with the file identifier and the plaintext verification code and provides feedback, wherein different encryption keys generated by different key party devices are different.

[0114] Step S304: Receive the encryption keys fed back by each of the key party devices, and encrypt the trusted identity information and the file verification code based on the corresponding encryption keys in the order of the key application addresses recorded in the key address list to obtain encrypted content data, and combine the encrypted content data with the file information to obtain an interactive file.

[0115] Step S305: When the storage mode is distributed storage, the interaction file is sent to each device recorded in the storage address list for storage.

[0116] Among them, the encrypted application information also includes a storage mode and a storage address list, and the interactive file can be stored using the storage mode and the storage address list. The storage mode is used to characterize the mode of storing interactive files, such as distributed storage, centralized storage and other modes, wherein distributed storage refers to storing data in a plurality of independent storage nodes in a dispersed manner. The storage address list is used to characterize a list recording the addresses of various storage devices used to store interactive files. An exemplary example may be that the current storage mode is distributed storage, and the storage address list records the addresses of storage device a, storage device b, storage device c and storage device d, then the generated interactive files are stored in storage device a, storage device b, storage device c and storage device d respectively, wherein the interactive files of each storage party are complete.

[0117] From the above, it can be seen that when the storage mode in the encrypted application information is distributed storage, the interactive file is sent to each device recorded in the storage address list for storage. This solution can download and compare interactive files by storing interactive files in multiple storage parties, further solving the problem of data source credibility.

[0118] Figure 4 A flowchart of another method for encrypting trusted identity information provided in an embodiment of the present application is provided, which provides an optional specific method for generating and storing log records, such as Figure 4 As shown, specifically including:

[0119] Step S401: when an encryption event is triggered, encryption application information and trusted identity information to be encrypted are obtained, wherein the encryption application information includes a key address list, a log mode and a log address list, and the key address list includes at least two key application addresses recorded in order.

[0120] Step S402: Generate a file identifier and a plaintext verification code for the trusted identity information, combine the file identifier, the plaintext verification code and the encrypted application information to obtain file information, and generate a file verification code for the file information.

[0121] Step S403: Send the file identifier and the plaintext verification code to the key party device corresponding to each key application address, so that the key party device generates an encryption key associated with the file identifier and the plaintext verification code and provides feedback, wherein different encryption keys generated by different key party devices are different.

[0122] Step S404: receiving encryption keys fed back by each of the key party devices, encrypting the trusted identity information and the file verification code based on the corresponding encryption keys in the order of the key application addresses recorded in the key address list to obtain encrypted content data, and combining the encrypted content data with the file information to obtain an interactive file.

[0123] Step S405: Generate a log record based on the encryption date of the trusted identity information and the associated information data, wherein the information data includes any one or more of the version number, ID information, the file identifier, the plaintext check code, the storage mode, the storage address list, the log mode, the log address list, the key address list, and the retrieval information. When the log mode is distributed storage, the log record is sent to each device recorded in the log address list for storage.

[0124] The encryption application information also includes a log mode and a log address list. The log mode is used to represent the mode of storing log records, such as distributed storage, centralized storage, etc., where distributed storage refers to storing data in multiple independent storage nodes. The log address list is used to represent a list of addresses of various log-party devices used to store log records. The encryption date is used to represent the date when the trusted identity information is encrypted. An exemplary example may be that the encryption date of the trusted identity information is December 22, 2024, and the associated information data includes a version number of 1.2.3, a user ID of 133569, and a file identifier of ed80a0h. Then, "December 22, 2024", "1.2.3", "133569" and "ed80a0h" are generated as log records. The current log mode is a distributed storage mode. The log address list records the addresses of log device a, log device b, log device c and log device d. Then, the generated log records are stored in log device a, log device b, log device c and log device d respectively.

[0125] As can be seen from the above, log records are generated based on the encryption date of the trusted identity information and the associated information data. The information data includes any one or more of the version number, ID verification information, file identifier, plain text checksum, storage mode, storage address list, log mode, log address list, and key address list. When the log mode is distributed storage, the log records are sent to each device recorded in the log address list for storage. This solution can store log records in multiple log parties to verify each other and further solve the problem of data source credibility.

[0126] Figure 5A flowchart of a method for decrypting trusted identity information provided in an embodiment of the present application, such as Figure 5 As shown, specifically including:

[0127] Step S501: when a decryption event is triggered, obtain the interactive file to be decrypted, parse the interactive file to obtain encrypted content data and file information, the file information includes a file identifier, a plaintext checksum and a key address list, the key address list includes at least two key application addresses recorded in order.

[0128] Among them, the decryption event can be an event related to the user's use of an electronic certificate. For example, the user uses the electronic certificate App on the authorized party's mobile phone and presents the electronic certificate QR code. The device scans the electronic certificate QR code and sends it to the corresponding authorized party's electronic certificate resolution service agency for corresponding personal identity information resolution. The authorized party sends the user ID, plaintext verification code and additional information to the authorizing party to apply for interactive file authorization. When the authorized party has the corresponding interactive file permission and returns the interactive file, the decryption event is triggered. Among them, the authorizing party is an institution that allows authorized use of interactive files, authorizes the authorized party to obtain and decrypt interactive files, and the authorized party is an institution that obtains authorization to use interactive files.

[0129] In one embodiment, a method for obtaining an interactive file to be decrypted may be, when the decryption instruction generated when the decryption event is triggered is a fileless decryption instruction, obtaining the first file information associated with the current fileless decryption instruction, the first file information including a first file identifier and a first plaintext verification code, sending the first file identifier and the first plaintext verification code to each storage device, selecting any device storing the corresponding interactive file from each storage device to feedback the interactive file, and receiving the feedback interactive file. The interactive file is obtained by the file identifier and the first plaintext verification code, thereby realizing the acquisition of the interactive file when there is no interactive file.

[0130] Step S502: Send the file identifier and the plaintext verification code to the key party device corresponding to each key application address, so that the key party device feeds back a decryption key associated with the file identifier and the plaintext verification code.

[0131] The decryption key is used to represent the key used in the decryption process, and the encrypted content data can be decrypted using the decryption key. In one embodiment, after each key party device receives the file identifier and the plaintext verification code, it searches for the corresponding decryption key in the stored relational data table according to the file identifier and the plaintext verification code, and returns the decryption key. The relational data table may include the corresponding relationship between the file identifier, the plaintext verification code, and the decryption key. An exemplary example may be that the relational data table stored in the key party device a is shown in the following table:

[0132] File Identification Plain text checksum Decryption Key 123a e80dg34 12789f9h 246b e07hg85 4759h6b4 749g e57jk45 6572n7dr

[0133] The above relationship data table describes the correspondence between the file identifier, the plaintext check code and the decryption key, which is specifically described as follows: when the file identifier is 123a and the plaintext check code is e80dg34, the corresponding decryption key is 12789f9h; when the file identifier is 246b and the plaintext check code is e07hg85, the corresponding decryption key is 4759h6b4; when the file identifier is 749g and the plaintext check code is e57jk45, the corresponding decryption key is 6572n7dr. It should be noted that the examples in the above table are only exemplary, and the actual process is more complex. For example, the file identifier received by the key party device a is 123a, the plaintext check code is e80dg34, and the decryption key obtained by querying the relationship data table is 12789f9h, then the key party device a returns 12789f9h.

[0134] In another embodiment, when the file identifier and the plaintext verification code are sent to the key party device corresponding to each key application address, the ID verification information is synchronously sent to the key party device corresponding to each key application address. When the key party device verifies the ID verification information, it feedbacks the decryption key associated with the file identifier and the plaintext verification code.

[0135] Step S503: Receive the decryption keys fed back by the key party devices, and decrypt the encrypted content data in reverse order based on the corresponding decryption keys according to the order of the key application addresses recorded in the key address list to obtain decrypted content data, wherein the decrypted content data includes trusted identity information and a file verification code.

[0136] Among them, the decrypted content data is used to represent the content data obtained after the encrypted content data is decrypted. An exemplary example may be that the key application addresses of the key address list are arranged in order as address a-address b-address c-address d, address a corresponds to decryption key 1, address b corresponds to decryption key 2, address c corresponds to decryption key 3, and address d corresponds to decryption key, then the encrypted content data is encrypted in the order of decryption key 4, decryption key 3, decryption key 2, and decryption key 1 to obtain the decrypted content data. In one embodiment, the decrypted content data also includes a first encryption check code. A method of verifying the decrypted content data may be to calculate a second encryption check code of the trusted identity information and the file check code, and generate a decryption error message when the first encryption check code is inconsistent with the second encryption check code. By verifying the encryption check code, it can be determined whether the decryption of the encrypted content data is correct or whether the data has been tampered with.

[0137] As can be seen from the above, when a decryption event is triggered, the interactive file to be decrypted is obtained, and the interactive file is parsed to obtain the encrypted content data and file information. The file information includes a file identifier, a plaintext check code, and a key address list. The key address list includes at least two key application addresses recorded in order. The file identifier and the plaintext check code are sent to the key party device corresponding to each key application address, and the key party device is used to feedback the decryption key associated with the file identifier and the plaintext check code, and the decryption key fed back by each key party device is received. According to the order of the key application addresses recorded in the key address list, the encrypted content data is decrypted in reverse order based on the corresponding decryption key to obtain the decrypted content data. The decrypted content data includes trusted identity information and file verification. This solution solves the problem that electronic certificates are not legitimate in different regions and departments, the data transmission process is easily tampered with, and how to recognize each other after intercommunication. It can improve the credibility of personal identity information, improve the security of its transmission on the Internet, prevent the abuse of personal identity information, and prevent data leakage.

[0138] Figure 6 A flowchart of another method for decrypting trusted identity information provided in an embodiment of the present application is provided, which provides a specific method for optional verification of decrypted content data, such as Figure 6 As shown, specifically including:

[0139] Step S601: when a decryption event is triggered, obtain the interactive file to be decrypted, parse the interactive file to obtain encrypted content data and file information, the file information includes a file identifier, a plaintext checksum and a key address list, the key address list includes at least two key application addresses recorded in order.

[0140] Step S602: Send the file identifier and the plaintext verification code to the key party device corresponding to each key application address, so that the key party device feeds back a decryption key associated with the file identifier and the plaintext verification code.

[0141] Step S603: Receive the decryption keys fed back by each of the key party devices, and decrypt the encrypted content data in reverse order based on the corresponding decryption keys according to the order of the key application addresses recorded in the key address list to obtain decrypted content data, wherein the decrypted content data includes trusted identity information, a file verification code, and a first encryption verification code.

[0142] Step S604: Calculate a second encrypted verification code of the trusted identity information and the file verification code, and generate a decryption error message when the first encrypted verification code is inconsistent with the second encrypted verification code.

[0143] The decrypted content data also includes a first encryption verification code, which is used to determine whether the decryption of the encrypted content data is correct or whether the data has been tampered with. In one embodiment, the trusted identity information and the file verification code are calculated according to the calculation method corresponding to the first encryption verification code to obtain a second encryption verification code, and when the first encryption verification code is inconsistent with the second encryption verification code, a decryption error message is generated. Optionally, the decrypted content data also includes a first file verification code, which is used to determine whether the decryption of the file information is correct or whether the data has been tampered with. One verification method may be, when the first encryption verification code is consistent with the second encryption verification code, calculating the second file verification code of the file information; when the first file verification code is inconsistent with the second file verification code, generating a decryption error message; when the first file verification code is consistent with the second file verification code, calculating the second plaintext verification code of the trusted identity information; when the plaintext verification code in the file information is inconsistent with the second plaintext verification code, generating a decryption error message; when the plaintext verification code in the file information is consistent with the second plaintext verification code, feeding back the trusted identity information; and generating a log record based on the decryption date of the trusted identity information and associated information data, the information data including any one or more of a file identifier, a plaintext verification code, a key address list, a storage mode, a storage address list, a log mode, a log address list, and retrieval information; when the log mode is distributed storage, sending the log record to each device recorded in the log address list for storage, wherein the decryption date is the date when the trusted identity information is decrypted.

[0144] An exemplary example may be that the first encryption verification code in the decrypted content data is egdi48y, the first file verification code is gfiir307, and the plaintext verification code in the file information is hf45ta7. The second encryption verification code is egdi48y obtained by calculating the trusted identity information and the file verification code according to the calculation method corresponding to the first encryption verification code. If it is consistent with the first encryption verification code, the file information is calculated according to the calculation method corresponding to the first file verification code to obtain the second file verification code gfiir307. If it is consistent with the first file verification code, the trusted identity information is calculated according to the calculation method corresponding to the plaintext verification code to obtain the second plaintext verification code hf45ta7. 5ta7, which is consistent with the plaintext checksum in the file information, then the trusted identity information is fed back. The current decryption date of the trusted identity information is January 1, 2024. The associated information data includes the file identifier 238af4 and the plaintext checksum hf45ta7. Log records are generated based on "January 1, 2024", "238af4" and "hf45ta7". The current log mode is distributed storage. The log address list records the addresses of log device a, log device b, log device c and log device d. The generated log records are stored in log device a, log device b, log device c and log device d respectively.

[0145] As can be seen from the above, the second encryption verification code of the trusted identity information and the file verification code is calculated, and when the first encryption verification code and the second encryption verification code are inconsistent, a decryption error message is generated. By verifying the encryption verification code, it can be determined whether the decryption of the encrypted content data is correct or whether the data has been tampered with.

[0146] Figure 7 A flowchart of another method for decrypting trusted identity information provided in an embodiment of the present application is provided, which provides an optional specific method for obtaining an interactive file to be decrypted, such as Figure 7 As shown, specifically including:

[0147] Step S701: When the decryption instruction generated when the decryption event is triggered is a fileless decryption instruction, first file information associated with the fileless decryption instruction is obtained, where the first file information includes a first file identifier and a first plaintext check code.

[0148] The fileless decryption instruction is used to represent a decryption instruction without an interactive file. In one embodiment, when the authorized party has the corresponding interactive file authority and returns the first file information, the fileless decryption instruction and the first file information are sent. Correspondingly, when the authorized party has the corresponding interactive file authority and returns the interactive file, the decryption instruction and the interactive file are sent.

[0149] Step S702: Send the first file identifier and the first plaintext verification code to each storage device, select any device storing the corresponding interactive file from the various storage devices to provide feedback on the interactive file, and receive the feedback of the interactive file.

[0150] Among them, an exemplary example may be that each storage device is storage device 1, storage device 2, storage device 3, storage device 4, and storage device 5, and the first file identifier and the first plaintext verification code in the first file information are sent to the five storage devices to determine the storage device where the interactive file corresponding to the first file identifier and the first plaintext verification code exists, and it is determined that the storage devices where the interactive file corresponding to the first file identifier and the first plaintext verification code exists are storage device 1, storage device 2, and storage device 3, then any one of storage device 1, storage device 2, and storage device 3 is selected to provide feedback on the interactive file.

[0151] Step S703: Parse the interactive file to obtain encrypted content data and file information, wherein the file information includes a file identifier, a plaintext checksum, and a key address list, wherein the key address list includes at least two key application addresses recorded in order.

[0152] Step S704: Send the file identifier and the plaintext verification code to the key party device corresponding to each of the key application addresses, so that the key party device feeds back a decryption key associated with the file identifier and the plaintext verification code.

[0153] Step S705: Receive the decryption keys fed back by each of the key party devices, and decrypt the encrypted content data in reverse order based on the corresponding decryption keys according to the order of the key application addresses recorded in the key address list to obtain decrypted content data, wherein the decrypted content data includes trusted identity information and a file verification code.

[0154] As can be seen from the above, when the decryption instruction generated when the decryption event is triggered is a fileless decryption instruction, the first file information associated with the current fileless decryption instruction is obtained, and the first file information includes a first file identifier and a first plaintext verification code. The first file information and the first plaintext verification code are sent to each storage device, and any device storing the corresponding interactive file in each storage device is selected to feedback the interactive file, and the feedback interactive file is received. This solution obtains the interactive file through the file identifier and the first plaintext verification code, and realizes the acquisition of the interactive file when there is no interactive file.

[0155] Figure 8This is a module structure diagram of a trusted identity information encryption device provided in an embodiment of the present application. The system is used to execute a trusted identity information encryption method provided in the above embodiment, and has functional modules and beneficial effects corresponding to the execution method. Figure 8 As shown, the system specifically includes:

[0156] The communication module 101 is used to obtain encryption application information and trusted identity information to be encrypted when an encryption event is triggered, wherein the encryption application information includes a key address list, and the key address list includes at least two key application addresses recorded in order;

[0157] The data encryption module 102 is used to generate a file identifier and a plain text verification code of the trusted identity information, combine the file identifier, the plain text verification code and the encryption application information to obtain file information, and generate a file verification code for the file information;

[0158] The communication module 101 is further used to send the file identifier and the plaintext verification code to the key party device corresponding to each key application address, so that the key party device generates an encryption key associated with the file identifier and the plaintext verification code and provides feedback, wherein different encryption keys generated by different key party devices are different;

[0159] The communication module 101 is also used to receive the encryption key fed back by each of the key party devices;

[0160] The data encryption module 102 is also used to encrypt the trusted identity information and the file verification code based on the corresponding encryption keys in the order of the key application addresses recorded in the key address list to obtain encrypted content data, and combine the encrypted content data with the file information to obtain an interactive file.

[0161] It can be seen from the above scheme that when an encryption event is triggered, encryption application information and trusted identity information to be encrypted are obtained, the encryption application information includes a key address list, the key address list includes at least two key application addresses recorded in order, a file identifier and a plaintext verification code of the trusted identity information are generated, the file identifier, the plaintext verification code and the encryption application information are combined to obtain the file information, and a file verification code of the file information is generated, the file identifier and the plaintext verification code are sent to the key party device corresponding to each key application address, and the key party device generates an encryption key associated with the file identifier and the plaintext verification code and provides feedback, wherein different key party devices generate different encryption keys, receive the encryption keys fed back by each key party device, and encrypt the trusted identity information and the file verification code based on the corresponding encryption key in the order of the key application addresses recorded in the key address list to obtain encrypted content data, and the encrypted content data is combined with the file information to obtain an interactive file. This solution solves the problems of electronic certificates not being legal in different regions and departments, the data transmission process being easily tampered with, and how to recognize each other after intercommunication. It can improve the credibility of personal identity information, improve the security of its transmission on the Internet, prevent the abuse of personal identity information, and prevent data leakage.

[0162] In a possible embodiment, the communication module 101 is specifically used for:

[0163] Sending an encrypted application information acquisition request to a server, so that the server can feed back the encrypted application information, where the encrypted application information is configured by the server;

[0164] The encrypted application information sent by the server is received and stored.

[0165] In a possible embodiment, the data encryption module 102 is specifically used to:

[0166] Obtaining the file identification of the trusted identity information randomly or by applying to an external device;

[0167] Based on a set first verification code generation algorithm, the trusted identity information is processed to obtain a plain text verification code;

[0168] The step of generating a file verification code for the file information includes:

[0169] The file information is processed based on a set second verification code generation algorithm to obtain a file verification code.

[0170] In a possible embodiment, the communication module 101 is further used for:

[0171] Synchronously sending the set version number to the key party device corresponding to each of the key application addresses;

[0172] Correspondingly, the key party device generates an encryption key associated with the file identifier and the plaintext verification code, including:

[0173] The key party device determines an encryption algorithm corresponding to the version number, and generates an encryption key associated with the file identifier and the plaintext check code based on the encryption algorithm;

[0174] Correspondingly, the file information also includes the version number.

[0175] In a possible embodiment, the communication module 101 is further used for:

[0176] Synchronously sending the ID verification information to the key party device corresponding to each of the key application addresses;

[0177] Accordingly, the generating of the encryption key associated with the file identifier and the plaintext verification code includes:

[0178] When the ID verification information is verified successfully, an encryption key associated with the file identifier and the plain text verification code is generated.

[0179] In a possible embodiment, an interactive file storage module is further included, which is specifically used to:

[0180] When the storage mode is distributed storage, the interaction file is sent to each device recorded in the storage address list for storage.

[0181] In a possible embodiment, a log module is further included, which is specifically used to:

[0182] generating a log record based on the encryption date of the trusted identity information and the associated information data, the information data including any one or more of a version number, ID verification information, the file identifier, the plaintext checksum, the storage mode, the storage address list, the log mode, the log address list, the key address list, and retrieval information;

[0183] When the log mode is distributed storage, the log record is sent to each device recorded in the log address list for storage.

[0184] Fig. 9 This is a module structure diagram of a decryption device for trusted identity information provided in an embodiment of the present application. The system is used to execute a decryption method for trusted identity information provided in the above embodiment, and has functional modules and beneficial effects corresponding to the execution method. Fig. 9 As shown, the system specifically includes:

[0185] The communication module 201 is used to obtain the interactive file to be decrypted when a decryption event is triggered;

[0186] A data decryption module 202, used to parse the interactive file to obtain encrypted content data and file information, wherein the file information includes a file identifier, a plain text checksum, and a key address list, wherein the key address list includes at least two key application addresses recorded in order;

[0187] The communication module 201 is further used to send the file identifier and the plaintext verification code to the key party device corresponding to each key application address, so that the key party device feeds back a decryption key associated with the file identifier and the plaintext verification code;

[0188] The communication module 201 is further used to receive the decryption key fed back by each of the key party devices;

[0189] The data decryption module 202 is further used to decrypt the encrypted content data based on the corresponding decryption key in reverse order according to the order of the key application addresses recorded in the key address list to obtain decrypted content data, wherein the decrypted content data includes trusted identity information.

[0190] As can be seen from the above, when a decryption event is triggered, the interactive file to be decrypted is obtained, and the interactive file is parsed to obtain the encrypted content data and file information. The file information includes a file identifier, a plaintext check code, and a key address list. The key address list includes at least two key application addresses recorded in order. The file identifier and the plaintext check code are sent to the key party device corresponding to each key application address, and the key party device is used to feedback the decryption key associated with the file identifier and the plaintext check code, and the decryption key fed back by each key party device is received. According to the order of the key application addresses recorded in the key address list, the encrypted content data is decrypted in reverse order based on the corresponding decryption key to obtain the decrypted content data. The decrypted content data includes trusted identity information and file verification. This solution solves the problem that electronic certificates are not legitimate in different regions and departments, the data transmission process is easily tampered with, and how to recognize each other after intercommunication. It can improve the credibility of personal identity information, improve the security of its transmission on the Internet, prevent the abuse of personal identity information, and prevent data leakage.

[0191] In a possible embodiment, the data decryption module 202 is specifically used to:

[0192] Calculating a second encrypted verification code of the trusted identity information and the file verification code;

[0193] When the first encryption verification code is inconsistent with the second encryption verification code, decryption error information is generated.

[0194] In a possible embodiment, the data decryption module 202 is further used for:

[0195] Calculating a second file verification code of the file information;

[0196] When the first file verification code is inconsistent with the second file verification code, decryption error information is generated.

[0197] In a possible embodiment, the data decryption module 202 is further used for:

[0198] Calculating a second plaintext verification code of the trusted identity information;

[0199] If the plaintext verification code in the file information is inconsistent with the second plaintext verification code, generating a decryption error message;

[0200] When the plaintext verification code in the file information is consistent with the second plaintext verification code, the trusted identity information is fed back.

[0201] In a possible embodiment, a log module is further included, which is specifically used to:

[0202] Generate a log record based on the decryption date of the trusted identity information and the associated information data, wherein the information data includes any one or more of a file identifier, a plain text checksum, a key address list, a storage mode, a storage address list, a log mode, a log address list, and retrieval information;

[0203] When the log mode is distributed storage, the log record is sent to each device recorded in the log address list for storage.

[0204] In a possible embodiment, the communication 201 is specifically used for:

[0205] In the case where the decryption instruction generated when the decryption event is triggered is a fileless decryption instruction, obtaining first file information currently associated with the fileless decryption instruction, the first file information including a first file identifier and a first plaintext check code;

[0206] Sending the first file identifier and the first plaintext verification code to each storage device, and selecting any device storing the corresponding interactive file from among the storage devices to perform feedback of the interactive file;

[0207] Receive feedback on the interaction document.

[0208] Fig.10 A schematic diagram of a structure of a trusted identity information encryption and decryption device provided in an embodiment of the present application, such as Fig.10As shown, the device includes a processor 301, a memory 302, an input device 303 and an output device 304; the number of processors 301 in the device can be one or more. Fig.10 A processor 301 is taken as an example; the processor 301, memory 302, input device 303 and output device 304 in the device can be connected by a bus or other means. Fig.10 The example of connection via a bus is taken. The memory 302, as a computer-readable storage medium, can be used to store software programs, computer executable programs and modules, such as program instructions or modules corresponding to a method for encrypting or decrypting trusted identity information in an embodiment of the present application. The processor 301 executes various functional applications and data processing of the device by running the software programs, instructions and modules stored in the memory 302, that is, implements the above-mentioned encryption method or decryption method of trusted identity information. The input device 303 can be used to receive input digital or character information, and generate key signal input related to user settings and function control of the device. The output device 304 may include a display device such as a display screen.

[0209] The embodiment of the present application further provides a storage medium containing computer executable instructions, wherein the computer executable instructions are used to perform an encryption method or a decryption method of trusted identity information when executed by a computer processor, the encryption method comprising:

[0210] When an encryption event is triggered, encryption application information and trusted identity information to be encrypted are obtained, wherein the encryption application information includes a key address list, and the key address list includes at least two key application addresses recorded in order;

[0211] Generate a file identifier and a plaintext verification code for the trusted identity information;

[0212] Combining the file identifier, the plain text verification code and the encrypted application information to obtain file information, and generating a file verification code for the file information;

[0213] Sending the file identifier and the plaintext verification code to the key party device corresponding to each key application address, so that the key party device generates an encryption key associated with the file identifier and the plaintext verification code and provides feedback, wherein different encryption keys generated by different key party devices are different;

[0214] receiving the encryption keys fed back by the key party devices, and encrypting the trusted identity information and the file verification code based on the corresponding encryption keys in order of the key application addresses recorded in the key address list to obtain encrypted content data;

[0215] The encrypted content data is combined with the file information to obtain an interactive file.

[0216] The encryption method includes:

[0217] When a decryption event is triggered, the interactive file to be decrypted is obtained, and the interactive file is parsed to obtain encrypted content data and file information, wherein the file information includes a file identifier, a plaintext checksum, and a key address list, wherein the key address list includes at least two key application addresses recorded in order;

[0218] Sending the file identifier and the plaintext verification code to the key party device corresponding to each of the key application addresses, so that the key party device feeds back a decryption key associated with the file identifier and the plaintext verification code;

[0219] Receive the decryption key fed back by each of the key party devices, and decrypt the encrypted content data in reverse order based on the corresponding decryption key according to the order of the key application addresses recorded in the key address list to obtain decrypted content data, wherein the decrypted content data includes trusted identity information and a file verification code.

[0220] It is worth noting that in the embodiment of the above-mentioned trusted identity information encryption method system, the various units and modules included are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the protection scope of the embodiments of the present application.

[0221] Note that the above are only preferred embodiments of the present application and the technical principles used. Those skilled in the art will understand that the present application is not limited to the specific embodiments described herein, and that various obvious changes, readjustments and substitutions can be made to the present application without departing from the protection scope of the present application. Therefore, although the present application is described in more detail through the above embodiments, the present application is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present application, and the scope of the present application is determined by the scope of the appended claims.

Claims

1. A method for encrypting trusted identity information, characterized in that: include: When an encryption event is triggered, encryption application information and trusted identity information to be encrypted are obtained, wherein the encryption application information includes a key address list, and the key address list includes at least two key application addresses recorded in order; Generate a file identifier and a plaintext verification code for the trusted identity information; Combining the file identifier, the plain text verification code and the encrypted application information to obtain file information, and generating a file verification code for the file information; Sending the file identifier and the plaintext verification code to the key party device corresponding to each key application address, so that the key party device generates an encryption key associated with the file identifier and the plaintext verification code and provides feedback, wherein different encryption keys generated by different key party devices are different; receiving the encryption keys fed back by the key party devices, and encrypting the trusted identity information and the file verification code based on the corresponding encryption keys in order of the key application addresses recorded in the key address list to obtain encrypted content data; The encrypted content data is combined with the file information to obtain an interactive file.

2. The method for encrypting trusted identity information according to claim 1, characterized in that: Before obtaining the encryption application information and the trusted identity information to be encrypted, the method further includes: Sending an encrypted application information acquisition request to a server, so that the server can feed back the encrypted application information, where the encrypted application information is configured by the server; The encrypted application information sent by the server is received and stored.

3. The method for encrypting trusted identity information according to claim 1, characterized in that: The generating of the file identifier and the plain text verification code of the trusted identity information includes: Obtaining the file identification of the trusted identity information randomly or by applying to an external device; Performing computation on the trusted identity information based on a set first verification code generation algorithm to obtain a plaintext verification code; The step of generating a file verification code for the file information includes: The file information is processed based on a set second verification code generation algorithm to obtain a file verification code.

4. The method for encrypting trusted identity information according to any one of claims 1 to 3, characterized in that: When the file identifier and the plain text verification code are sent to the key party device corresponding to each key application address, it also includes: Synchronously sending the set version number to the key party device corresponding to each of the key application addresses; Correspondingly, the key party device generates an encryption key associated with the file identifier and the plaintext verification code, including: The key source device determines an encryption algorithm corresponding to the version number, and generates an encryption key associated with the file identifier and the plaintext check code based on the encryption algorithm; Correspondingly, the file information also includes the version number.

5. The method for encrypting trusted identity information according to any one of claims 1 to 3, characterized in that: When the file identifier and the plain text verification code are sent to the key party device corresponding to each key application address, it also includes: Synchronously sending the ID verification information to the key party device corresponding to each of the key application addresses; Correspondingly, the generating of an encryption key associated with the file identifier and the plaintext verification code includes: When the ID verification information is verified successfully, an encryption key associated with the file identifier and the plain text verification code is generated.

6. According to the encryption method of trusted identity information described in any one of claims 1-3, the file information includes any one or more of a version number, a file identifier, a plaintext checksum, a key address list, a storage mode, a storage address list, a log mode, a log address list and retrieval information.

7. The method for encrypting trusted identity information according to any one of claims 1 to 3, characterized in that: The encryption application information also includes a storage mode and a storage address list, and after the encrypted content data is combined with the file information to obtain an interactive file, it also includes: When the storage mode is distributed storage, the interaction file is sent to each device recorded in the storage address list for storage.

8. The method for encrypting trusted identity information according to claim 7, characterized in that: The encrypted application information also includes a log mode and a log address list, and after the encrypted content data is combined with the file information to obtain an interactive file, it also includes: generating a log record based on the encryption date of the trusted identity information and the associated information data, the information data including any one or more of a version number, ID verification information, the file identifier, the plaintext checksum, the storage mode, the storage address list, the log mode, the log address list, the key address list, and retrieval information; When the log mode is distributed storage, the log record is sent to each device recorded in the log address list for storage.

9. The method for encrypting trusted identity information according to claim 6 or 8, wherein the retrieval information comprises: Any one or more of copyright information, creation time information, project information, regional information, department information, desensitized personal identity information, and custom information.

10. A method for decrypting trusted identity information, characterized in that: include: When a decryption event is triggered, the interactive file to be decrypted is obtained, and the interactive file is parsed to obtain encrypted content data and file information, wherein the file information includes a file identifier, a plaintext checksum, and a key address list, wherein the key address list includes at least two key application addresses recorded in order; Sending the file identifier and the plaintext verification code to the key party device corresponding to each of the key application addresses, so that the key party device feeds back a decryption key associated with the file identifier and the plaintext verification code; Receive the decryption key fed back by each of the key party devices, and decrypt the encrypted content data in reverse order based on the corresponding decryption key according to the order of the key application addresses recorded in the key address list to obtain decrypted content data, wherein the decrypted content data includes trusted identity information and a file verification code.

11. The method for decrypting trusted identity information according to claim 10, characterized in that: The decrypted content data also includes a first encryption verification code, and after the decrypted content data is obtained, it also includes: Calculating a second encrypted verification code of the trusted identity information and the file verification code; When the first encryption verification code is inconsistent with the second encryption verification code, decryption error information is generated.

12. The method for decrypting trusted identity information according to claim 11, characterized in that: The decrypted content data also includes a first file verification code. When the first encryption verification code is consistent with the second encryption verification code, the method further includes: Calculating a second file verification code of the file information; When the first file verification code is inconsistent with the second file verification code, decryption error information is generated.

13. The method for decrypting trusted identity information according to claim 12, characterized in that: When the first file verification code is consistent with the second file verification code, the method further includes: Calculating a second plaintext verification code of the trusted identity information; If the plaintext verification code in the file information is inconsistent with the second plaintext verification code, generating a decryption error message; When the plaintext verification code in the file information is consistent with the second plaintext verification code, the trusted identity information is fed back.

14. The method for decrypting trusted identity information according to claim 13, characterized in that: When the plaintext verification code in the file information is consistent with the second plaintext verification code, the method further includes: Generate a log record based on the decryption date of the trusted identity information and the associated information data, wherein the information data includes any one or more of a file identifier, a plain text checksum, a key address list, a storage mode, a storage address list, a log mode, a log address list, and retrieval information; When the log mode is distributed storage, the log record is sent to each device recorded in the log address list for storage.

15. The method for decrypting trusted identity information according to any one of claims 10 to 14, characterized in that: The step of obtaining the interactive file to be decrypted includes: In the case where the decryption instruction generated when the decryption event is triggered is a fileless decryption instruction, obtaining first file information currently associated with the fileless decryption instruction, wherein the first file information includes a first file identifier and a first plaintext check code; Sending the first file identifier and the first plaintext verification code to each storage device, and selecting any device storing the corresponding interactive file from among the storage devices to perform feedback of the interactive file; Receive feedback on the interaction document.

16. A device for encrypting trusted identity information, characterized in that: include: A communication module, used for obtaining encryption application information and trusted identity information to be encrypted when an encryption event is triggered, wherein the encryption application information includes a key address list, and the key address list includes at least two key application addresses recorded in order; A data encryption module, used to generate a file identifier and a plaintext verification code of the trusted identity information, combine the file identifier, the plaintext verification code and the encryption application information to obtain file information, and generate a file verification code for the file information; The communication module is further used to send the file identifier and the plaintext verification code to the key party device corresponding to each of the key application addresses, so that the key party device generates an encryption key associated with the file identifier and the plaintext verification code and provides feedback, wherein different encryption keys generated by different key party devices are different; The communication module is further used to receive encryption keys fed back by each of the key party devices; The data encryption module is also used to encrypt the trusted identity information and the file verification code based on the corresponding encryption keys in the order of the key application addresses recorded in the key address list to obtain encrypted content data, and combine the encrypted content data with the file information to obtain an interactive file.

17. A decryption device for trusted identity information, characterized in that: include: The communication module is used to obtain the interactive file to be decrypted when a decryption event is triggered; A data decryption module, used to parse the interactive file to obtain encrypted content data and file information, wherein the file information includes a file identifier, a plain text check code, and a key address list, wherein the key address list includes at least two key application addresses recorded in order; The communication module is further used to send the file identifier and the plaintext verification code to the key party device corresponding to each of the key application addresses, so that the key party device feeds back a decryption key associated with the file identifier and the plaintext verification code; The communication module is further used to receive the decryption key fed back by each of the key party devices; The data decryption module is further used to decrypt the encrypted content data based on the corresponding decryption key in reverse order according to the order of the key application addresses recorded in the key address list to obtain decrypted content data, wherein the decrypted content data includes trusted identity information.

18. A device for encrypting and decrypting trusted identity information, the device comprising: one or more processors; A storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, enables the one or more processors to implement the encryption method or decryption method of the trusted identity information as described in any one of claims 1-15.

19. A storage medium storing computer executable instructions, wherein the computer executable instructions are used to execute the encryption method or decryption method of the trusted identity information according to any one of claims 1 to 15 when executed by a computer processor.

Images