Confusion encryption method and device, equipment, medium and program product

Abstract

The invention provides a confusion encryption method which can be applied to the technical field of cloud computing. The confusion encryption method comprises the following steps: establishing a first encryption channel between a system page end and a national password confusion encryption tool, and transmitting data processed by a first encryption algorithm through the first encryption channel based on a hypertext transmission security protocol; receiving the data by using a national cryptographic confusion encryption tool and executing security verification to obtain a key string and a national cryptographic algorithm type corresponding to the first encrypted data; decrypting the first encrypted data in a security isolation environment inside the national password confusion encryption tool based on the key string and the national password algorithm type, and performing national password algorithm re-encryption on the decrypted data to obtain re-encrypted data; and transmitting the re-encrypted data to the server through a second encryption channel, wherein the second encryption channel uses a national cryptographic algorithm and adopts a hardware cipher machine to perform encryption. The invention further provides a confusion encryption device and equipment, a storage medium and a program product.

Description

Technical Field

[0001] The present application relates to the field of cloud computing, and more specifically to an obfuscation encryption method, apparatus, device, medium, and program product. Background Art

[0002] With the rapid development of Internet technology, World Wide Web (Web) applications are becoming increasingly versatile and the volume of data interaction is increasing dramatically. However, this has also brought about serious information security issues. In Web applications, the interaction and data transmission between the front-end and back-end are key links in the flow of information, and their security is directly related to user privacy protection, corporate trade secrets, and network security.

[0003] Currently, in web applications, encryption at the network layer is the primary consideration for ensuring data security between the front-end and back-end. Hypertext Transfer Protocol Secure (HTTPS), a widely used network-layer encryption protocol, encrypts transmitted data using Secure Sockets Layer / Transport Layer Security (SSL / TLS), effectively preventing eavesdropping or tampering during transmission. HTTPS has been widely adopted in numerous fields, including e-commerce, online payment, and social networking, providing users with a relatively secure network environment.

[0004] However, from an information security perspective, relying solely on network-layer encryption is insufficient to fully guarantee the security of highly sensitive information. Network-layer encryption primarily protects data during transmission, but it offers little protection against data security during front-end and back-end processing. In real-world applications, the front-end often needs to encrypt sensitive data before sending it to the back-end to prevent leakage before transmission. This necessitates encryption at the application layer.

[0005] In terms of application-layer encryption, common encryption methods include internationally accepted encryption algorithms such as RSA and the Advanced Encryption Standard (AES), as well as national encryption algorithms that have gained increasing attention in recent years, such as the Elliptic Curve Public Key Cryptography (SM2), the Cryptographic Hash Cryptography (SM3), and the Block Cipher (SM4). RSA is an asymmetric encryption algorithm with high security, but relatively slow encryption and decryption speeds, making it suitable for encrypting small amounts of data or exchanging keys. AES is a symmetric encryption algorithm with fast encryption and decryption speeds, making it suitable for encrypting large amounts of data. However, both RSA and AES share a common problem in front-end applications: the front-end must first obtain the encryption key string. Once this key string is exposed on the front-end, it can be obtained by malicious users, rendering the encryption ineffective.

[0006] Furthermore, the use of domestically developed encryption algorithms holds significant strategic significance. This ensures independent control of encryption technology, minimizing the risk of restrictions or cracking. As a domestically developed encryption technology, the National Encryption Algorithm (NSA), boasts high security and independent controllability, and is increasingly being applied in key sectors such as government affairs, finance, and energy.

[0007] To address these issues, it's necessary to encapsulate an obfuscated encryption tool based on a national secret algorithm. This tool can encrypt sensitive data on the front end while simultaneously using obfuscation technology to protect the encryption code, preventing easy access to the key string and encryption logic. On the back end, the server decrypts the encrypted data, achieving a double-layer encryption. This double-layer encryption mechanism significantly improves data transmission security, effectively preventing data theft or tampering during transmission and processing. Summary of the Invention

[0008] In view of the above problems, the present application provides an obfuscation encryption method, apparatus, device, medium and program product.

[0009] According to the first aspect of the present application, an obfuscation encryption method is provided, including: establishing a first encryption channel between the system page end and the national secret obfuscation encryption tool, and transmitting data processed by a first encryption algorithm through the first encryption channel based on the Hypertext Transfer Protocol Security Protocol; using the national secret obfuscation encryption tool to receive the data processed by the first encryption algorithm and perform security verification to obtain a key string and national secret algorithm type corresponding to the first encrypted data; based on the key string and the national secret algorithm type, in a secure isolation environment inside the national secret obfuscation encryption tool, decrypting the first encrypted data, and re-encrypting the decrypted data with the national secret algorithm to obtain re-encrypted data; and transmitting the re-encrypted data to the server through a second encryption channel, the second encryption channel uses the national secret algorithm and adopts a hardware cipher machine to perform encryption; wherein, the keys in the key string can be rotated and updated.

[0010] According to an embodiment of the present application, the encryption algorithm of the first encryption channel is dynamically selected by the user according to needs; and the key of the first encryption algorithm is dynamically generated by the system page end and is only used in this communication.

[0011] According to an embodiment of the present application, the method for performing security verification includes: in response to receiving first encrypted data, extracting a user identifier from user basic information, wherein the first encrypted data is associated with the user basic information; obtaining an institution unique identifier associated with the user identifier from a remote dictionary service; based on the institution unique identifier, querying the corresponding key string and national encryption algorithm type from a key string database; and verifying that the key string and national encryption algorithm type match a preset security policy.

[0012] According to an embodiment of the present application, the secure isolation environment is a hardware security module or a trusted execution environment, which is used to prevent the key string and data from being leaked or tampered with during the decryption and re-encryption process.

[0013] According to an embodiment of the present application, the national secret algorithm type includes one or more combinations of Commercial Secret Algorithm No. 1, elliptic curve public key cryptography algorithm, cryptographic hash algorithm and block cipher algorithm; and the re-encryption process adopts the encryption mode and filling method corresponding to the national secret algorithm type.

[0014] According to an embodiment of the present application, the hardware cryptographic machine of the second encryption channel supports accelerated operations of the national secret algorithm, and data interaction is performed between the hardware cryptographic machine and the national secret obfuscation encryption tool through a dedicated interface.

[0015] According to an embodiment of the present application, it also includes: after the server receives the re-encrypted data, it is decrypted by a hardware cryptographic machine using the corresponding national secret algorithm and key string, and the integrity and source legitimacy of the decrypted data are verified.

[0016] According to an embodiment of the present application, the method for updating the key includes: setting a key rotation strategy in the national secret obfuscation encryption tool, and the key rotation strategy triggers the key update based on the time period or data transmission volume; when the triggering condition is met, the system page end regenerates a new first encryption algorithm key, and transmits the key update instruction to the national secret obfuscation encryption tool through the first encryption channel; the national secret obfuscation encryption tool updates the corresponding key string in the local key string database, and synchronously updates the key information stored on the server.

[0017] According to an embodiment of the present application, the national secret obfuscation encryption tool includes an anomaly detection module, which is used to monitor abnormal behavior in the data transmission process in real time. When abnormal behavior is detected, the national secret obfuscation encryption tool immediately interrupts the current communication and triggers an alarm mechanism. The abnormal behavior includes a sudden increase in data transmission volume, the number of decryption failures exceeding a threshold, and the number of illegal key attempts exceeding a threshold.

[0018] The second aspect of the present application provides an obfuscation encryption device, including: a first transmission module, used to establish a first encryption channel between the system page end and the national secret obfuscation encryption tool, and based on the Hypertext Transfer Protocol Security, transmit data processed by the first encryption algorithm through the first encryption channel; a security verification module, used to use the national secret obfuscation encryption tool to receive data processed by the first encryption algorithm and perform security verification to obtain the key string and national secret algorithm type corresponding to the first encrypted data; a re-encryption module, used to decrypt the first encrypted data based on the key string and national secret algorithm type in a secure isolation environment inside the national secret obfuscation encryption tool, and re-encrypt the decrypted data using the national secret algorithm to obtain the re-encrypted data; a second transmission module, used to transmit the re-encrypted data to the server through a second encryption channel, and the second encryption channel uses the national secret algorithm and adopts a hardware cipher machine to perform encryption.

[0019] The third aspect of the present application provides an electronic device, comprising: one or more processors; a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above method.

[0020] The fourth aspect of the present application further provides a computer-readable storage medium having a computer program or instructions stored thereon, which implements the steps of the above method when the computer program or instructions are executed by a processor.

[0021] The fifth aspect of the present application further provides a computer program product, comprising a computer program or instructions, which implement the steps of the above method when executed by a processor. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The above contents and other objects, features and advantages of the present application will become more apparent through the following description of the embodiments of the present application with reference to the accompanying drawings, in which:

[0023] Figure 1 Schematically illustrates an application scenario diagram of the obfuscation encryption method, apparatus, device, medium, and program product according to an embodiment of the present application;

[0024] Figure 2 The following schematically shows a flow chart of an obfuscation encryption method according to an embodiment of the present application;

[0025] Figure 3 The following schematically shows an architecture diagram of an obfuscation encryption method according to an embodiment of the present application;

[0026] Figure 4 A flowchart of a method for performing security verification according to an embodiment of the present application is schematically shown;

[0027] Figure 5A flowchart schematically illustrates a method for updating a key according to an embodiment of the present application;

[0028] Figure 6 A block diagram schematically illustrates a structure of an obfuscation encryption device according to an embodiment of the present application; and

[0029] Figure 7 A block diagram of an electronic device suitable for implementing an obfuscation encryption method according to an embodiment of the present application is schematically shown. DETAILED DESCRIPTION

[0030] Hereinafter, embodiments of the present application will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present application. In the detailed description below, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present application. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessarily confusing the concepts of the present application.

[0031] The terms used herein are only for describing specific embodiments and are not intended to limit the present application. The terms "comprise," "include," etc. used herein indicate the presence of features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0032] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0033] When expressions such as "at least one of A, B, and C, etc." are used, they should generally be interpreted in accordance with the meaning commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0034] In the technical solution of this application, the user information involved (including but not limited to user personal information, user image information, user device information, such as location information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with relevant laws, regulations and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0035] In the scenario of using personal information for automated decision-making, the methods, devices, and systems provided in the embodiments of the present application all provide users with corresponding operation portals for users to choose to agree or reject the automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered. The expression "automated decision-making" here refers to the activity of automatically analyzing and evaluating an individual's behavioral habits, interests and hobbies, or economic, health, credit status, etc. through computer programs and making decisions. The expression "expert decision-making" here refers to the activity of making decisions by people who specialize in a certain field, have specialized experience, knowledge and skills, and have reached a certain level of professionalism.

[0036] An embodiment of the present application provides an obfuscation encryption method, comprising: establishing a first encrypted channel between a system page and a national secret obfuscation encryption tool, transmitting data processed with a first encryption algorithm through the first encrypted channel based on the Hypertext Transfer Protocol Secure (HTTPS); receiving the data processed with the first encryption algorithm using the national secret obfuscation encryption tool and performing security verification to obtain a key string and national secret algorithm type corresponding to the first encrypted data; decrypting the first encrypted data within a secure, isolated environment within the national secret obfuscation encryption tool based on the key string and national secret algorithm type, and re-encrypting the decrypted data using the national secret algorithm to obtain re-encrypted data; and transmitting the re-encrypted data to a server through a second encrypted channel, wherein the second encrypted channel uses the national secret algorithm and employs a hardware cryptographic machine for encryption. The obfuscation encryption method of the present embodiment establishes a first encrypted channel based on HTTPS, initially encrypts the data using the first encryption algorithm, then decrypts it using the national secret obfuscation encryption tool, re-encrypts it using the national secret algorithm, and transmits it to the server through a second encrypted channel encrypted with the national secret algorithm using the hardware cryptographic machine, thereby forming a double-layer encryption protection, greatly enhancing the confidentiality and integrity of the data during transmission and effectively resisting the risks of eavesdropping and tampering. At the same time, the encryption method of the embodiment of the present application supports multiple encryption algorithms, which can be flexibly selected according to different scenarios and security requirements. In addition, the setting of a secure isolation environment ensures that the encryption operation is not subject to external interference and guarantees data security.

[0037] Figure 1The following schematically illustrates an application scenario of the obfuscation encryption method according to an embodiment of the present application.

[0038] like Figure 1 As shown, the application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 is used as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links or optical fiber cables.

[0039] A user may use a first terminal device 101, a second terminal device 102, or a third terminal device 103 to interact with a server 105 via a network 104 to receive or send messages, etc. Various communication client applications may be installed on the first terminal device 101, the second terminal device 102, or the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (for example only).

[0040] The first terminal device 101 , the second terminal device 102 , and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0041] The server 105 may be a server that provides various services, such as a background management server (for example only) that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process received data such as user requests, and feed back processing results (e.g., web pages, information, or data obtained or generated based on user requests) to the terminal devices.

[0042] It should be noted that the obfuscation encryption method provided in the embodiment of the present application can generally be executed by the server 105. Accordingly, the obfuscation encryption device provided in the embodiment of the present application can generally be set in the server 105. The obfuscation encryption method provided in the embodiment of the present application can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Accordingly, the obfuscation encryption device provided in the embodiment of the present application can also be set in a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0043] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is merely illustrative. Any number of terminal devices, networks and servers may be provided as required.

[0044] The following will be based on Figure 1 The scene described by Figures 2 to 5 The obfuscation encryption method according to the embodiment of the present application is described in detail.

[0045] Figure 2 The following schematically shows a flow chart of an obfuscation encryption method according to an embodiment of the present application; Figure 3 The following schematically shows an architecture diagram of an obfuscation encryption method according to an embodiment of the present application.

[0046] like Figure 2 and Figure 3 As shown, the obfuscation encryption method of this embodiment includes operations S210 to S240.

[0047] In operation S210, a first encryption channel is established between the system page end and the national secret obfuscation encryption tool, and data processed by the first encryption algorithm is transmitted through the first encryption channel based on the Hypertext Transfer Protocol Security.

[0048] In an embodiment of this application, a primary encrypted channel based on the Hypertext Transfer Protocol (HTTPS) is established between the system page and the national secret obfuscation encryption tool. This provides a dynamic, highly secure communication encryption solution. This solution allows users to flexibly select encryption algorithms (such as SM2, SM3, SM4, or other national secret algorithms or general encryption algorithms) based on their actual needs. The system page dynamically generates a one-time key for the primary encryption algorithm during each communication, which is used only for the current session, ensuring the key's uniqueness and timeliness. During data transmission, the data to be transmitted is first encrypted using the user-specified encryption algorithm and the dynamically generated key, and then transmitted to the national secret obfuscation encryption tool via HTTPS. HTTPS provides transport-layer encryption, ensuring data security during network transmission, while the national secret algorithm further strengthens data protection through application-layer encryption, forming a dual-layer protection mechanism. The dynamic key mechanism effectively avoids the risk of leakage caused by long-term key storage and reuse. Even if an attacker intercepts encrypted data, they cannot decrypt past communications. Dynamic algorithm selection increases the difficulty of cracking. Even if some algorithms are cracked, other algorithms can still ensure communication security. In addition, the solution is highly flexible and compliant. Users can choose appropriate encryption algorithms based on specific scenarios, balance performance and security requirements, and meet domestic cryptographic compliance requirements for sensitive areas such as government affairs and finance.

[0049] Return to reference Figure 2 and Figure 3In operation S220, a national secret obfuscation encryption tool is used to receive data processed by the first encryption algorithm and perform security verification to obtain a key string and a national secret algorithm type corresponding to the first encrypted data, wherein the keys in the key string can be rotated and updated.

[0050] In an embodiment of the present application, the first encrypted data is generated based on a user operation through processing with a first encryption algorithm. Therefore, the first encrypted data, as a data carrier generated by a user operation, is associated with user information.

[0051] Figure 4 The flowchart of the method for performing security verification according to an embodiment of the present application is schematically shown.

[0052] like Figure 4 As shown, the method for performing security verification in this embodiment includes operations S410 to S440.

[0053] In operation S410 , in response to receiving first encrypted data, a user identifier is extracted from basic user information, wherein the first encrypted data is associated with the basic user information.

[0054] In an embodiment of the present application, user identifiers are extracted from user cookies (Cookies are small text files stored by websites in the user's browser to record user identity, preferences, behavioral data, and other information). This mainly includes: the front-end reads browser-stored cookies (such as document.cookie) through JavaScript, or the back-end parses the Cookie field in the HTTP request header to extract predefined identifier key-value pairs (such as user_id or session_token); for encrypted or encoded identifiers, further decoding or decryption is required, and the integrity is verified through hash signatures, and the validity period is checked in combination with timestamps to ensure security. On the one hand, this technology can realize user identity recognition, supporting both temporary behavior tracking of anonymous users (such as device fingerprint device_id) and account association and permission control for logged-in users; on the other hand, it can optimize session management, quickly retrieve session data, and maintain user login status.

[0055] In operation S420 , an institution unique identifier associated with the user identifier is obtained from a remote dictionary service.

[0056] In the embodiments of the present application, obtaining a unique organization identifier associated with a user identifier from a remote dictionary service is a key technical approach to improving system performance and data access efficiency. The core method includes: first, storing the association between users and organizations through a properly designed remote dictionary service data structure (e.g., a hash or string type). For example, a key name (e.g., user_org:12345) is constructed using the user identifier (e.g., user_id) as part of the key, and the organization identifier (e.g., org_id) and other related information is recorded in the value. Second, the server sends a query command (e.g., HGET or GET) through the remote dictionary service client to quickly locate and retrieve the target data. If the data does not exist, a null value is returned, triggering data initialization logic. Furthermore, to avoid long-term memory usage, a reasonable expiration time (TTL) is set for the cached data. For example, after the user logs in, the organization information is cached for 30 minutes. After the timeout, it automatically expires and the database is queried again for updates. This mechanism has significant effects: on the one hand, the in-memory storage feature of the remote dictionary service reduces query response time to microseconds, significantly improving the system's performance in high-concurrency scenarios. For example, compared with database queries, the throughput of the remote dictionary service can be increased by more than 10 times; on the other hand, by transferring high-frequency queries (such as the user's institution) to the remote dictionary service, the database load can be greatly reduced, saving hardware costs.

[0057] In operation S430, based on the organization unique identifier, the corresponding key string and national encryption algorithm type are queried from the key string database.

[0058] In an embodiment of this application, the key string and national encryption algorithm type are queried from a key string database based on the organization's unique identifier, ensuring information security and compliance. First, a structured database table is constructed, storing the organization identifier (such as org_id), key string (encryption_key), and national encryption algorithm type (such as SM2, SM3, or SM4) as key fields to ensure data relevance. Second, after receiving the organization identifier, the server uses a database query statement (such as SELECT encryption_key, algorithm_type FROM key_database WHERE org_id = 'ORG_A001') to accurately retrieve the corresponding record. If no record is found, an error message is returned or the key initialization process is triggered. Finally, the query results (key string and algorithm type) are returned to the application layer for subsequent encryption, decryption, or signature verification operations. On the one hand, this mechanism ensures the confidentiality, integrity and authenticity of data transmission and storage by allocating exclusive keys and algorithms to different institutions, especially in sensitive areas such as finance and government affairs, to meet compliance requirements for information security and password management; on the other hand, it supports flexible expansion, allowing institutions to choose the type of national secret algorithm according to their own needs, thereby enhancing the system's autonomous and controllable capabilities. At the same time, national secret algorithms (such as SM4) perform well in encryption speed and resource consumption, and effectively resist cryptographic attacks.

[0059] In operation S440 , it is verified that the key string and the national encryption algorithm type match the preset security policy.

[0060] In an embodiment of the present application, first, the preset security policy needs to clearly define the compliance requirements of the key string (such as length ≥ 32 bytes, hexadecimal or Base64 encoding format, and set validity period) and the support range of the national secret algorithm type (such as only allowing SM2, SM3, and SM4) to form an executable rule base; secondly, the verification process is implemented through multi-dimensional verification: first, format verification, checking whether the key string conforms to the predefined format to avoid parsing failure due to illegal characters or encoding errors; second, algorithm matching, comparing the queried algorithm type with the list allowed by the policy to ensure that only compliant algorithms are used; third, validity period verification, if the key is associated with a validity period, check whether the current time is within the validity period to prevent expired keys from being abused; finally, if all conditions are met, it is determined to be a match, otherwise it is marked as a mismatch and triggers an alarm or denial of service. On the one hand, this mechanism significantly reduces the risk of cryptographic attacks by enforcing the use of high-strength keys and compliant algorithms. For example, the 128-bit key of the SM4 algorithm effectively resists brute force cracking. On the other hand, it simplifies operations and maintenance processes, reduces manual review costs through centralized management policies, supports audit traceability, and logs the verification process to facilitate subsequent security incident investigations. For example, in financial transactions, the system can verify that user keys and algorithms comply with bank security policies, ensuring the legitimacy of transaction signatures. In government systems, it can prevent the leakage of sensitive information during document transmission due to non-compliant algorithms.

[0061] In the embodiments of this application, national secret algorithms (such as SM1, SM2, SM3, and SM4) are integrated with data obfuscation technology. Through a dynamic key string management mechanism, key strings are dynamically obtained based on user identification, timestamp, and other rules, avoiding the security risks brought by fixed keys. At the same time, a multi-algorithm type adaptation scheme is designed to flexibly select national secret algorithms to meet the needs of different scenarios, and a multi-dimensional security verification process is established to perform integrity and legitimacy verification on the received encrypted data. The combination of national secret algorithms and obfuscation technology significantly improves the data's resistance to cracking during transmission and storage, and is particularly suitable for government affairs and finance, which have high security requirements. The dynamic key string mechanism effectively limits the scope of key leakage and ensures the continuous security of the system. Multi-algorithm support enhances system compatibility and scalability, adapting to diverse encryption needs. The comprehensive security verification process prevents malicious data intrusion and ensures system stability and reliability.

[0062] Figure 5 The flowchart of the key updating method according to an embodiment of the present application is schematically shown.

[0063] like Figure 5 As shown, the key updating method of this embodiment includes operations S510 to S530.

[0064] In operation S510, a key rotation policy is set in the national secret obfuscation encryption tool, and the key rotation policy triggers key update based on a time period or data transmission volume.

[0065] In the embodiments of this application, a key rotation policy is implemented within the National Cryptography Obfuscation Encryption Tool. This security mechanism triggers dynamic key updates based on preset time periods or data transfer thresholds, aiming to reduce the risk of long-term key exposure and enhance the encryption system's resilience to attacks. Trigger conditions include time-based triggering (e.g., automatic key generation every 24 hours or every hour), data transfer volume triggering (e.g., key update after cumulative data transfer of 1GB or 500MB), or a hybrid strategy (e.g., dual triggering every 24 hours or after 500MB of data transfer). This policy, combined with National Cryptography algorithms (e.g., SM4 random key generation and SM2 secure key distribution), enables automated key management. By regularly updating keys, the key rotation policy significantly reduces the impact of a key leak. Even if the old key is compromised, an attacker can only decrypt data for a limited period of time and cannot access subsequent communications, effectively protecting against long-term eavesdropping or brute force attacks. Furthermore, the dynamic key mechanism enhances the system's unpredictability, making it particularly suitable for combating potential threats such as quantum computing. At the functional level, this strategy can flexibly adjust rotation parameters based on business scenarios (e.g., short cycles for high-frequency trading systems and long cycles for low-frequency scenarios), balancing security and performance overhead. For example, financial trading systems can ensure the security of funds through high-frequency rotation, while IoT devices can appropriately extend the cycle to reduce resource consumption. Its beneficial effects are reflected in three aspects: first, by automating the key generation, distribution, and destruction processes, it reduces operational risks caused by manual intervention; second, it improves the confidentiality and integrity of data transmission, ensuring that sensitive information is always protected by the latest keys throughout its lifecycle; and third, it enhances the overall security resilience of the system, providing reliable encryption protection for high-security scenarios such as government affairs and finance. Through the coordinated application of key rotation strategies and national secret algorithms, encryption tools have achieved dynamic and intelligent key management.

[0066] In operation S520, when the trigger condition is met, the system page end regenerates a new first encryption algorithm key and transmits the key update instruction to the national secret obfuscation encryption tool through the first encryption channel.

[0067] In an embodiment of the present application, within the key rotation mechanism, when the system detects that a preset trigger condition (such as a time period expiration or data transmission volume reaching a threshold) has been met, the system interface automatically initiates the key update process. First, the system invokes a cryptographically secure random number generator to generate a new key that complies with national security standards (e.g., a 128-bit SM4 symmetric key). This key is then hashed to ensure randomness and uniqueness, preventing key prediction or reuse. The system interface then encapsulates the new key and update instruction into an encrypted message and securely transmits it to the national security obfuscation encryption tool via an established primary encryption channel (based on the HTTPS protocol and using dual protection of SM2 asymmetric encryption or SM4 symmetric encryption). This channel implements identity authentication, data encryption, and integrity verification to ensure that the key update instruction is protected from theft, tampering, or forgery during transmission. Upon receiving the instruction, the national security tool verifies the message source and content integrity. Once verified, it replaces the old key and simultaneously reports the update result to the system interface. Once both parties confirm the key update is successful, the old key is securely destroyed (e.g., through memory overwrite or key erasure) to prevent residual risks. The automated key update process reduces manual intervention and lowers the risk of operational errors.

[0068] In operation S530, the national secret obfuscation encryption tool updates the corresponding key string in the local key string database and synchronously updates the key information stored on the server.

[0069] In an embodiment of the present application, in the key rotation process of the National Secret Obfuscation Encryption Tool, when a new key is received, the tool will immediately update the local key string database, mark the old key as "invalid" and insert a new key entry, and at the same time update the key version number or timestamp to identify the key status to ensure the accuracy and traceability of local key management. Subsequently, the tool synchronizes the new key information (including key ID, value, effective time, etc.) to the server through a secure channel (such as TLS encryption). After verification, the server updates its stored key records and notifies the associated devices or services to achieve global consistency of key information. This mechanism can effectively avoid communication failures caused by inconsistent key versions, while retaining historical key records to support key rollback in abnormal situations. Through automated synchronization, the system not only improves the reliability of encrypted communications in a distributed environment, but also enhances the auditability of key management.

[0070] Return to reference Figure 2 and Figure 3 In operation S230, based on the key string and the national secret algorithm type, the first encrypted data is decrypted in a secure isolation environment inside the national secret obfuscation encryption tool, and the decrypted data is re-encrypted using the national secret algorithm to obtain the re-encrypted data.

[0071] In an embodiment of the present application, first, a secure isolation environment is constructed inside the national secret obfuscation encryption tool, and the external attack surface is blocked through physical / logical isolation to ensure that the key string, algorithm logic and data operations are executed within the security domain to prevent side channel attacks or memory theft; secondly, the decryption and re-encryption process is completed in the isolated environment - in the decryption stage, the queried key string (such as SM4 symmetric key) is securely injected, the decryption engine is initialized according to the national secret algorithm type (such as SM4-cipher block chaining mode), and the underlying national secret library (such as the national secret secure socket layer protocol) is called to decrypt the first encrypted data (including ciphertext and initialization vector (IV)) to restore the original plaintext data; in the re-encryption stage, a new national secret algorithm (such as upgrading to SM4-Galois / counter mode) and key (which may be the same key or a dynamically generated new key) are dynamically selected according to business needs or security policies, and encryption operations are performed on the new plaintext data to generate re-encrypted data containing information such as ciphertext and authentication tag, and ensure that only the encryption result is transmitted out of the isolated environment through a secure channel, and the plaintext data is immediately destroyed within the environment. This approach effectively protects against data tampering and leakage through the dual protection of secure isolation and national secret algorithms (such as the authenticated encryption feature of SM4-Galois / Counter Mode). Furthermore, it supports dynamic algorithm switching and flexible key management, adapting to scenarios such as cross-border data transmission (such as re-encryption using the target country's compliant algorithm) and tiered protection of sensitive data, reducing reliance on foreign encryption technology and improving supply chain security. This approach ensures data security throughout its entire lifecycle while achieving a balance between compliance and business flexibility, providing reliable protection for critical information infrastructure.

[0072] In the embodiments of this application, the secure isolation environment is a hardware security module (HSM) or a trusted execution environment (TEE), which is used to prevent key strings and sensitive data from being leaked or tampered with during the decryption and re-encryption processes. As an independent encryption device, the HSM relies on tamper-resistant hardware and a dedicated encryption chip to implement closed management of key generation, storage, use, and destruction, ensuring that key materials are never exposed to external systems in plaintext and resisting side-channel theft through physical attack resistance. The TEE, on the other hand, divides independent security domains within a general-purpose computing platform through hardware-level isolation, restricting decryption and re-encryption operations to encrypted memory space, completely isolating it from the external operating system. It also supports dynamic integrity verification and remote attestation to prevent malware tampering or environmental forgery. The collaboration between the two can effectively block risks such as key leakage (such as memory scanning and debugging interface attacks), data tampering (such as man-in-the-middle hijacking of plaintext) and replay attacks (such as intercepted ciphertext and reuse). Typical application scenarios include HSM encryption of bank card PIN codes in financial payments, TEE isolation and decryption of sensitive documents in government cloud environments, and IoT devices completing firmware upgrade package integrity verification in TEE. This provides enterprises with a high-security data protection solution that balances cost and performance while meeting national encryption compliance requirements.

[0073] In the embodiments of this application, national secret algorithms include one or more combinations of Commercial Secret Algorithm No. 1 (SM1), Elliptic Curve Public Key Cryptography (SM2), Cryptographic Hash (SM3), and Block Cipher (SM4). These algorithms can be flexibly configured based on business security requirements to form a multi-layered protection system. SM1, a symmetric block encryption algorithm, is widely used in high-security scenarios such as financial IC cards; SM2, based on elliptic curve cryptography (ECC), provides digital signatures, key exchange, and public key encryption; SM3, a cryptographic hash algorithm, outputs a 256-bit digest value, suitable for data integrity verification and digital signature generation; and SM4, a symmetric block encryption algorithm, supports 128-bit keys and block lengths, making it suitable for the encrypted transmission of large amounts of data. The re-encryption process uses encryption modes and padding methods corresponding to the national secret algorithm type. For example, SM4 can be combined with CBC (Cipher Block Chaining) or GCM (Galois / Counter) mode. The former requires PKCS#7 padding to accommodate block length, while the latter uses authenticated encryption (AEAD) to ensure both confidentiality and integrity. SM2 defaults to the ECIES (Elliptic Curve Integrated Cryptography) framework for public key encryption, combining a key derivation function (KDF) with a symmetric encryption algorithm (such as SM4) to achieve hybrid encryption. SM3 is directly embedded in the digital signature process as a hash function (for example, an SM2 signature requires the calculation of an SM3 digest on the message). Through the dynamic combination of algorithms and modes, the system can customize the optimal security strategy for different scenarios (such as data storage encryption, network communication encryption, and identity authentication).

[0074] In operation S240, the re-encrypted data is transmitted to the server through a second encryption channel, and the second encryption channel uses a national secret algorithm and a hardware cipher machine to perform encryption.

[0075] In an embodiment of the present application, the hardware cipher machine of the second encryption channel supports accelerated operations of the national secret algorithm, and data interaction is carried out between the hardware cipher machine and the national secret obfuscation encryption tool through a dedicated interface to ensure the efficiency and security of the encryption process.

[0076] In the embodiments of this application, to ensure the absolute security of re-encrypted sensitive data during transmission, the system transmits data via a dedicated second encryption channel. This channel strictly adheres to national secret algorithm standards and utilizes a hardware cryptographic engine as its core encryption engine. Specifically, before data leaves the local security domain, the system first performs a second encryption (i.e., re-encryption) on the original ciphertext to generate an encrypted data packet that complies with national secret standards. This data packet is then transmitted to the server via a pre-configured second encryption channel, which utilizes either the SM4-GCM block cipher mode or the SM2-SM3 hybrid encryption framework (dynamically selected based on business needs) to ensure data confidentiality, integrity, and resistance to replay attacks. Encryption operations in this second encryption channel are performed by a hardware cryptographic engine (such as a national secret HSM or PCI-E encryption card) deployed at the network edge. This device, based on a dedicated cryptographic chip, implements full key lifecycle management (key generation, storage, use, and destruction are all performed in a hardware-isolated environment) and resists side-channel attacks through physical tamper-resistant features (such as epoxy encapsulation and active destruction circuitry). In addition, the hardware cipher machine is deeply integrated with the transport layer protocol (such as the customized national secret TLS 1.2 protocol stack), automatically completing two-way identity authentication, key negotiation and parameter verification when establishing an encrypted channel, ensuring that the channel itself cannot be forged and only authorized parties can access it.

[0077] After the server receives the re-encrypted data, the method may also include: decrypting the data using the corresponding national secret algorithm and key string through the hardware cryptographic machine, and verifying the integrity and source legitimacy of the decrypted data. Specifically, the hardware cryptographic machine first extracts the pre-injected national secret key string (such as SM4 symmetric key or SM2 private key) from the internal secure storage medium (such as a tamper-proof encryption chip or HSM key library), and automatically matches the corresponding national secret algorithm (such as SM4-CBC mode decryption or SM2 asymmetric decryption) based on the algorithm identifier in the ciphertext header. During the decryption process, the hardware cryptographic machine performs core operations through a dedicated encryption coprocessor to ensure that the key material always resides in an encrypted form in a hardware isolation environment, avoiding the risk of key leakage due to host memory scanning or exposure of the debug interface. After decryption is completed, the system immediately performs integrity verification and source legitimacy verification on the plaintext data. Integrity verification involves using the national secret hash value associated with the ciphertext (such as the SM3 digest) or message authentication code (MAC) (such as the GMAC built into the SM4-GCM mode) to recalculate the hash value of the plaintext data through the hardware cipher machine and compare it with the original value to ensure that the data has not been tampered with. Source legitimacy verification includes, if the ciphertext is protected by a digital signature (such as an SM2 signature), verifying the validity of the signature using the SM2 public key built into the hardware cipher machine, and confirming the identity of the signer (such as a national secret digital certificate issued by a CA) through certificate chain parsing. If the ciphertext is generated through key negotiation (such as the SM2 key exchange protocol), verifying whether the derivation process of the session key complies with national secret standards (such as the key derivation rules defined in GB / T 38636). In addition, the hardware cipher machine generates real-time audit logs during the decryption and verification process, recording the operation time, key identification, algorithm type, and verification results, and digitally signing the logs using the national secret SM9 identification cryptography technology to ensure traceability. If any verification step fails (e.g., a hash value mismatch or an invalid signature), the system immediately triggers a security response mechanism, including discarding the plaintext data, blocking further transmission, and reporting the security incident. This mechanism effectively protects against ciphertext tampering attacks, forged data injection, and key misuse.

[0078] In an embodiment of the present application, to further enhance the proactive defense capabilities of the National Secret Obfuscation Encryption Tool in complex network environments, the tool may also include an anomaly detection module. This module monitors abnormal behavior during data transmission in real time, establishing a dynamic threat awareness and emergency response mechanism. Upon detecting abnormal behavior, the tool immediately interrupts current communication and triggers an alert. Abnormal behavior includes a sudden increase in data transmission volume, a number of decryption failures exceeding a threshold, and a number of illegal key attempts exceeding a threshold. Specifically, this module utilizes a multi-dimensional anomaly detection algorithm to establish a dynamic monitoring system for three types of abnormal behavior. For sudden increases in data transmission volume, a sliding window algorithm is used to calculate packet traffic per unit time. A threshold is dynamically calculated by combining a historical traffic baseline (e.g., the average of the last seven days) with the standard deviation. If the current traffic exceeds three standard deviations of the baseline value (or a parameter dynamically adjusted based on the business scenario), it is identified as an abnormal traffic spike. This type of anomaly may indicate a data theft attempt (e.g., an attacker stealing encrypted files through high-volume transmission), triggering an immediate emergency response. If decryption failures exceed the limit, the system analyzes logs from hardware cryptographic machines or software encryption engines to generate real-time statistics on decryption failures for national encryption algorithms (such as SM4 symmetric encryption and SM2 asymmetric encryption). If decryption failures occur five times in a row (or a custom threshold), and the error types are concentrated in anomalies such as "key mismatch" or "MAC verification failure," the system identifies a key leak or man-in-the-middle attack risk. For example, an attacker might attempt to decrypt data by forging certificates or stealing keys. The system will mitigate this threat through alerts and key rotation mechanisms. If illegal key attempts exceed the limit, the system monitors the number of invalid key entries per unit time during key negotiation and authentication (such as SM2 key exchange and SM9 identification code). If more than 10 (or a dynamic threshold) attempts are detected for randomly forged keys, expired certificates, or signature verification failures, the system identifies a brute force or dictionary attack. These attacks are often used to steal session keys or impersonate legitimate devices. The system will temporarily freeze the keys and update firewall rules to block the attack source.

[0079] When the anomaly detection module captures any of the above anomalies, the system will perform a triple emergency response, including: Communication interruption: forcibly close the current connection through the underlying network driver and clear the session state table to prevent attackers from continuing to infiltrate through the established communication channel; Alarm triggering: Generate a structured security event, including the anomaly type, occurrence time, source / destination IP, associated session ID and attack characteristics, and push it to the Security Operation Center (SOC) through the national secret SM4-GCM encrypted channel to ensure that the alarm information is not tampered with during transmission; Self-healing mechanism: Temporarily freeze the suspected attacked key or session (such as prohibiting it from being used again within 30 minutes), and trigger the key rotation process (such as revoking the SM2 certificate and reissuing it), and update the firewall rules to block subsequent access from suspicious IPs.

[0080] Furthermore, the anomaly detection module utilizes adaptive learning technology, dynamically optimizing threshold parameters through machine learning algorithms to avoid both false positives (such as during normal business peaks) and false negatives (such as during low-frequency but persistent attacks). For example, in government extranet scenarios, the system can automatically adjust baseline thresholds based on historical traffic patterns (such as the daily peak in official document transmission between 9:00 AM and 11:00 AM). In financial payment scenarios, the system can accurately identify small, high-frequency fraud attempts by correlating transaction amounts with decryption failure rates. Through this mechanism, the National Secret Obfuscation Encryption Tool effectively blocks threats such as key leakage, man-in-the-middle attacks, and brute force attacks.

[0081] Based on the above obfuscation encryption method, this application also provides an obfuscation encryption device. Figure 6 The device is described in detail.

[0082] Figure 6 The structural block diagram of the obfuscation encryption device according to an embodiment of the present application is schematically shown.

[0083] like Figure 6 As shown, the obfuscation encryption device 800 of this embodiment includes a first transmission module 810 , a security verification module 820 , a re-encryption module 830 and a second transmission module 840 .

[0084] The first transmission module 810 is used to establish a first encryption channel between the system page end and the national secret obfuscation encryption tool, and transmit data processed by the first encryption algorithm through the first encryption channel based on the Hypertext Transfer Protocol Security Protocol. In one embodiment, the first transmission module 810 can be used to perform the operation S210 described above, which will not be repeated here.

[0085] The security verification module 820 is used to use the national secret obfuscation encryption tool to receive data processed by the first encryption algorithm and perform security verification to obtain the key string and national secret algorithm type corresponding to the first encrypted data, wherein the keys in the key string can be rotated and updated. In one embodiment, the security verification module 820 can be used to perform the operation S220 described above, which will not be repeated here.

[0086] The re-encryption module 830 is used to decrypt the first encrypted data based on the key string and the national secret algorithm type, in a secure isolation environment inside the national secret obfuscation encryption tool, and re-encrypt the decrypted data using the national secret algorithm to obtain the re-encrypted data. In one embodiment, the re-encryption module 830 can be used to perform the operation S230 described above, which will not be repeated here.

[0087] The second transmission module 840 is used to transmit the re-encrypted data to the server through the second encryption channel. The second encryption channel uses the national secret algorithm and adopts a hardware cipher machine to perform encryption. In one embodiment, the second transmission module 840 can be used to perform the operation S240 described above, which will not be repeated here.

[0088] According to embodiments of the present application, any multiple modules among the first transmission module 810, the security verification module 820, the re-encryption module 830, and the second transmission module 840 may be combined into a single module, or any one of these modules may be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules may be combined with at least part of the functionality of other modules and implemented in a single module. According to embodiments of the present application, at least one of the first transmission module 810, the security verification module 820, the re-encryption module 830, and the second transmission module 840 may be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or may be implemented in hardware or firmware through any other reasonable means of circuit integration or packaging, or implemented in any one of the three implementation methods of software, hardware, and firmware, or any appropriate combination of any of these. Alternatively, at least one of the first transmission module 810 , the security verification module 820 , the re-encryption module 830 and the second transmission module 840 may be at least partially implemented as a computer program module, which may perform corresponding functions when executed.

[0089] Figure 7 A block diagram of an electronic device suitable for implementing an obfuscation encryption method according to an embodiment of the present application is schematically shown.

[0090] like Figure 7 As shown, an electronic device 900 according to an embodiment of the present application includes a processor 901, which can perform various appropriate actions and processes based on programs stored in a read-only memory (ROM) 902 or programs loaded from a storage unit 908 into a random access memory (RAM) 903. The processor 901 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or related chipsets and / or a dedicated microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 901 may also include onboard memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for performing different actions of the method flow according to the embodiment of the present application.

[0091] Various programs and data required for the operation of the electronic device 900 are stored in the RAM 903. The processor 901, the ROM 902, and the RAM 903 are connected to each other via a bus 904. The processor 901 performs various operations of the method flow according to the embodiment of the present application by executing the programs in the ROM 902 and / or the RAM 903. It should be noted that the programs may also be stored in one or more memories other than the ROM 902 and the RAM 903. The processor 901 may also perform various operations of the method flow according to the embodiment of the present application by executing the programs stored in one or more memories.

[0092] According to an embodiment of the present application, electronic device 900 may further include an input / output (I / O) interface 905, which is also connected to bus 904. Electronic device 900 may also include one or more of the following components connected to I / O interface 905: an input section 906 including a keyboard, mouse, etc.; an output section 907 including devices such as a cathode ray tube (CRT), liquid crystal display (LCD), and speakers; a storage section 908 including a hard disk; and a communication section 909 including a network interface card such as a LAN card or modem. Communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to I / O interface 905 as needed. Removable media 911, such as a magnetic disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed in drive 910 as needed, so that computer programs read from the removable media can be installed into storage section 908 as needed.

[0093] This application also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments, or may exist independently and not be incorporated into the device / apparatus / system. The computer-readable storage medium carries one or more programs, and when the one or more programs are executed, the method according to the embodiments of this application is implemented.

[0094] According to an embodiment of the present application, a computer-readable storage medium may be a non-volatile computer-readable storage medium, and may include, for example, but not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present application, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present application, a computer-readable storage medium may include the ROM 902 and / or RAM 903 described above and / or one or more memories other than ROM 902 and RAM 903.

[0095] The embodiments of the present application also include a computer program product, which includes a computer program containing program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the obfuscated encryption method provided in the embodiments of the present application.

[0096] The computer program executes the above functions defined in the system / device of the embodiment of the present application when the processor 901 executes the computer program. According to the embodiment of the present application, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0097] In one embodiment, the computer program may be stored on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may be transmitted and distributed in the form of a signal on a network medium, downloaded and installed via the communication portion 909, and / or installed from a removable medium 911. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to wireless, wired, or any suitable combination thereof.

[0098] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 909, and / or installed from a removable medium 911. When the computer program is executed by the processor 901, the above-mentioned functions defined in the system of the embodiment of the present application are performed. According to the embodiment of the present application, the systems, devices, means, modules, units, etc. described above can be implemented by computer program modules.

[0099] According to an embodiment of the present application, the program code for executing the computer program provided by the embodiment of the present application can be written in any combination of one or more programming languages. Specifically, these computer programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C" or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect via the Internet).

[0100] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the above-mentioned module, program segment, or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of the boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0101] Those skilled in the art will appreciate that the features described in the various embodiments of this application may be combined and / or coupled in various ways, even if such combinations or couplings are not explicitly described in this application. In particular, the features described in the various embodiments of this application may be combined and / or coupled in various ways without departing from the spirit and teachings of this application. All such combinations and / or couplings fall within the scope of this application.

Claims

1. A method for obfuscating encryption, characterized in that: The method comprises: Establishing a first encryption channel between the system page end and the national secret obfuscation encryption tool, and transmitting data processed by the first encryption algorithm through the first encryption channel based on the Hypertext Transfer Protocol secure protocol; Using a national secret obfuscation encryption tool to receive the data processed by the first encryption algorithm and perform security verification to obtain a key string and a national secret algorithm type corresponding to the first encrypted data; Based on the key string and the type of the national secret algorithm, in a secure isolated environment within the national secret obfuscation encryption tool, decrypt the first encrypted data, and re-encrypt the decrypted data using the national secret algorithm to obtain re-encrypted data; and The re-encrypted data is transmitted to the server through a second encryption channel, where the second encryption channel uses a national secret algorithm and a hardware cipher to perform encryption; The keys in the key string can be updated in rotation.

2. The method according to claim 1, characterized in that The encryption algorithm of the first encryption channel is dynamically selected by the user according to needs; and The key of the first encryption algorithm is dynamically generated by the system page and is only used in this communication.

3. The method according to claim 1, characterized in that The method for performing security verification includes: extracting a user identifier from basic user information in response to receiving the first encrypted data, wherein the first encrypted data is associated with the basic user information; obtaining, from a remote dictionary service, an institution-unique identifier associated with the user identifier; Based on the unique identifier of the organization, query the corresponding key string and national secret algorithm type from the key string database; and Verify that the key string and national encryption algorithm type match the preset security policy.

4. The method according to claim 1, wherein The secure isolation environment is a hardware security module or a trusted execution environment, which is used to prevent the key string and data from being leaked or tampered with during the decryption and re-encryption process.

5. The method according to claim 1, wherein The national secret algorithm type includes one or more combinations of Commercial Secret No. 1 algorithm, elliptic curve public key cryptography algorithm, cryptographic hash algorithm and block cipher algorithm; and The re-encryption process adopts the encryption mode and padding method corresponding to the national secret algorithm type.

6. The method according to claim 1, characterized in that The hardware cipher machine of the second encryption channel supports accelerated operations of the national secret algorithm, and data interaction is carried out between the hardware cipher machine and the national secret obfuscation encryption tool through a dedicated interface.

7. The method according to claim 1, characterized in that The method further comprises: After receiving the re-encrypted data, the server uses the corresponding national secret algorithm and key string to decrypt it through the hardware cipher machine, and verifies the integrity and source legitimacy of the decrypted data.

8. The method according to claim 1, characterized in that The method for updating the key includes: Setting a key rotation strategy in the national secret obfuscation encryption tool, wherein the key rotation strategy triggers key updates based on a time period or a data transmission volume; When the trigger condition is met, the system page regenerates a new first encryption algorithm key and transmits the key update instruction to the national secret obfuscation encryption tool through the first encryption channel; The national secret obfuscation encryption tool updates the corresponding key string in the local key string database and synchronously updates the key information stored on the server.

9. The method according to claim 1, characterized in that The national secret obfuscation encryption tool includes an anomaly detection module, wherein the anomaly detection module is used to monitor abnormal behavior during data transmission in real time. When the abnormal behavior is detected, the national secret obfuscation encryption tool immediately interrupts the current communication and triggers an alarm mechanism. The abnormal behaviors include a sudden increase in data transmission volume, a number of decryption failures exceeding a threshold, and a number of illegal key attempts exceeding a threshold.

10. A confusion encryption device, characterized in that: The device comprises: A first transmission module is used to establish a first encryption channel between the system page end and the national secret obfuscation encryption tool, and transmit data processed by the first encryption algorithm through the first encryption channel based on the Hypertext Transfer Protocol Secure Sockets Layer (HTTP). A security verification module, configured to receive the data processed by the first encryption algorithm using a national secret obfuscation encryption tool and perform security verification to obtain a key string and a national secret algorithm type corresponding to the first encrypted data; a re-encryption module, configured to decrypt the first encrypted data based on the key string and the national secret algorithm type, in a secure isolated environment within the national secret obfuscation encryption tool, and re-encrypt the decrypted data using the national secret algorithm to obtain re-encrypted data; and A second transmission module is used to transmit the re-encrypted data to the server through a second encryption channel, where the second encryption channel uses a national secret algorithm and adopts a hardware cipher machine to perform encryption; The keys in the key string can be updated in rotation.

11. An electronic device comprising: one or more processors; a memory for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 9.

12. A computer-readable storage medium having a computer program or instruction stored thereon, characterized in that: When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 9 are implemented.

13. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 9 are implemented.

Images