Data encryption method and device, data decryption method and device, equipment and medium
By using a multi-layered encryption mechanism to encrypt and encode the seed key with AES, the problem of seed keys being easily stolen and tampered with in existing encryption methods is solved, thus achieving high data security and integrity protection.
Patent Information
- Application Number
- CN202511070008.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-07-31
- Publication Date
- 2025-11-18
Smart Images
Figure CN120979642A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of data encryption, and in particular to a data encryption method, a decryption method, a device, equipment and a storage medium. BACKGROUND
[0002] At present, some existing encryption methods only use a single encryption algorithm and a fixed key, and lack flexible management of encryption parameters, making the encryption system vulnerable when facing complex attacks. In addition, the existing technology often lacks effective security mechanisms in the storage and transmission process of encrypted information, which can easily lead to the leakage of encryption keys and sensitive data. In particular, in scenarios involving dynamic password generation, the protection of seed keys is crucial, but existing methods are not perfect in encrypting and managing seed keys, which can easily lead to the theft or tampering of seed keys during storage or transmission, thereby threatening the security of the entire password system.
[0003] Therefore, how to improve the security of seed keys has become a technical problem to be solved by those skilled in the art. SUMMARY
[0004] In view of the above, the present application provides a data encryption method, a decryption method, a device, equipment and a storage medium, which aims to solve the above technical problems.
[0005] In a first aspect, the present application provides a data encryption method, which comprises:
[0006] obtaining encryption information for encryption;
[0007] encrypting the seed key according to the encryption information to obtain ciphertext of the seed key;
[0008] generating core information according to the ciphertext of the seed key and the name of the password algorithm file;
[0009] encoding the encrypted core information to obtain a target encryption result.
[0010] In one embodiment, the method of obtaining encryption information for encryption comprises:
[0011] obtaining an encryption key, a random number and the name of the password algorithm file from a password algorithm file library.
[0012] In one embodiment, the method of encrypting the seed key according to the encryption information to obtain the ciphertext of the seed key comprises:
[0013] encrypting the seed key using the encryption key and the random number through an AES encryption algorithm to obtain the ciphertext of the seed key.
[0014] In an embodiment, the core information is generated according to the ciphertext of the seed key and the name of the cryptographic algorithm profile, and includes:
[0015] The ciphertext of the seed key and the name of the cryptographic algorithm profile are spliced to obtain a spliced result.
[0016] The spliced result is taken as the core information.
[0017] In an embodiment, the core information is encrypted and encoded to obtain a target encryption result, including:
[0018] The storage key and the initial vector are obtained from the configuration center.
[0019] The core information is encrypted by an AES encryption algorithm using the storage key and the initial vector to obtain encrypted core information.
[0020] The encrypted core information is encoded to obtain the target encryption result.
[0021] In a second aspect, the application provides a data decryption method, and the method includes:
[0022] The target encryption result is decoded and decrypted to obtain core information.
[0023] The ciphertext of the seed key and the name of the cryptographic algorithm profile are determined according to the core information.
[0024] Decryption information used for decryption is obtained according to the name of the cryptographic algorithm profile.
[0025] The ciphertext of the seed key is decrypted according to the decryption information to obtain the seed key.
[0026] In an embodiment, the decryption information used for decryption is obtained according to the name of the cryptographic algorithm profile, and includes:
[0027] The name of the cryptographic algorithm profile is determined to obtain an encryption key and a random number from a cryptographic algorithm profile library.
[0028] In a third aspect, the application provides a data encryption device, and the data encryption device includes:
[0029] An obtaining module is configured to obtain encryption information used for encryption.
[0030] A first encryption module is configured to encrypt a seed key according to the encryption information to obtain a ciphertext of the seed key.
[0031] A generating module is configured to generate core information according to the ciphertext of the seed key and the name of the cryptographic algorithm profile.
[0032] The second encryption module is configured to encode the core information after encryption to obtain a target encryption result.
[0033] In a fourth aspect, the present application provides an electronic device, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory complete mutual communication through the communication bus.
[0034] The memory is configured to store a computer program.
[0035] The processor is configured to execute the program stored on the memory to implement the steps of the data encryption method of any one of the embodiments of the first aspect and / or the data decryption method of the second aspect.
[0036] In a fifth aspect, a computer readable storage medium is provided, which stores a computer program, and the computer program is executed by a processor to implement the steps of the data encryption method of any one of the embodiments of the first aspect and / or the data decryption method of the second aspect.
[0037] Compared with the prior art, the above technical solution provided by the embodiments of the present application has the following advantages:
[0038] According to the encryption information, the seed key is encrypted to obtain the ciphertext of the seed key, and according to the ciphertext of the seed key and the name of the password algorithm file, the core information is generated, encrypted and encoded to obtain the target encryption result. Through the multi-layer encryption mechanism, including the encryption of the seed key and the encryption and encoding of the core information, the confidentiality and integrity of the data are significantly enhanced. This multi-layer encryption method makes it difficult for attackers to crack the original seed key and sensitive information even if they obtain the encrypted data, thereby effectively preventing data leakage and tampering. BRIEF DESCRIPTION OF DRAWINGS
[0039] The accompanying drawings, which are incorporated into and form part of the specification, illustrate embodiments consistent with the present application and, together with the specification, serve to explain the principles of the application.
[0040] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the accompanying drawings needed to be used in the embodiments or prior art description will be briefly introduced. Obviously, for those skilled in the art, other drawings can also be obtained without creative labor based on these drawings.
[0041] Figure 1 The flowchart of the preferred embodiment of the data encryption method of the present application is shown in the figure;
[0042] Figure 2A flowchart diagram of a preferred embodiment of a data decryption method of the present application is shown in FIG. 1.
[0043] Figure 3 A module diagram of a preferred embodiment of a data encryption device of the present application is shown in FIG. 2.
[0044] Figure 4 A diagram of a preferred embodiment of an electronic device of the present application is shown in FIG. 3.
[0045] The implementation, functional features and advantages of the present application will be further described with reference to the embodiments and the accompanying drawings. DETAILED DESCRIPTION
[0046] In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and should not be used to limit the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without making any creative efforts fall within the scope of protection of the present application.
[0047] It should be noted that the descriptions involving "first", "second", etc. in the present application are only for the purpose of description and should not be understood as indicating or implying the relative importance of the technical features indicated or the number of the technical features indicated. Therefore, the features limited by "first" and "second" can explicitly or implicitly include at least one of the features. In addition, the technical solutions of various embodiments can be combined with each other, but it must be based on the fact that those of ordinary skill in the art can implement it. When the combination of technical solutions appears to be contradictory or unimplementable, it should be considered that the combination of technical solutions does not exist and is not within the scope of protection claimed by the present application.
[0048] Referring to FIG. 1, Figure 1 A method flow diagram of an embodiment of a data encryption method of the present application is shown in FIG. 1. The method is performed by an electronic device, which can be implemented by a software system and / or a hardware system. The data encryption method comprises:
[0049] Step S110: obtaining encryption information for encryption;
[0050] Step S120: encrypting the seed key according to the encryption information to obtain ciphertext of the seed key;
[0051] Step S130: generating core information according to the ciphertext of the seed key and the name of the password algorithm file;
[0052] Step S140: encoding the encrypted core information to obtain a target encryption result.
[0053] In the data encryption process, encryption information is a set of key parameters used to protect data security. These parameters define the type of encryption algorithm, key length, encryption mode, etc., ensuring the security of encrypted data. Encryption information can be stored in a secure configuration file, and only authorized applications or services can access it.
[0054] The required encryption information is extracted from a configuration center that securely stores encryption information or from a password algorithm library by calling a pre-configured encryption information acquisition interface or function. These encryption information is usually stored in a specific data structure or configuration file, containing parameters such as encryption algorithm type, key length, encryption mode, and padding method. For example, assume there is a Time-Based One-Time Password (TOTP) generation system that needs to encrypt the seed key. The encryption information obtained from the encryption information configuration center is: the encryption algorithm type is AES, the key length is 256 bits, the encryption mode is CBC mode, and the padding method is PKCS7.
[0055] The seed key is the core key for generating dynamic passwords, directly determining the security of dynamic passwords. Encrypting the seed key is to prevent it from being stolen during storage or transmission, thereby protecting the security of the dynamic password generation process. By encrypting the seed key, its security during storage and transmission is ensured, preventing the risk of dynamic passwords being forged due to key leakage.
[0056] The obtained encryption information can be used to select the corresponding encryption algorithm and parameters to perform encryption operations on the seed key. During encryption, strictly follow the specifications and procedures of the encryption algorithm to ensure the correctness and security of encryption. For example, if it is a symmetric encryption algorithm, use the encryption key to encrypt the seed key; if it is an asymmetric encryption algorithm, use the public key to encrypt. Following the above example, use the obtained AES-256-CBC-PKCS7 encryption information to encrypt the seed key. Assuming the original seed key is "seed_key_1234", after performing the encryption operation, the ciphertext of the seed key is "d3b1f9e7c4a8f6d2e5b3a9c7f4d6e5b".
[0057] After encrypting the seed key, its confidentiality is greatly enhanced. Even if it is illegally obtained during storage or transmission, attackers cannot obtain the original seed key due to the lack of correct decryption keys or information, effectively preventing the risk of dynamic passwords being forged or cracked, and improving the security and reliability of the entire system.
[0058] The generation of core information is to associate the encrypted seed key with the password algorithm file, so as to accurately find the corresponding decryption parameters and rules for subsequent decryption operation. By combining the seed key ciphertext and the password algorithm file name into core information, the correct password algorithm file can be quickly located during decryption, thereby ensuring the smooth progress of the decryption process and realizing the complete recovery of data.
[0059] The ciphertext of the seed key obtained by the above steps and the name of the obtained password algorithm file are combined according to certain rules to form core information. This rule can be simple splicing, or the two can be integrated together in a specific format or coding manner, the key is to ensure that the seed key ciphertext and the password algorithm file name can be correctly separated and identified during decryption. For example, the ciphertext of the seed key is "d3b1f9e7c4a8f6d2e5b3a9c7f4d6e5b", and the name of the password algorithm file is "policy_001". According to the simple splicing rule, the two are connected with a specific separator (such as "_") to generate core information "d3b1f9e7c4a8f6d2e5b3a9c7f4d6e5b_policy_001".
[0060] After generating the core information, the ciphertext of the seed key and the name of the password algorithm file are closely associated, providing a key guide for the subsequent decryption process, ensuring that the corresponding decryption parameters can be accurately found during decryption, and improving the overall efficiency and accuracy of the encryption and decryption process.
[0061] Encrypting the core information is to further improve its security and prevent the core information itself from being tampered with or leaked. The encoding operation is to convert the encrypted core information into a format suitable for storage, transmission or display, ensuring the compatibility and usability of data in different environments and media. Encoding can also increase the integrity and identifiability of data. A suitable encryption algorithm can be selected to encrypt the core information. Special storage keys and initial vectors can be used as parameters during encryption to enhance the strength and security of encryption. Then, the encrypted core information is encoded and converted using the selected encoding method (such as Base64 encoding) to meet the specific format requirements, facilitating subsequent storage, transmission or use.
[0062] The encrypted and encoded core information not only has further improved security, but also has better storage and transmission adaptability. The encoded target encryption result can exist and be transmitted stably in various systems, platforms and network environments, while effectively preventing data damage and tampering during storage or transmission, ensuring data integrity and usability, and providing a reliable final output for the entire encryption system.
[0063] In one embodiment, the obtaining the encryption information for encryption comprises:
[0064] The encryption key, the random number and the name of the cryptographic algorithm file are obtained from the cryptographic algorithm file library.
[0065] In the cryptographic algorithm file library, the encryption key is usually protected by multiple security mechanisms, such as stored in a hardware security module (HSM) or encrypted by a key encryption key (KEK). The system can extract the required encryption key from the cryptographic algorithm file library after authentication and authorization by calling a security interface.
[0066] The cryptographic algorithm file library is usually equipped with a random number generator that meets security standards, such as a FIPS140-2 certified random number generator. High-quality random numbers are obtained by calling the random number generation interface provided by the cryptographic algorithm file library. When obtaining random numbers, the length and format of the random numbers can be specified according to the requirements of the encryption algorithm and the application scenario.
[0067] The cryptographic algorithm file library stores multiple cryptographic algorithm files with different names, and the system can select the appropriate cryptographic algorithm file name according to the specific application scenario, security policy or user configuration. For example, the system can query the configuration list of the cryptographic algorithm file library to determine the cryptographic algorithm file name to be obtained according to the preset rules or input parameters.
[0068] In one embodiment, the encryption of the seed key according to the encryption information comprises:
[0069] The seed key is encrypted by the AES encryption algorithm using the encryption key and the random number to obtain the ciphertext of the seed key.
[0070] The encryption key is used for the key expansion process of the AES algorithm to generate a series of round keys that participate in each round of encryption operation. The random number is used as an initialization vector (IV) and is XORed with the plaintext in the CBC encryption mode to ensure that the same plaintext produces different ciphertexts in different encryption operations, increasing the randomness and attack resistance of the encryption.
[0071] AES encryption algorithm converts plaintext (seed key) into ciphertext through a series of complex mathematical transformations, including byte substitution, row shifting, column mixing and round key addition operations. These operations are interwoven to form a multi-round encryption process, making the mapping relationship between ciphertext and plaintext extremely complex and difficult to crack through reverse analysis. Using the selected AES encryption mode (such as CBC, ECB, etc.) and padding method (such as PKCS7, ZeroPadding, etc.), the AES encryption function is called with the seed key, encryption key and random number as input parameters to perform encryption operations. During the encryption process, each step of operation is performed according to the specifications of the AES algorithm to ensure the correctness and security of the encryption.
[0072] In one embodiment, the core information is generated according to the ciphertext of the seed key and the name of the cryptographic algorithm file, including:
[0073] The ciphertext of the seed key and the name of the cryptographic algorithm file are spliced to obtain a spliced result.
[0074] The spliced result is used as the core information.
[0075] The ciphertext of the seed key is the result of encrypting the original seed key during the encryption process, while the name of the cryptographic algorithm file identifies the specific parameter set used during encryption. These two represent the result and process of the encryption operation, respectively.
[0076] After the encryption operation is completed, the obtained seed key ciphertext is stored in binary or text form in a temporary variable or memory space, and the name of the current file used is obtained from the cryptographic algorithm file library in text string form. Direct splicing can integrate the core information at very low computational cost, avoiding the performance loss caused by introducing complex data structures or algorithms, while ensuring easy parsing of the data at the decryption end. Using a specific separator, the seed key ciphertext and the file name can be easily separated and restored at the decryption end, ensuring smooth decryption operations. The string concatenation function or method can be called to connect the string representation of the seed key ciphertext with the cryptographic algorithm file name, and a predefined separator is inserted between them.
[0077] In one embodiment, the core information is encrypted and encoded to obtain the target encryption result, including:
[0078] Obtain the storage key and initial vector from the configuration center;
[0079] Encrypt the core information using the storage key and the initial vector through the AES encryption algorithm to obtain the encrypted core information.
[0080] The encrypted core information is encoded to obtain a target encryption result.
[0081] The storage key is used for key expansion in the AES encryption process to generate round keys for encryption operation; the initial vector is XORed with the core information in the CBC encryption mode to increase the randomness and unpredictability of encryption. The storage key and the initial vector are obtained from the configuration center through secure network requests or local configuration file reading operations. The configuration center usually adopts security mechanisms such as encrypted storage and access control to protect these key parameters. For example, the storage key and the initial vector can be obtained from a remote configuration center through an HTTPS request, or read and decrypted from a local encrypted configuration file.
[0082] Through AES encryption, the core information can be converted into ciphertext form, ensuring that even if the data is stolen, it is difficult for attackers to obtain the original core information content. Select an AES encryption mode (such as CBC, ECB, etc.) and determine the padding method (such as PKCS7, ZeroPadding, etc.). Call the AES encryption function with the core information, the storage key, and the initial vector as input parameters to perform encryption. In the encryption process, strictly follow the specifications of the AES algorithm for byte substitution, row shifting, column mixing, and round key addition operations to ensure the correctness and security of encryption.
[0083] Encoding operations can convert encrypted binary data into text format, making it easier to store, transmit, and display. Base64 encoding is a commonly used encoding method that can convert binary data into printable ASCII characters while maintaining a certain level of encoding and decoding efficiency, making it suitable for various application scenarios. Call the Base64 encoding function with the encrypted core information byte array as the input parameter to perform Base64 encoding. The encoded result will be output in string form for subsequent storage or transmission.
[0084] Referring to Figure 2 The method is executed by an electronic device, which can be implemented by a software system and / or a hardware system. The data encryption method includes:
[0085] Step S210: decoding and decrypting the target encryption result to obtain core information;
[0086] Step S220: determining the ciphertext of the seed key and the name of the cryptographic algorithm profile according to the core information;
[0087] Step S210: obtaining decryption information for decryption according to the name of the cryptographic algorithm profile;
[0088] Step S240: decrypt the ciphertext of the seed key according to the decoding information to obtain the seed key.
[0089] The target encryption result is usually encoded data for storage and transmission. In order to obtain the encrypted core information, the encoded data must be decoded to restore the format of the encrypted core information, and then decrypted to obtain the original core information.
[0090] The encoded target encryption result is read and the appropriate decoding algorithm is selected. Common encoding methods include Base64, and the corresponding decoding algorithm is selected according to the specific application scenario. In the decoding process, the encoded data is converted back to binary form encryption data. Then, according to the encryption algorithm and key information used during encryption, the decoded encryption data is decrypted to obtain the core information. For example, assuming that the target encryption result is the Base64 encoded string "aGVsbG8gd29ybGQ=", first use the Base64 decoding algorithm to decode it to get the binary data "h6e5d3a9f5c7b8e9d6c3b5a4d2e9f8c7b". Then call the AES decryption algorithm, use the key (such as K) and initial vector (such as VIk) used during encryption to decrypt it, and get the core information "d3b1f9e7c4a8f6d2e5b3a9c7f4d6e5b_policy_001".
[0091] The core information contains the ciphertext of the seed key and the name of the password algorithm file, and the two parts correspond to the encrypted seed key and the specific algorithm parameters used for encryption, respectively. In the decryption process, accurately separating the two parts is a key step to achieve correct decryption. Only correct separation can use the appropriate algorithm and parameters for subsequent decryption operation to ensure the correctness of the decrypted seed key. Analyze the core information. For example, if the core information uses a simple splicing method and separates the ciphertext of the seed key and the name of the password algorithm file with a specific separator (such as "_"), the seed key ciphertext and the name of the password algorithm file are separated by finding the position of the separator. For example, the core information is "d3b1f9e7c4a8f6d2e5b3a9c7f4d6e5b_policy_001". By finding the underscore "_" separator, the seed key ciphertext "d3b1f9e7c4a8f6d2e5b3a9c7f4d6e5b" and the name of the password algorithm file "policy_001" are separated.
[0092] The password algorithm file is queried from the password algorithm file library stored in the secure location by taking the name of the password algorithm file as an index. The password algorithm file library stores various password algorithm files, each of which corresponds to a specific name and decryption parameter. For example, a password algorithm file library is maintained on a local configuration file or a remote server, and the corresponding file is found by name to obtain the decryption algorithm type, key length, decryption mode, and other information therein.
[0093] The ciphertext of the seed key is an encrypted seed key, and only through correct decryption operation can the original seed key be restored. The decryption algorithm type, key length, decryption mode, and other parameters in the obtained decryption information are used to call the corresponding decryption function to perform decryption operation on the ciphertext of the seed key.
[0094] For example, if the decryption information is AES-256-CBC-PKCS7, the corresponding AES decryption function is used to provide the correct decryption key and initialization vector (IV) to decrypt the ciphertext of the seed key. For example, the decryption key is "0f16f73d386b4e7e4b2c60c1b4d8e3f", and the initialization vector (IV) is "1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6". The ciphertext "d3b1f9e7c4a8f6d2e5b3a9c7f4d6e5b" of the seed key is decrypted using the AES-256-CBC-PKCS7 decryption algorithm to obtain the original seed key "645a3df2e7b8a9c4b1d7e8c6f3c0a9d". After successfully decrypting the original seed key, the final restoration of the data is achieved, so that the encrypted data can be used by the legitimate recipient, ensuring the availability and integrity of the data
[0095] In one embodiment, the decryption information used for decryption is obtained according to the name of the password algorithm file, including:
[0096] The name of the password algorithm file is determined to obtain the encryption key and the random number from the password algorithm file library.
[0097] The name of the password algorithm file is found in the core information. The core information usually contains the ciphertext of the seed key and the name of the password algorithm file, which are separated by a specific separator. By parsing the core information, the name of the password algorithm file is separated. The determined name of the password algorithm file is used as a query condition to access the password algorithm file library, and the corresponding encryption key and random number can be obtained by calling the interface or function provided by the password algorithm file library and inputting the name of the password algorithm file.
[0098] Referring to Figure 3 FIG. 1 shows a functional module schematic diagram of the data encryption device 100 of the present application.
[0099] The data encryption apparatus 100 described in the present application is installed in an electronic device. According to the implemented function, the data encryption apparatus 100 comprises an acquisition module 110, a first encryption module 120, a generation module 130 and a second encryption module 140. The above-mentioned modules can also be referred to as units, which refer to a series of computer program segments capable of being executed by an electronic device processor and capable of completing fixed functions, which are stored in the memory of the electronic device.
[0100] In the present embodiment, the functions of each module / unit are as follows:
[0101] The acquisition module 110 is used for acquiring encryption information for encryption;
[0102] The first encryption module 120 is used for encrypting the seed key according to the encryption information to obtain ciphertext of the seed key;
[0103] The generation module 130 is used for generating core information according to the ciphertext of the seed key and the name of the password algorithm file;
[0104] The second encryption module 140 is used for encrypting and encoding the core information to obtain a target encryption result.
[0105] The specific implementation of the data encryption apparatus of the present application is substantially the same as that of the above-mentioned data encryption method, and will not be repeated here.
[0106] Referring to Figure 4 Fig. 1 is a schematic diagram of a preferred embodiment of an electronic device of the present application.
[0107] The electronic device comprises a processor 111, a communication interface 112, a memory 113 and a communication bus 114, wherein the processor 111, the communication interface 112 and the memory 113 complete mutual communication through the communication bus 114;
[0108] The memory 113 is used for storing computer programs, for example, data encryption / decryption programs;
[0109] The processor 111 in some embodiments can be a central processing unit (CPU), a controller, a microcontroller, a microprocessor or other data processing chip. The processor 111 is usually used to control the overall operation of the electronic device, such as performing control and processing related to data interaction or communication, etc. In the present embodiment, the processor 111 is used to run the program code or process data stored in the memory 113.
[0110] The communication interface 112 can optionally include a standard wired interface, a wireless interface (e.g., a WI-FI interface), and can be used to establish a communication connection between the electronic device and other electronic devices.
[0111] The memory 113 includes at least one type of readable storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory (e.g., an SD or DX memory, etc.), a random access memory (RAM), a static random access memory (SRAM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a programmable read-only memory (PROM), a magnetic memory, a magnetic disk, an optical disk, etc. In some embodiments, the memory 113 can be an internal storage unit of the electronic device, such as a hard disk or a memory of the electronic device. In other embodiments, the memory 113 can also be an external storage device of the electronic device, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. Of course, the memory 113 can also include both an internal storage unit and an external storage device of the electronic device. In this embodiment, the memory 113 is generally used to store an operating system and various computer programs installed in the electronic device, such as program codes of a data encryption / decryption program, etc. In addition, the memory 113 can also be used to temporarily store various data that has been output or will be output.
[0112] Figure 4 Only an electronic device having components 111-114 is shown, but it should be understood that all of the shown components are not required to be implemented, and more or fewer components can be alternatively implemented.
[0113] In one embodiment of the present application, the processor 111, when executing the programs stored in the memory 113, implements the data encryption method provided by any one of the method embodiments described above, including:
[0114] Obtaining encryption information for encryption;
[0115] Encrypting the seed key according to the encryption information to obtain ciphertext of the seed key;
[0116] Generating core information according to the ciphertext of the seed key and the name of the cryptographic algorithm profile;
[0117] Encoding the encrypted core information to obtain a target encryption result.
[0118] In another embodiment of the present application, the processor 111, when executing the program stored in the memory 113, implements the data decryption method provided by any one of the foregoing method embodiments, including:
[0119] decrypting the target encryption result after decoding to obtain the core information;
[0120] determining the ciphertext of the seed key and the name of the cryptographic algorithm file according to the core information;
[0121] obtaining decryption information for decryption according to the name of the cryptographic algorithm file;
[0122] decrypting the ciphertext of the seed key according to the decryption information to obtain the seed key.
[0123] For detailed description of the above steps, please refer to the foregoing Figure 1 and Figure 2 description of the flowchart of the data encryption / decryption method embodiment.
[0124] In addition, the embodiments of the present application also propose a computer readable storage medium, which is non-volatile or volatile. The computer readable storage medium is any one or any combination of the following: a hard disk, a multimedia card, an SD card, a flash card, an SMC, a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a portable compact disc read-only memory (CD-ROM), a USB memory, etc. The computer readable storage medium includes a storage data area and a storage program area, and the storage program area stores a program, which, when executed by a processor, implements the following operations:
[0125] obtaining encryption information for encryption;
[0126] encrypting the seed key according to the encryption information to obtain the ciphertext of the seed key;
[0127] generating core information according to the ciphertext of the seed key and the name of the cryptographic algorithm file;
[0128] encrypting the core information after encoding to obtain a target encryption result.
[0129] When the program is executed by the processor, the following operations can also be implemented:
[0130] decrypting the target encryption result after decoding to obtain the core information;
[0131] determining the ciphertext of the seed key and the name of the cryptographic algorithm file according to the core information;
[0132] obtaining decryption information for decryption according to the name of the cryptographic algorithm file;
[0133] According to the decoding information, the ciphertext of the seed key is decrypted to obtain the seed key.
[0134] The specific implementation of the computer readable storage medium of the present application is substantially the same as that of the above-mentioned data encryption / decryption method, and will not be described here.
[0135] It should be noted that the above-mentioned sequence number of the embodiments of the present application is only for description, and does not represent the advantages and disadvantages of the embodiments. Moreover, the terms "include", "contain" or any other variant thereof in this paper are intended to cover non-exclusive inclusion, so that the process, device, article or method including a series of elements not only includes those elements, but also includes other elements not explicitly listed, or includes elements inherent to such process, device, article or method. Without more limitations, the element defined by the sentence "including a" does not exclude the presence of other identical elements in the process, device, article or method including the element.
[0136] Through the description of the above embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment method can be realized by means of software and general hardware simulation platform, of course, it can also be realized by hardware, but in many cases the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of software product, which is stored in a storage medium (such as ROM / RAM, magnetic disc, optical disc) as described above, and includes a plurality of instructions for making a terminal device execute the method described in each embodiment of the present application.
[0137] The above is only the preferred embodiment of the present application, and does not limit the patent scope of the present application, and any equivalent structure or equivalent process transformation using the content of the present application specification and drawings, or direct or indirect application in other related technical fields, are also included in the patent protection scope of the present application.
Claims
1. A data encryption method, characterized in that, The method includes: Obtain the encrypted information used for encryption; The seed key is encrypted based on the encryption information to obtain the ciphertext of the seed key; Generate core information based on the ciphertext of the seed key and the name of the cryptographic algorithm file; The core information is encrypted and then encoded to obtain the target encryption result.
2. The data encryption method as described in claim 1, characterized in that, The acquisition of encrypted information for encryption includes: Retrieve the encryption key, random number, and name of the cryptographic algorithm file from the cryptographic algorithm archive.
3. The data encryption method as described in claim 2, characterized in that, The step of encrypting the seed key according to the encryption information to obtain the ciphertext of the seed key includes: The seed key is encrypted using the AES encryption algorithm, the encryption key, and the random number to obtain the ciphertext of the seed key.
4. The data encryption method as described in claim 2, characterized in that, The process of generating core information based on the ciphertext of the seed key and the name of the cryptographic algorithm file includes: The ciphertext of the seed key and the name of the cryptographic algorithm file are concatenated to obtain the concatenation result; The splicing result is used as the core information.
5. The data encryption method as described in claim 2, characterized in that, The process of encrypting the core information and then encoding it to obtain the target encryption result includes: Retrieve the storage key and initialization vector from the configuration center; The core information is encrypted using the AES encryption algorithm, the storage key, and the initial vector to obtain the encrypted core information. The encrypted core information is then encoded to obtain the target encrypted result.
6. A data decryption method, characterized in that, The method includes: After decoding the encrypted result of the target, decryption is performed to obtain the core information; The name of the seed key ciphertext and the cryptographic algorithm file is determined based on the core information; Based on the name of the cryptographic algorithm file, obtain the decryption information used for decryption; The seed key is obtained by decrypting the ciphertext of the seed key based on the decoding information.
7. The data decryption method as described in claim 6, characterized in that, The step of obtaining decryption information for decryption based on the name of the cryptographic algorithm file includes: Determine the name of the cryptographic algorithm archive and retrieve the encryption key and random number from the cryptographic algorithm archive repository.
8. A data encryption device, characterized in that, The device includes: Acquisition module: Used to acquire encrypted information for encryption; First encryption module: used to encrypt the seed key according to the encryption information to obtain the ciphertext of the seed key; Generation module: Used to generate core information based on the ciphertext of the seed key and the name of the cryptographic algorithm file; The second encryption module is used to encrypt the core information and then encode it to obtain the target encryption result.
9. An electronic device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, when executing a program stored in memory, implements the data encryption method of any one of claims 1 to 5, and / or implements the data decoding method of any one of claims 6 to 7.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the data encryption method as described in any one of claims 1 to 7, and / or the data decoding method as described in any one of claims 6 to 7.