A password processing method, device, equipment and computer readable storage medium

Abstract

This invention discloses a cryptographic processing method, apparatus, device, and computer-readable storage medium, applied in the field of security. The method includes: a server receiving a request from a client and parsing the request to obtain an identifier; the identifier is used to distinguish service access parties; based on the identifier, the server queries the corresponding public key and key version number from a key configuration library and returns them together to the client, enabling the client to encrypt the plaintext password using the public key to generate ciphertext for transmission, and sending the ciphertext, key version number, and identifier together to the server; based on the identifier and key version number, the server queries the corresponding private key from the key configuration library, decrypts the ciphertext using the private key to obtain the plaintext password; the plaintext password is then encrypted, and the encrypted password is stored in a database. This invention achieves differentiated key configuration and risk isolation; as well as smooth key rotation and compatible transition.

Description

Technical Field

[0001] This invention relates to the field of security, and in particular to a cryptographic processing method, apparatus, device, and computer-readable storage medium. Background Technology

[0002] In user middleware scenarios, user passwords are typically collected by the front-end and submitted to the server for processing. Existing methods usually involve statically storing the public key locally on the client (e.g., within the page or client package). This method has the following problems: if the private key is leaked, all business operations are threatened, resulting in a complete loss of control over accounts across the platform; differentiated key policy configuration is not possible, making it difficult to meet the requirements of different channels; during key rotation or emergency replacement, all client resources must be fully updated, leading to incompatibility between old and new clients, and unupdated clients becoming completely unusable, causing business interruptions and slow recovery.

[0003] Therefore, how to manage key pairs differently and ensure compatibility between the old and new systems during automated key rotation / switching are technical problems that urgently need to be solved. Summary of the Invention

[0004] In view of this, the purpose of the present invention is to provide a cryptographic processing method, apparatus, device and computer-readable storage medium, which solves the problems of concentrated security risks, inflexible strategies and complex key rotation process that easily leads to service interruption in the prior art.

[0005] To address the aforementioned technical problems, this invention provides a cryptographic processing method applied to a server, comprising: Receive a request initiated by the client and parse the request to obtain an identifier; the identifier is used to distinguish the service access party. The corresponding public key and key version number are retrieved from the key configuration library based on the identifier and returned to the client together, so that the client can use the public key to encrypt the plaintext password, generate the transmission ciphertext, and send the transmission ciphertext, the key version number and the identifier together to the server. The corresponding private key is retrieved from the key configuration library based on the identifier and the key version number. The private key is then used to decrypt the transmitted ciphertext to obtain the plaintext password. The plaintext password is encrypted, and the encrypted password is stored in the database.

[0006] Optionally, the corresponding private key is retrieved from the key configuration library based on the identifier and the key version number, including: The corresponding key pair is retrieved from the key configuration library based on the identifier and the key version number; the key pair is in a normal state. If the query is successful, then determine the status of the key pair; If the key pair is in an active state, then the private key in the key pair is used as the corresponding private key; If the key pair is in a transitional state, then check whether the current system time has exceeded the grace window expiration timestamp; If the limit is not exceeded, the private key in the key pair will be used as the corresponding private key.

[0007] Optionally, it also includes: Generate a new key pair and corresponding key version number for the identifier according to preset conditions, and store them in the key configuration library; Set the new key pair to the active state, set the old key pair to the transition state, and record the grace window expiration timestamp. When the system time exceeds the grace window expiration timestamp, the old key pair in the transition state will be removed from the key configuration library.

[0008] Optionally, a new key pair and corresponding key version number are generated for the identifier according to preset conditions and stored in the key configuration library, including: Read the security level label bound to the identifier from the key configuration library; Based on the security level label, match the rotation cycle value and grace window duration value corresponding to the identifier from the preset policy mapping table; Generate a new key pair and corresponding key version number for the identifier according to the rotation cycle, and store them in the key configuration library; Accordingly, the expiration timestamp of the grace window is calculated based on the length of the grace window and the current time.

[0009] Optionally, receiving a request initiated by a client and parsing the request to obtain an identifier includes: Receive the request initiated by the client and parse the request for at least one of the following identifiers: site identifier, tenant identifier, business domain identifier, and channel identifier.

[0010] Optionally, the plaintext password is encrypted, and the encrypted password is stored in a database, including: A random obfuscation factor is generated, and the obfuscation factor is concatenated with the plaintext cipher in a preset order to obtain the data string to be processed; The preset one-way hash function is called to perform multiple iterative compression calculations on the data string to be processed to obtain an intermediate value of fixed length; The confusion factor and the intermediate value are combined according to a preset format to obtain the encrypted password.

[0011] Optionally, a random confusion factor is generated, including: The confusion factor is generated by calling the cryptographically secure pseudo-random number generator at the operating system level, along with the current system timestamp, process identifier, and memory state entropy source; the confusion factor is an unpredictable random byte sequence.

[0012] The present invention also provides a cryptographic processing apparatus, applied to a server, comprising: The parsing module is used to receive requests initiated by clients and parse the requests to obtain an identifier; the identifier is used to distinguish the service access party. The encryption module is used to query the corresponding public key and key version number from the key configuration library according to the identifier, and return them to the client together, so that the client can use the public key to encrypt the plaintext password, generate the transmission ciphertext, and send the transmission ciphertext, the key version number and the identifier together to the server. The decryption module is used to find the corresponding private key from the key configuration library according to the identifier and the key version number, and use the private key to decrypt the transmitted ciphertext to obtain the plaintext password; The storage module is used to encrypt the plaintext password and store the encrypted password in the database.

[0013] The present invention also provides a cryptographic processing device, comprising: Memory, used to store computer programs; A processor for implementing the cryptographic processing method described above when executing the computer program.

[0014] The present invention also provides a computer-readable storage medium storing computer-executable instructions, which, when loaded and executed by a processor, implement the cryptographic processing method described above.

[0015] The present invention also provides a computer program product, including a computer program / instruction that, when executed by a processor, implements the steps of the cryptographic processing method described above.

[0016] As can be seen from the above technical solution, the present invention receives requests initiated by clients through a server, parses the requests to obtain an identifier; the identifier is used to distinguish business access parties; based on the identifier, the corresponding public key and key version number are retrieved from the key configuration library, and returned to the client together, so that the client can use the public key to encrypt the plaintext password, generate the transmission ciphertext, and send the transmission ciphertext, key version number, and identifier to the server; based on the identifier and key version number, the corresponding private key is retrieved from the key configuration library, and the transmission ciphertext is decrypted using the private key to obtain the plaintext password; the plaintext password is then encrypted, and the encrypted password is stored in the database. The beneficial effects of the present invention are: by distinguishing different access parties based on the identifier and dynamically issuing corresponding public keys and key version numbers, each access party can use its own independent key pair, realizing differentiated key configuration and risk isolation; at the same time, when the key is changed, the server can accurately locate the corresponding private key based on the key version number, so as to achieve smooth key rotation and compatible transition.

[0017] In addition, the present invention also provides a cryptographic processing apparatus, device, and computer-readable storage medium, which also have the above-mentioned beneficial effects. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0019] Figure 1 A flowchart of a cryptographic processing method provided in an embodiment of the present invention; Figure 2 A timing diagram of a cryptographic processing method provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of a key rotation process provided in an embodiment of the present invention; Figure 4 This is a timing diagram of an embodiment of the present invention for a key automatic rotation and grace window period compatibility processing; Figure 5 This is a timing diagram for handling invalid keys according to an embodiment of the present invention; Figure 6 This is a schematic diagram of the structure of a cryptographic processing device provided in an embodiment of the present invention; Figure 7 This is a schematic diagram of the structure of a cryptographic processing device provided in an embodiment of the present invention. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] In user-centric platform scenarios, user passwords are typically collected by the client and submitted to the server for processing. Currently, public keys are generally permanently stored in the front-end page or client installation package. This approach has the following drawbacks: it is difficult to manage public keys differently, and the maintenance costs of key rotation and canary deployments are significantly increased; once the private key is leaked, changing the key pair requires synchronously updating all front-end resources, which is cumbersome and poses a risk of service interruption. It is evident that current data encryption schemes suffer from strong intrusiveness, static key management, and incomplete protection links from the client to the server, thus impacting business development efficiency and user data security.

[0022] To address the aforementioned issues, this invention achieves differentiated management by centrally managing keys (public and private keys) on the server side and dynamically distributing keys to clients based on identifiers. Furthermore, by adding key version numbers, it implements an automated, periodic key pair rotation mechanism and a transition scheme compatible with both old and new key sets during key switching. Additionally, it utilizes asymmetric encryption algorithms to encrypt password transmission, achieving unified protection throughout the client-to-server transmission phase. This significantly improves the security and consistency of sensitive data at each stage of collection, transmission, and processing.

[0023] Please refer to the details. Figure 1 , Figure 1 A flowchart illustrating a cryptographic processing method provided in an embodiment of the present invention. The method may include: S101: Receives the request initiated by the client and parses the request to obtain the identifier; the identifier is used to distinguish the service access party.

[0024] In this embodiment, each step is executed by the server. The server receives requests initiated by the client, which may be login requests or registration requests, etc. It should be noted that the request carries an identifier, which is used to distinguish different service access parties.

[0025] Furthermore, the above-mentioned receiving the request initiated by the client and parsing the request to obtain the identifier includes: receiving the request initiated by the client and parsing the request for at least one of the following identifiers: site identifier, tenant identifier, business domain identifier, and channel identifier.

[0026] Among them, site identifiers are used to distinguish different sites or domains (such as web (web page) terminals, mobile H5 (Hypertext Markup Language) terminals, etc.); tenant identifiers are used to distinguish different tenants in a multi-tenant architecture (such as enterprise customers, organizations, etc.); business domain identifiers are used to distinguish different business modules or domains within the same system (such as order domains, user domains, etc.); and channel identifiers are used to distinguish the request source channel (such as App (application), mini-program, third-party cooperation channels, etc.). By parsing at least one identifier, the server can execute differentiated key policies, configuration queries, or access control based on these identifiers, thereby achieving secure isolation and flexible management under multiple sites, multiple tenants, and multiple business domains.

[0027] S102: Based on the identifier, retrieve the corresponding public key and key version number from the key configuration library and return them to the client, so that the client can use the public key to encrypt the plaintext password, generate the transmission ciphertext, and send the transmission ciphertext, key version number and identifier to the server.

[0028] Steps S102 and S103 constitute the encryption process for password transmission. This embodiment employs an asymmetric encryption algorithm. It should be noted that the key configuration library is a dependent component of the server, specifically used to store key pairs (public and private keys) and related metadata for different access parties (distinguished by identifiers), such as key version numbers, status (active / transitioning), rotation periods, and grace window timestamps. The key configuration library allows the server to dynamically query the correct key information based on the identifier in the request, thereby achieving key isolation, version management, and automated rotation across multiple sites / tenants. Furthermore, even if different sites use different key versions, the client can smoothly switch by identifying the corresponding key version number, thus reducing the maintenance costs associated with hard-coded public keys on the front end.

[0029] After receiving the user's account, password, and other sensitive information, the client uses the public key issued by the server to encrypt the password field (plaintext) using RSA (an encryption algorithm), obtaining the transmitted ciphertext. This transmitted ciphertext, along with an identifier and key version number, is then sent to the server as a password submission request. It should be noted that this method is not limited to password processing but is also applicable to the processing of other sensitive information, such as mobile phone numbers, email addresses, and ID card numbers.

[0030] S103: Find the corresponding private key from the key configuration library based on the identifier and key version number, and use the private key to decrypt the transmitted ciphertext to obtain the plaintext ciphertext.

[0031] The server locates the corresponding private key in the key configuration library based on the identifier and key version number carried in the password submission request, and uses the private key to decrypt the transmitted ciphertext to obtain the original password plaintext or other sensitive information plaintext.

[0032] Furthermore, the process of retrieving the corresponding private key from the key configuration library based on the identifier and key version number can specifically include: querying the corresponding key pair from the key configuration library based on the identifier and key version number; if the query is successful, determining the status of the key pair; if the key pair is in an active state, using the private key in the key pair as the corresponding private key; if the key pair is in a transitional state, verifying whether the current system time has exceeded the grace window expiration timestamp; if it has not exceeded the time limit, using the private key in the key pair as the corresponding private key.

[0033] It's important to note that during key rotation, the new key pair is active, while the old key pair is in a transitional state with a grace window. During this grace window, the server can simultaneously hold both the new and old private keys for decryption. The server directly searches for the corresponding key pair in the key configuration library based on the identifier and key version number uploaded by the client. If the query is successful and the key pair is active, the private key is used directly. If the query is successful but the key pair is in a transitional state, the server further verifies whether the current system time has exceeded the grace window expiration timestamp. If it has, the old private key is used; otherwise, it is considered invalid. If the query fails or the key pair has expired, an error is returned along with the version number of the currently active key, guiding the client to update. This ensures that during the key rotation transition period, both new and old clients can find the correct private key to complete decryption, achieving a smooth switch without lost requests. The entire transition process is seamless for the user, requires no manual intervention, and does not cause service interruption.

[0034] Furthermore, it may also include: generating a new key pair and its corresponding key version number according to preset conditions, and storing them in the key configuration library; setting the status of the new key pair to active, setting the status of the old key pair to transitional, and recording the grace window expiration timestamp; when the system time exceeds the grace window expiration timestamp, removing the old key pair in the transitional state from the key configuration library.

[0035] This embodiment does not specifically limit the preset conditions. For example, new key pair generation can be automatically triggered at regular intervals, with the background scheduling task executing automatically on a periodic basis; or it can be manually triggered by the administrator initiating it from the operation and maintenance console. When a new key pair is generated, it is automatically assigned a key version number and its status is set to active; the status of the existing old key pair is changed to transitional, and its grace window expiration timestamp is recorded to ensure compatibility with client requests still encrypted with the old key during key rotation. When the system time exceeds the grace window expiration timestamp, the old key in transitional state will automatically fail, and to reduce storage and retrieval overhead, it needs to be removed from the key configuration library.

[0036] Furthermore, the process of generating new key pairs and corresponding key version numbers for identifiers according to preset conditions and storing them in the key configuration library can specifically include: reading the security level tag bound to the identifier from the key configuration library; matching the corresponding rotation cycle value and grace window duration value of the identifier from a preset policy mapping table based on the security level tag; generating new key pairs and corresponding key version numbers for the identifier according to the rotation cycle and storing them in the key configuration library; correspondingly, the grace window expiration timestamp is calculated based on the grace window duration and the current time. In this embodiment, the server no longer hardcodes the rotation parameters for each identifier, but instead predefines security levels (such as high, medium, and low), and then the mapping table automatically converts the levels into specific rotation cycles and grace window durations. In this way, by simply adjusting the security level of the identifier, its key update frequency and transition period length can be controlled in batches, achieving differentiated configuration while avoiding the management complexity brought about by configuring parameters individually for each identifier. At the same time, the rotation cycle directly drives the timing of new key generation, while the grace window duration is used to dynamically calculate the expiration timestamp, ensuring that the old key automatically expires after the security window period.

[0037] S104: Encrypt the plaintext password and store the encrypted password in the database.

[0038] This step is the encryption storage step. When the decryption result is plaintext, the server performs a second encryption. Unlike the previous encryption steps, this encryption process is irreversible. When the decryption result is other sensitive information in plaintext, corresponding business verification or preprocessing is performed. Through this step, the password is converted into an irreversible digest before the server completes business verification, preventing the original plaintext from being continuously exposed in subsequent processes.

[0039] Furthermore, the above-mentioned encryption of plaintext passwords and storage of encrypted passwords in the database may specifically include: generating a random confusion factor; concatenating the confusion factor and plaintext passwords in a preset order to obtain a data string to be processed; calling a preset one-way hash function to perform multiple iterative compression calculations on the data string to be processed to obtain a fixed-length intermediate value; and combining the confusion factor and the intermediate value in a preset format to obtain the encrypted password.

[0040] A random confusion factor is used to ensure that even if two users use the same password, the resulting credentials will be completely different. This confusion factor is concatenated with the plaintext password in a predetermined order to form a mixed data string, aiming to disrupt the regularity of the original password and resist attacks. This embodiment does not specifically limit the one-way hash function. For example, it could be a hash algorithm, or other algorithms. Multiple iterations can significantly increase the computational cost of brute-force attacks. Thus, verification only requires extracting the confusion factor from the stored credentials, repeating the same operation, and comparing intermediate values; the original password cannot be recovered from the digest.

[0041] Furthermore, generating a random obfuscation factor can specifically include: invoking the operating system's underlying cryptographically secure pseudo-random number generator, along with the current system timestamp, process identifier, and memory state entropy source, to generate the obfuscation factor; the obfuscation factor is an unpredictable random byte sequence. This generation method ensures that the obfuscation factor possesses sufficient entropy and randomness, thereby effectively defending against brute-force attacks, rainbow tables, and other attack methods, significantly improving the anti-cracking capability of password storage.

[0042] For login authentication scenarios, the server does not restore the plaintext password in the database. It only needs to re-decrypt the ciphertext password (transmission ciphertext) in the login request with the private key and perform secondary encryption. Then, it compares the result with the ciphertext password field stored in the database to complete the user authentication.

[0043] The cryptographic processing method provided in this embodiment of the invention proceeds as follows: S101: Receive a request initiated by a client and parse the request to obtain an identifier; the identifier is used to distinguish the service access party; S102: Query the corresponding public key and key version number from the key configuration library according to the identifier, and return them to the client together, so that the client can use the public key to encrypt the plaintext password, generate the transmission ciphertext, and send the transmission ciphertext, key version number, and identifier to the server; S103: Find the corresponding private key from the key configuration library according to the identifier and key version number, and use the private key to decrypt the transmission ciphertext to obtain the plaintext password; S104: Encrypt the plaintext password and store the encrypted password in the database. This method distinguishes different access parties by identifying them on the server side and dynamically issues corresponding public keys and key version numbers. This allows each access party to use independent key pairs, achieving differentiated key configuration and risk isolation. Simultaneously, when keys are changed, the server can accurately locate the corresponding private key based on the key version number, enabling smooth key rotation and compatible transition. This completely eliminates the security risks associated with long-term key fixation and the service interruption risks caused by manual key rotation, thus constructing a complete data security closed loop throughout the entire user platform lifecycle. Furthermore, users can use the same set of key issuance, link transmission protection, server-side decryption, and database encrypted storage mechanisms across different lifecycle stages such as registration and login, coupled with automatic key rotation and compatible transition capabilities, thereby constructing an information security management closed loop covering the entire user platform lifecycle.

[0044] Please refer to Figure 2 , Figure 2 A timing diagram of a cryptographic processing method provided in an embodiment of the present invention may specifically include: (1) The client (browser) initiates a login page request, carrying the site identifier.

[0045] (2) After receiving the request, the application server queries the key configuration library (including the scheduler) for the corresponding public key and its key version number based on the identifier.

[0046] (3) The key configuration library returns the public key and its key version number to the application server.

[0047] (4) The application server sends the public key and its key version number to the client.

[0048] (5) The user enters the password on the client and the client uses the public key to encrypt the password with RSA to generate ciphertext.

[0049] (6) The client submits the ciphertext, identifier and key version number to the application server.

[0050] (7) The application server queries the key configuration library for the corresponding private key based on the identifier and version number.

[0051] (8) The key configuration library returns the target private key.

[0052] (9) The application server uses the private key to decrypt the ciphertext, obtain the plaintext password, and then encrypts it again.

[0053] (10) The application server stores the double-encrypted password in the database. It should be noted that this step is only executed during the registration request, and does not need to be executed during the login request.

[0054] (11) The application server returns a login success message to the client.

[0055] Please refer to Figure 3 , Figure 3 This invention provides a schematic diagram of a key rotation process, which may specifically include: (1) The rotation scheduler automatically triggers according to the preset rotation cycle (e.g., every N days / hour) to generate a new set of RSA public and private key pairs for the target site and increments the key version number (original version number + 1).

[0056] (2) Mark the original old key pair status as transitioning, calculate the grace period deadline (i.e., the grace window expiration timestamp), and record the timestamp as the deadline.

[0057] (3) Set the newly generated key pair to active status and notify the server to refresh the local cache so that it can recognize the new key version.

[0058] (4) The server receives a ciphertext processing request from the client, which carries an identifier and a key version number. The server matches the key version number in the request: if the version number corresponds to the old key and the current time has not exceeded its grace period (i.e., the grace period), the old private key is used to complete the decryption; if the version number corresponds to the new key (or the version number is the currently active version), the new private key is used to complete the decryption.

[0059] (5) After successful decryption, perform secondary encryption on the plaintext password and continue subsequent business processing (such as storing or comparing passwords).

[0060] (6) After the grace period expires, old key pairs in transition will be automatically removed from the available key pool and archived. Requests carrying old version numbers will no longer be accepted thereafter.

[0061] Please refer to Figure 4 , Figure 4 A timing diagram for automatic key rotation and grace window period compatibility processing provided in this embodiment of the invention may specifically include: Automatic key rotation: After the rotation scheduler is triggered, the newly generated key pair is set to active state, the old key pair is marked as transitioning and the grace period is recorded. At the same time, the server is notified to refresh the key cache so that the new key can take effect.

[0062] Grace Window (Coexistence of Old and New Keys): For requests carrying an old version number, the server retrieves the old private key, which is still within the grace period, based on the identifier and the old version number. It then returns the old private key and successfully decrypts the request, allowing for normal processing. For requests carrying a new version number, the server retrieves the new private key, which is currently active, based on the identifier and the new version number. It then returns the new private key and successfully decrypts the request, allowing for normal processing.

[0063] Please refer to Figure 5 , Figure 5 A timing diagram for invalidation key processing provided in an embodiment of the present invention may specifically include: Grace period expires: The old key pair is removed from the available key pool and archived, and the old key information cached on the server is cleared. The old version number officially becomes invalid.

[0064] Old version number request (after grace period): When the client still sends a request with the old version number and ciphertext, the server queries the private key based on the identifier and the old version number. However, at this time, the key for that version number has been marked as obsolete, and a valid private key cannot be obtained.

[0065] Response handling: The server returns a key expiration error to the client and will no longer accept the request, thus forcing the client to obtain a new version of the public key and resubmit.

[0066] The cryptographic processing apparatus provided in the embodiments of the present invention will be described below. The cryptographic processing apparatus described below can be referred to in correspondence with the cryptographic processing method described above.

[0067] Please refer to the details. Figure 6 , Figure 6 A schematic diagram of a cryptographic processing device provided in an embodiment of the present invention may include: The parsing module 100 is used to receive requests initiated by clients and parse the requests to obtain an identifier; the identifier is used to distinguish the service access party. The encryption module 200 is used to query the corresponding public key and key version number from the key configuration library according to the identifier, and return them to the client together, so that the client can use the public key to encrypt the plaintext password, generate the transmission ciphertext, and send the transmission ciphertext, the key version number and the identifier together to the server. The decryption module 300 is used to find the corresponding private key from the key configuration library according to the identifier and the key version number, and use the private key to decrypt the transmitted ciphertext to obtain the plaintext password; The storage module 400 is used to encrypt the plaintext password and store the encrypted password in the database.

[0068] Furthermore, based on the above embodiments, the decryption module 300 may specifically include: The query unit is used to query the corresponding key pair from the key configuration library based on the identifier and the key version number; the key pair is in a normal state; The first determining unit is used to determine the status of the key pair if the query is successful. The second determining unit is used to use the private key in the key pair as the corresponding private key if the state of the key pair is active. The third determining unit is used to verify whether the current system time exceeds the grace window expiration timestamp if the key pair is in a transitional state. The fourth determining unit is used to use the private key in the key pair as the corresponding private key if no limit is exceeded.

[0069] Furthermore, based on the above embodiments, the cryptographic processing apparatus may further include: The generation module is used to generate a new key pair and a corresponding key version number for the identifier according to preset conditions, and store them in the key configuration library; The recording module is used to set the status of the new key pair to active state, set the status of the old key pair to transition state, and record the grace window expiration timestamp. The removal module is used to remove old key pairs in transition from the key configuration library when the system time exceeds the grace window expiration timestamp.

[0070] Furthermore, based on the above embodiments, the generation module may specifically include: A reading unit is used to read the security level tag bound to the identifier from the key configuration library; The matching unit is used to match the rotation cycle value and grace window duration value corresponding to the identifier from a preset policy mapping table according to the security level label. A storage unit is used to generate a new key pair and a corresponding key version number for the identifier according to the rotation cycle, and store them in the key configuration library; Accordingly, the expiration timestamp of the grace window is calculated based on the length of the grace window and the current time.

[0071] Furthermore, based on the above embodiments, the parsing module 100 may specifically include: The receiving unit is used to receive the request initiated by the client and parse the request for at least one of the following identifiers: site identifier, tenant identifier, business domain identifier, and channel identifier.

[0072] Furthermore, based on any of the above embodiments, the storage module 400 may specifically include: The processing unit is used to generate a random confusion factor and concatenate the confusion factor with the plaintext cipher in a preset order to obtain the data string to be processed. The calculation unit is used to call a preset single-item hash function to perform multiple iterative compression calculations on the data string to be processed to obtain an intermediate value of fixed length; The combination unit is used to combine the confusion factor and the intermediate value according to a preset format to obtain the encrypted password.

[0073] Furthermore, based on any of the above embodiments, the processing unit may specifically include: The generation subunit is used to call the cryptographically secure pseudo-random number generator at the operating system level, as well as the current system timestamp, process identifier, and memory state entropy source, to generate the confusion factor; the confusion factor is an unpredictable random byte sequence.

[0074] It should be noted that the order of the modules and units in the above-mentioned cryptographic processing device can be changed without affecting the logic.

[0075] The cryptographic processing apparatus provided in this embodiment of the invention includes a parsing module 100 for receiving requests initiated by a client and parsing the requests to obtain an identifier; the identifier is used to distinguish service access parties; an encryption module 200 for querying the corresponding public key and key version number from the key configuration library based on the identifier, and returning them together to the client, so that the client can use the public key to encrypt the plaintext password, generate transmission ciphertext, and send the transmission ciphertext, the key version number, and the identifier together to the server; a decryption module 300 for searching the corresponding private key from the key configuration library based on the identifier and the key version number, and using the private key to decrypt the transmission ciphertext to obtain the plaintext password; and a storage module 400 for encrypting the plaintext password and storing the encrypted password in a database. This device uses the server to distinguish different access parties based on their identifiers and dynamically distributes corresponding public keys and key version numbers, enabling each access party to use its own independent key pair, thus achieving differentiated key configuration and risk isolation. At the same time, when a key is changed, the server can accurately locate the corresponding private key based on the key version number, so as to achieve smooth key rotation and compatible transition.

[0076] The cryptographic processing device provided in the embodiments of the present invention will be described below. The cryptographic processing device described below and the cryptographic processing method described above can be referred to each other.

[0077] Please refer to Figure 7 , Figure 7 A schematic diagram of a cryptographic processing device provided in an embodiment of the present invention may include: Memory 10 is used to store computer programs; Processor 20 is used to execute computer programs to implement the above-described cryptographic processing method.

[0078] The memory 10, processor 20, and communication interface 31 all communicate with each other through the communication bus 32.

[0079] In this embodiment of the invention, the memory 10 is used to store one or more programs. The programs may include program code, which includes computer operation instructions. In this embodiment of the invention, the memory 10 may store programs for implementing the following functions: Receive requests initiated by clients and parse the requests to obtain identifiers; the identifiers are used to distinguish business access parties. The corresponding public key and key version number are retrieved from the key configuration library based on the identifier and returned to the client. The client then uses the public key to encrypt the plaintext password, generates ciphertext for transmission, and sends the ciphertext, key version number, and identifier to the server. The corresponding private key is retrieved from the key configuration library based on the identifier and key version number. The private key is then used to decrypt the transmitted ciphertext to obtain the plaintext ciphertext. The plaintext password is encrypted, and the encrypted password is stored in the database.

[0080] In one possible implementation, the memory 10 may include a program storage area and a data storage area, wherein the program storage area may store the operating system and applications required for at least one function; and the data storage area may store data created during use.

[0081] Furthermore, memory 10 may include read-only memory and random access memory, providing instructions and data to the processor. A portion of the memory may also include NVRAM. The memory stores operating systems and operating instructions, executable modules, or data structures, or subsets thereof, or extended sets thereof, wherein the operating instructions may include various operating instructions for implementing various operations. The operating system may include various system programs for implementing various basic tasks and handling hardware-based tasks.

[0082] Processor 20 can be a central processing unit (CPU), an application-specific integrated circuit, a digital signal processor, a field-programmable gate array, or other programmable logic device. Processor 20 can be a microprocessor or any conventional processor. Processor 20 can call programs stored in memory 10.

[0083] Communication interface 31 can be an interface for the communication module, used to connect with other devices or systems.

[0084] Of course, it should be noted that, Figure 7 The structure shown does not constitute a limitation on the cryptographic processing device in the embodiments of the present invention. In practical applications, the cryptographic processing device may include more than Figure 7 More or fewer components as shown, or combinations of certain components.

[0085] It is understood that if the password processing method in the above embodiments is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the current technology, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and executes all or part of the steps of the methods in the various embodiments of the present invention. The aforementioned storage medium includes: USB flash drive, mobile hard drive, read-only memory (ROM), random access memory (RAM), electrically erasable programmable ROM, register, hard disk, removable disk, CD-ROM, magnetic disk, or optical disk, and other media capable of storing program code.

[0086] Based on this, embodiments of the present invention also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the cryptographic processing method described above.

[0087] The following describes a computer program product provided by an embodiment of this application. The computer program product described below can be referred to in conjunction with other embodiments described herein.

[0088] A computer program product includes a computer program / instructions that, when executed by a processor, implement the steps of the aforementioned disclosed cryptographic processing method.

[0089] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0090] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0091] Finally, it should be noted that in this document, relationships such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0092] The foregoing has provided a detailed description of a cryptographic processing method, apparatus, device, and computer-readable storage medium provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A cryptographic processing method, characterized in that, Applied to the server side, including: Receive a request initiated by the client and parse the request to obtain an identifier; the identifier is used to distinguish the service access party. The corresponding public key and key version number are retrieved from the key configuration library based on the identifier and returned to the client together, so that the client can use the public key to encrypt the plaintext password, generate the transmission ciphertext, and send the transmission ciphertext, the key version number and the identifier together to the server. The corresponding private key is retrieved from the key configuration library based on the identifier and the key version number. The private key is then used to decrypt the transmitted ciphertext to obtain the plaintext password. The plaintext password is encrypted, and the encrypted password is stored in the database.

2. The cryptographic processing method according to claim 1, characterized in that, Based on the identifier and the key version number, the corresponding private key is retrieved from the key configuration library, including: The corresponding key pair is retrieved from the key configuration library based on the identifier and the key version number; If the query is successful, then determine the status of the key pair; If the key pair is in an active state, then the private key in the key pair is used as the corresponding private key; If the key pair is in a transitional state, then check whether the current system time has exceeded the grace window expiration timestamp; If the limit is not exceeded, the private key in the key pair will be used as the corresponding private key.

3. The cryptographic processing method according to claim 1, characterized in that, Also includes: Generate a new key pair and corresponding key version number for the identifier according to preset conditions, and store them in the key configuration library; Set the new key pair to the active state, set the old key pair to the transition state, and record the grace window expiration timestamp. When the system time exceeds the grace window expiration timestamp, the old key pair in the transition state will be removed from the key configuration library.

4. The cryptographic processing method according to claim 3, characterized in that, Generate a new key pair and corresponding key version number for the identifier according to preset conditions, and store them in the key configuration library, including: Read the security level label bound to the identifier from the key configuration library; Based on the security level label, match the rotation cycle value and grace window duration value corresponding to the identifier from the preset policy mapping table; Generate a new key pair and corresponding key version number for the identifier according to the rotation cycle, and store them in the key configuration library; Accordingly, the expiration timestamp of the grace window is calculated based on the length of the grace window and the current time.

5. The cryptographic processing method according to claim 1, characterized in that, Receive a request initiated by the client, and parse the request to obtain an identifier, including: Receive the request initiated by the client and parse the request for at least one of the following identifiers: site identifier, tenant identifier, business domain identifier, and channel identifier.

6. The cryptographic processing method according to any one of claims 1 to 5, characterized in that, Encrypting the plaintext password and storing the encrypted password in a database includes: A random obfuscation factor is generated, and the obfuscation factor is concatenated with the plaintext cipher in a preset order to obtain the data string to be processed; The preset one-way hash function is called to perform multiple iterative compression calculations on the data string to be processed to obtain an intermediate value of fixed length; The confusion factor and the intermediate value are combined according to a preset format to obtain the encrypted password.

7. The cryptographic processing method according to claim 6, characterized in that, Generate a random confusion factor, including: The confusion factor is generated by calling the cryptographically secure pseudo-random number generator at the operating system level, along with the current system timestamp, process identifier, and memory state entropy source; the confusion factor is an unpredictable random byte sequence.

8. A cryptographic processing device, characterized in that, Applied to the server side, including: The parsing module is used to receive requests initiated by clients and parse the requests to obtain an identifier; the identifier is used to distinguish the service access party. The encryption module is used to query the corresponding public key and key version number from the key configuration library according to the identifier, and return them to the client together, so that the client can use the public key to encrypt the plaintext password, generate the transmission ciphertext, and send the transmission ciphertext, the key version number and the identifier together to the server. The decryption module is used to find the corresponding private key from the key configuration library according to the identifier and the key version number, and use the private key to decrypt the transmitted ciphertext to obtain the plaintext password; The storage module is used to encrypt the plaintext password and store the encrypted password in the database.

9. A cryptographic processing device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the cryptographic processing method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when loaded and executed by a processor, implement the cryptographic processing method as described in any one of claims 1 to 7.

Images