Encryption and decryption method, device and equipment and readable storage medium
Patent Information
- Application Number
- CN202610404359.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-03-30
- Publication Date
- 2026-10-16
AI Technical Summary
[0004]本申请提供一种加解密方法、装置、设备及可读存储介质，旨在解决目前的加密算法服务器存在着加密算法固定单一、加密能力有限及扩展不便的技术问题
[0015]本申请实施例提供的技术方案带来的有益效果包括：
Smart Images
Figure CN122933044A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of information security technology, and in particular to an encryption / decryption method, apparatus, device, and readable storage medium. Background Technology
[0002] With the advancement of domestic substitution, server products supporting domestic encryption algorithms such as SM2 / SM3 / SM4 are rapidly becoming more widespread. Mainstream manufacturers such as Huawei, Sugon, Inspur, and Phytium have launched trusted servers that comply with the standards of the State Cryptography Administration, supporting hardware-level acceleration of domestic encryption algorithms and meeting the compliance requirements of government, enterprise, financial, and critical infrastructure sectors.
[0003] However, current encryption algorithm servers suffer from problems such as fixed and single encryption algorithms, limited encryption capabilities, and inconvenient expansion. Summary of the Invention
[0004] This application provides an encryption / decryption method, apparatus, device, and readable storage medium, aiming to solve the technical problems of current encryption algorithm servers having fixed and single encryption algorithms, limited encryption capabilities, and inconvenient expansion.
[0005] In a first aspect, embodiments of this application provide an encryption / decryption method, which is applied to a service node, and the encryption / decryption method includes: Receive the encryption capabilities registered by each encryption node; Based on the encryption capabilities registered by each encryption node, each encryption node is sorted according to priority to obtain an encryption node sequence; If an encryption / decryption request is received, the encryption node sequence is traversed in descending order of priority based on the encryption / decryption request, and the target encryption node is determined by combining the state of the encryption nodes, so that the encryption / decryption request can be processed through the target encryption node.
[0006] Optionally, receiving the encryption capabilities registered by each encryption node includes: Receive encryption capability registration requests from each encryption node; The registration request for encryption capabilities of each encryption node is validated for legality. The validity validation includes the integrity signature of the registration request, the compliance of the encryption algorithm name, and whether the identifier of the encryption algorithm is in the whitelist. If the legitimacy verification is successful, the encryption capabilities registered by the encryption node will be accepted.
[0007] Optionally, the encryption capabilities registered by each encryption node include supported encryption algorithms, supported encryption types, encryption security levels, communication bandwidth, communication latency, and communication stability. Based on the encryption capabilities registered by each encryption node, each encryption node is sorted according to priority to obtain an encryption node sequence including: For each encryption node, the supported encryption types, encryption security levels, communication bandwidth, communication latency, and communication stability are normalized to obtain the normalized values for each item. Based on the normalized values of each item and the preset weights of each item, the priority of each encrypted node is calculated. Each encrypted node is sorted according to its priority to obtain the encrypted node sequence.
[0008] Optionally, after sorting each encrypted node according to priority to obtain the encrypted node sequence, the process includes: If the difference in priority between two adjacent encrypted nodes in the encrypted node sequence is not greater than a preset difference, the order of the two adjacent encrypted nodes is adjusted according to the priority order of whether hardware encryption is supported, communication stability, and encryption security level among the supported encryption types, to obtain an updated encrypted node sequence.
[0009] Optionally, if an encryption / decryption request is received, then based on the encryption / decryption request, traversing the encrypted node sequence in descending order of priority, and determining the target encrypted node in conjunction with the state of the encrypted nodes includes: If an encryption / decryption request is received, the encrypted node sequence is traversed in descending order of priority. If the encryption algorithm supported by the currently traversed encryption node matches the encryption algorithm required by the encryption / decryption request and is available, then the currently traversed encryption node will be the target encryption node.
[0010] Optionally, after traversing the encrypted node sequence in descending order of priority, the method further includes: If all candidate encryption nodes in the encryption node sequence that support encryption algorithms and match the encryption algorithm required by the encryption / decryption request are busy, then the target encryption node is selected from the candidate encryption nodes in the order of minimum backlog, minimum packet loss rate, and minimum encryption failure rate.
[0011] Optionally, the encryption / decryption method further includes: For each business node, when a new encryption node's encryption capability registration request is detected or the status of an existing encryption node changes, the priority of the new encryption node or the changed encryption node is calculated. Each encrypted node is reordered according to priority to obtain an updated sequence of encrypted nodes.
[0012] Secondly, embodiments of this application provide an encryption / decryption device, the encryption / decryption device comprising: The receiving module is used to receive the encryption capabilities registered by each encryption node; The sorting module is used to sort each encryption node according to its priority based on the encryption capabilities registered by each encryption node, so as to obtain a sequence of encryption nodes; The determination module is used to, upon receiving an encryption / decryption request, traverse the sequence of encrypted nodes in descending order of priority based on the encryption / decryption request, and determine the target encryption node by combining the state of the encrypted nodes, so that the encryption / decryption request can be processed through the target encryption node.
[0013] Thirdly, embodiments of this application provide an encryption / decryption device, which includes a processor, a memory, and an encryption / decryption program stored in the memory and executable by the processor, wherein when the encryption / decryption program is executed by the processor, it implements the steps of the encryption / decryption method as described above.
[0014] Fourthly, embodiments of this application provide a readable storage medium storing an encryption / decryption program, wherein when the encryption / decryption program is executed by a processor, it implements the steps of the encryption / decryption method as described above.
[0015] The beneficial effects of the technical solutions provided in this application include: In this embodiment, the encryption capabilities registered by each encryption node are received; based on the encryption capabilities registered by each encryption node, each encryption node is sorted according to priority to obtain an encryption node sequence; if an encryption / decryption request is received, the encryption node sequence is traversed in descending order of priority based on the encryption / decryption request, and the target encryption node is determined in combination with the state of the encryption node, so that the encryption / decryption request can be processed through the target encryption node. In this embodiment, there can be multiple business nodes and encryption nodes, each with different encryption capabilities, such as supported encryption algorithms, supported encryption types, encryption security levels, communication bandwidth, communication latency, and communication stability. Each encryption node can dynamically register its encryption capabilities with each business node, thereby solving the problem of fixed and single encryption algorithms, achieving plug-and-play encryption capabilities, and flexible expansion of encryption capabilities. Furthermore, for each business node, each encryption node is sorted based on its registered encryption capabilities to obtain an encryption node sequence, providing a basis for selecting the optimal encryption node. When an encryption / decryption request is received, the encryption nodes in the encryption node sequence are traversed and matched according to priority from high to low based on the encryption / decryption request (including the required encryption algorithm). At the same time, the state of the encryption nodes, such as load, packet loss rate, and failure rate, are considered to comprehensively select the optimal encryption node. Thus, on the basis of flexible expansion of encryption nodes, optimal allocation of encryption nodes is also achieved, constructing a flexible and high-performance encryption / decryption system. Attached Figure Description
[0016] Figure 1 This is a flowchart illustrating an embodiment of the encryption / decryption method of this application; Figure 2 This is a schematic diagram of the system architecture of one embodiment of the encryption / decryption method of this application; Figure 3 This is a schematic diagram illustrating the interaction between the service node and the encryption node in one embodiment of the encryption / decryption method of this application; Figure 4 This is a functional module diagram of an embodiment of the encryption / decryption device of this application; Figure 5 This is a schematic diagram of the hardware structure of the encryption / decryption device involved in the embodiments of this application. Detailed Implementation
[0017] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present application.
[0018] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.
[0019] Firstly, embodiments of this application provide an encryption / decryption method.
[0020] In one embodiment, reference is made to Figure 1 , Figure 1 This is a flowchart illustrating an embodiment of the encryption / decryption method of this application, as shown below. Figure 1 As shown, the encryption / decryption method is applied to the business node, and the encryption / decryption method includes: Step S10: Receive the encryption capabilities registered by each encryption node.
[0021] In this embodiment, refer to Figure 2 , Figure 2 This is a schematic diagram of the system architecture of an embodiment of the encryption / decryption method of this application, as shown below. Figure 2As shown, there can be multiple business nodes and encryption nodes, employing either a distributed architecture or a standalone server architecture. These nodes can reside on the same server or on different servers. Each encryption node can dynamically register its encryption capabilities with each business node, and each business node listens for registration requests from each encryption node. Encryption capabilities include not only a list of supported encryption algorithms (such as AES-256-GCM, SM4-CBC, and other national or international cryptographic algorithms), but also encryption type (software encryption, instruction set acceleration, QAT hardware acceleration), security level, and performance metrics (communication bandwidth, communication latency, stability score). Through the dynamic registration mechanism, business nodes and encryption nodes are decoupled, allowing encryption resources to be used "plug and play" like plug-and-play. This solves the problem of fixed and singular encryption algorithms in traditional solutions, where expansion requires service restarts, enabling flexible horizontal scaling of encryption capabilities and allowing the system to adapt to various heterogeneous encryption software and hardware.
[0022] Step S20: Based on the encryption capabilities registered by each encryption node, sort each encryption node according to priority to obtain an encryption node sequence.
[0023] In this embodiment, each service node maintains an encrypted resource pool, i.e., an encrypted node sequence. The heterogeneous encryption capability indicators reported by each encrypted node are normalized to eliminate dimensional differences (e.g., mapping bandwidth (Gbps) and latency (μs) to the 0-1 range). A weighted linear combination formula is used to calculate the encryption capability score of each encrypted node, with weights preset according to the service scenario (e.g., bandwidth weighting for high-throughput scenarios and latency weighting for low-latency scenarios). The encrypted node sequence is generated by arranging the encrypted capability scores in descending order of priority. This step quantifies multi-dimensional encryption capabilities into a single priority indicator, providing objective data support for subsequent scheduling and avoiding uneven resource utilization and performance bottlenecks caused by traditional round-robin or random scheduling.
[0024] Step S30: If an encryption / decryption request is received, the encryption node sequence is traversed in descending order of priority based on the encryption / decryption request, and the target encryption node is determined in combination with the state of the encryption nodes, so that the encryption / decryption request can be processed through the target encryption node.
[0025] In this embodiment, after receiving an encryption / decryption request message, the service node first extracts the encryption algorithm requirement from the request, and then traverses the encryption node sequence from high priority to low priority. During the traversal, not only is the algorithm matching degree checked, but the running status of the node is also queried in real time (e.g., ACTIVE, BUSY, UNHEALTHY). Only when an encryption node supports the requested algorithm and its status is available is it determined as the target node. This dual screening mechanism of "priority + status" ensures that the encryption task can meet security compliance requirements (algorithm matching) and obtain optimal processing performance (high priority and idle), significantly improving the overall system throughput and response speed.
[0026] In this embodiment, a flexible and high-performance encryption / decryption system is constructed through the above steps. Business nodes do not need to be aware of the specific differences in the underlying encryption hardware; they only need to schedule through a unified interface, achieving horizontal scaling of encryption capabilities and dynamic load balancing. Especially in the context of domestic substitution, it can uniformly manage encryption cards and software encryption resources from different manufacturers, significantly improving the system's adaptability and reliability in complex environments.
[0027] In this embodiment, refer to Figure 3 , Figure 3 This is a schematic diagram illustrating the interaction between the service node and the encryption node in one embodiment of the encryption / decryption method of this application, as shown below. Figure 3As shown, business node A includes a UDS negotiation module, primarily responsible for negotiating with the encryption node, dynamically registering and creating encryption pools, and other important functions; an MMP sharing interface module, primarily responsible for data flow transmission between the business node and the encryption node; and a resource management and scheduling module, primarily responsible for the overall scheduling and optimization of data flow packet encryption. Encryption node B includes a UDS negotiation module, responsible for initializing the encryption module and reporting relevant encryption information to the business node; an MMP sharing interface module, primarily responsible for data flow transmission between the business node and the encryption node; and an encryption module, which involves QAT encryption driver (hardware unloading driver), AESNI encryption driver (instruction set encryption), and openssl encryption driver (software driver), etc., whose main function is to encrypt and decrypt data packets. The interaction steps between business node A and encryption node B are as follows: a. Business node A negotiates with encryption nodes B1, B2, and Bn, etc., regarding supported algorithms, encryption capabilities, and the maximum supported channels; b. Based on the negotiation results, some encryption nodes that meet the business requirements carried by process A are identified, such as B1, Bn, etc.; c. Business node A establishes a one-way data flow channel with encryption nodes B1 and Bn using mmap; d. Business node A performs real-time management and scheduling with encryption node Bn; e. When network traffic packets arrive, the packets are load-balanced to different encryption nodes Bn; f. After encryption by encryption node Bn, the data is returned to business node A through the data flow channel.
[0028] Furthermore, in one embodiment, reference is made to Figure 2 , Figure 2 For this application Figure 1 A detailed flowchart of step S10 is shown below. Figure 2 As shown, step S10 includes: Step S101: Receive encryption capability registration requests from each encryption node; Step S102: Verify the legality of the encryption capability registration request for each encryption node. The legality verification includes the integrity signature of the registration request, the compliance of the encryption algorithm name, and whether the identifier of the encryption algorithm is in the whitelist. Step S103: If the legitimacy verification is passed, the encryption capability registered by the encryption node is received.
[0029] In this embodiment, legitimacy verification is the first line of defense for ensuring the security of the scheduling system. Integrity signatures (such as HMAC) prevent registration messages from being tampered with during transmission; algorithm name compliance checks prevent malicious string injection attacks; and a whitelist mechanism ensures that only trusted processes (based on PID or path) can register as encrypted nodes. This effectively prevents malicious nodes from accessing the system to steal data or disrupt services, ensuring the security of the encrypted scheduling environment and ensuring that only trusted encrypted resources participate in business processing.
[0030] Furthermore, in one embodiment, the encryption capabilities registered by each encryption node include supported encryption algorithms, supported encryption types, encryption security levels, communication bandwidth, communication latency, and communication stability. Step S20 includes: For each encryption node, the supported encryption types, encryption security levels, communication bandwidth, communication latency, and communication stability are normalized to obtain the normalized values for each item. Based on the normalized values of each item and the preset weights of each item, the priority of each encrypted node is calculated. Each encrypted node is sorted according to its priority to obtain the encrypted node sequence.
[0031] In this embodiment, the message structure of the encryption capability registration request sent by each encryption node is shown in Table 1. The data items in Table 1 are standardized using the formula shown in Table 2, mapping their values to the 0-1 range. This normalization process makes metrics of different dimensions (such as Gbps and μs) comparable. The normalized values and preset weights of each item are shown in Table 3. The preset weights reflect business strategies; for example, security level weights can be increased for financial scenarios with high security requirements, and bandwidth weights can be increased for performance-sensitive video streaming scenarios. Calculating and ranking priorities shifts scheduling decisions from "experience-based" to "data-driven," improving resource utilization and ensuring that high-capability nodes are utilized first, thereby maximizing the overall encryption performance.
[0032] Table 1.
[0033] Table 2.
[0034] Table 3.
[0035] Further, in one embodiment, after sorting each encrypted node according to priority to obtain an encrypted node sequence, the process includes: If the difference in priority between two adjacent encrypted nodes in the encrypted node sequence is not greater than a preset difference, the order of the two adjacent encrypted nodes is adjusted according to the priority order of whether hardware encryption is supported, communication stability, and encryption security level among the supported encryption types, to obtain the updated encrypted node sequence.
[0036] In this embodiment, when the overall scores of two nodes are very close, relying solely on the scores may lead to scheduling oscillations (i.e., frequent switching between the two nodes). By introducing secondary sorting rules such as hardware support and stability, prioritizing nodes that support hardware encryption (such as QAT) can reduce CPU load, and prioritizing nodes with high stability can reduce the failure rate. This enhances the stability and determinism of the system and avoids the overhead of frequent context switching caused by small fluctuations in scores.
[0037] Further, in one embodiment, step S30 includes: If an encryption / decryption request is received, the encrypted node sequence is traversed in descending order of priority. If the encryption algorithm supported by the currently traversed encryption node matches the encryption algorithm required by the encryption / decryption request and is available, then the currently traversed encryption node will be the target encryption node.
[0038] In this embodiment, during the traversal process, algorithm matching is a prerequisite to ensure compliance; status checking is a safeguard to ensure feasibility. Only nodes that simultaneously meet the requirements of algorithm support and an active status are selected. This avoids sending tasks to nodes that do not support the algorithm or are down, reducing retry overhead and error rates, and ensuring the accuracy and efficiency of business processing.
[0039] Furthermore, in one embodiment, after traversing the encrypted node sequence in descending priority order, the method further includes: If all candidate encryption nodes in the encryption node sequence that support encryption algorithms and match the encryption algorithm required by the encryption / decryption request are busy, then the target encryption node is selected from the candidate encryption nodes in the order of priority: minimum backlog, minimum packet loss rate, and minimum encryption failure rate.
[0040] In this embodiment, under high-load scenarios, the optimal node may be overloaded. In this case, a degradation strategy is activated, shifting the focus from static scoring to real-time load metrics such as backlog and packet loss rate. When all candidate encryption nodes in the encryption node sequence that support the encryption algorithm required by the encryption / decryption request are busy, the encryption node with the smallest backlog is selected. While selecting the node with the smallest backlog is not theoretically optimal, it avoids packet loss due to queue overflow, ensuring business continuity. This demonstrates the system's robustness, preventing the entire service from becoming unavailable due to a single node's performance bottleneck, and achieving dynamic fault tolerance. Furthermore, if multiple encryption nodes have the same backlog, the encryption node with the lowest packet loss rate is selected. If multiple encryption nodes also have the same packet loss rate, the encryption node with the lowest encryption failure rate is selected. The optimal target encryption node is allocated according to the priority order of smallest backlog, lowest packet loss rate, and lowest encryption failure rate.
[0041] Furthermore, in one embodiment, the encryption / decryption method further includes: For each business node, when a new encryption node's encryption capability registration request is detected or the status of an existing encryption node changes, the priority of the new encryption node or the changed encryption node is calculated. Each encrypted node is reordered according to priority to obtain an updated sequence of encrypted nodes.
[0042] In this embodiment, the encrypted resources are dynamically changing. When a new node is added (e.g., a hot-swappable encryption card) or the status of an old node changes (e.g., heartbeat timeout, sudden load change), reordering is triggered to ensure that the encryption pool information is accurate in real time. This allows the system to automatically detect hardware changes or faults without manual intervention or service restarts, achieving automated and intelligent operation and maintenance, and ensuring that scheduling decisions are always based on the latest resource status.
[0043] Further, in one embodiment, after the encryption / decryption request is processed by the target encryption node, the process includes: When the business node and the encryption node are located on the same server, the encryption node returns the processed encrypted and decrypted data to the business node through shared memory; When the business node and the encryption node are located on different servers, the encryption node returns the processed encrypted and decrypted data to the business node through the physical network card.
[0044] In this embodiment, a differentiated data return mechanism is employed to optimize data interaction efficiency and adapt to different deployment architectures. Specifically, when the business node and the encryption node are deployed on the same server, the shared memory mechanism allows for direct data exchange in user space, avoiding multiple copies of data between kernel and user space, as well as the overhead of network protocol stack encapsulation and decapsulation. This significantly reduces CPU utilization and communication latency, achieving near-zero copy high-speed data transmission, thereby improving encryption and decryption throughput performance in single-machine scenarios. When the two are deployed on different servers, the physical network interface card provides the necessary cross-node communication links, ensuring connectivity and reliability in a distributed architecture. This adaptive data transmission strategy allows the system to maximize performance potential in single-machine deployment scenarios while maintaining flexible scalability in large-scale cluster deployment scenarios. This maximizes the overall response speed of encryption and decryption services while ensuring security and compliance, and reduces system operation and maintenance costs and resource consumption.
[0045] Secondly, embodiments of this application also provide an encryption / decryption device.
[0046] In one embodiment, reference is made to Figure 4 , Figure 4 This is a functional module diagram of an embodiment of the encryption / decryption device of this application, as shown below. Figure 4 As shown, the encryption / decryption device is applied to the service node, and the encryption / decryption device includes: The receiving module 10 is used to receive the encryption capabilities registered by each encryption node; The sorting module 20 is used to sort each encryption node according to its priority based on the encryption capabilities registered by each encryption node, so as to obtain a sequence of encryption nodes; The determination module 30 is used to, if an encryption / decryption request is received, traverse the encryption node sequence in descending order of priority based on the encryption / decryption request, and determine the target encryption node in combination with the state of the encryption nodes, so that the encryption / decryption request can be processed through the target encryption node.
[0047] Furthermore, in one embodiment, the receiving module 10 is configured to: Receive encryption capability registration requests from each encryption node; The registration request for encryption capabilities of each encryption node is validated for legality. The validity validation includes the integrity signature of the registration request, the compliance of the encryption algorithm name, and whether the identifier of the encryption algorithm is in the whitelist. If the legitimacy verification is successful, the encryption capabilities registered by the encryption node will be accepted.
[0048] Furthermore, in one embodiment, the encryption capabilities registered by each encryption node include supported encryption algorithms, supported encryption types, encryption security levels, communication bandwidth, communication latency, and communication stability. The sorting module 20 is used for: For each encryption node, the supported encryption types, encryption security levels, communication bandwidth, communication latency, and communication stability are normalized to obtain the normalized values for each item. Based on the normalized values of each item and the preset weights of each item, the priority of each encrypted node is calculated. Each encrypted node is sorted according to its priority to obtain the encrypted node sequence.
[0049] Furthermore, in one embodiment, the encryption / decryption device further includes an adjustment and sorting module, used for: If the difference in priority between two adjacent encrypted nodes in the encrypted node sequence is not greater than a preset difference, the order of the two adjacent encrypted nodes is adjusted according to the priority order of whether hardware encryption is supported, communication stability, and encryption security level among the supported encryption types, to obtain the updated encrypted node sequence.
[0050] Furthermore, in one embodiment, the determining module 30 is used for: If an encryption / decryption request is received, the encrypted node sequence is traversed in descending order of priority. If the encryption algorithm supported by the currently traversed encryption node matches the encryption algorithm required by the encryption / decryption request and is available, then the currently traversed encryption node will be the target encryption node.
[0051] Furthermore, in one embodiment, the encryption / decryption device further includes a downgrade selection module, used for: If all candidate encryption nodes in the encryption node sequence that support encryption algorithms and match the encryption algorithm required by the encryption / decryption request are busy, then the target encryption node is selected from the candidate encryption nodes in the order of priority: minimum backlog, minimum packet loss rate, and minimum encryption failure rate.
[0052] Furthermore, in one embodiment, the encryption / decryption device further includes an update sorting module, used for: For each business node, when a new encryption node's encryption capability registration request is detected or the status of an existing encryption node changes, the priority of the new encryption node or the changed encryption node is calculated. Each encrypted node is reordered according to priority to obtain an updated sequence of encrypted nodes.
[0053] The functions of each module in the encryption / decryption device correspond to the steps in the encryption / decryption method embodiments described above, and their functions and implementation processes will not be elaborated here.
[0054] Thirdly, embodiments of this application provide an encryption / decryption device.
[0055] Reference Figure 5 , Figure 5 This is a schematic diagram of the hardware structure of the encryption / decryption device involved in the embodiments of this application. In the embodiments of this application, the encryption / decryption device may include a processor, a memory, a communication interface, and a communication bus.
[0056] The communication bus can be of any type and is used to interconnect the processor, memory, and communication interface.
[0057] Communication interfaces include input / output (I / O) interfaces, physical interfaces, and logical interfaces used for interconnecting devices within the encryption / decryption device, as well as interfaces used for interconnecting the encryption / decryption device with other devices (such as other computing devices or user equipment). Physical interfaces can be Ethernet interfaces, fiber optic interfaces, ATM interfaces, etc.; user equipment can be displays, keyboards, etc.
[0058] Memory can be various types of storage media, such as random access memory (RAM), read-only memory (ROM), non-volatile RAM (NVRAM), flash memory, optical storage, hard disk, programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), etc.
[0059] The processor can be a general-purpose processor, which can call encryption / decryption programs stored in memory and execute the encryption / decryption methods provided in the embodiments of this application. For example, the general-purpose processor can be a central processing unit (CPU). The methods executed when the encryption / decryption programs are called can be referred to in the various embodiments of the encryption / decryption methods of this application, and will not be repeated here.
[0060] Those skilled in the art will understand that Figure 5 The hardware structure shown does not constitute a limitation of this application and may include more or fewer components than shown, or combine certain components, or have different component arrangements.
[0061] Fourthly, embodiments of this application also provide a readable storage medium.
[0062] The present application has an encryption / decryption program stored on a readable storage medium, wherein when the encryption / decryption program is executed by a processor, it implements the steps of the encryption / decryption method as described above.
[0063] The method implemented when the encryption / decryption program is executed can be referred to in the various embodiments of the encryption / decryption method of this application, and will not be repeated here.
[0064] It should be noted that the sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.
[0065] The terms "comprising" and "having," and any variations thereof, in the specification, claims, and accompanying drawings of this application are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to such process, method, product, or apparatus. The terms "first," "second," and "third," etc., are used to distinguish different objects, etc., and do not indicate a sequence, nor do they limit "first," "second," and "third" to different types.
[0066] In the description of the embodiments of this application, terms such as "exemplary," "for example," or "for instance" are used to indicate examples, illustrations, or explanations. Any embodiment or design described as "exemplary," "for example," or "for instance" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of terms such as "exemplary," "for example," or "for instance" is intended to present the relevant concepts in a concrete manner.
[0067] In the description of the embodiments of this application, unless otherwise stated, " / " means "or". For example, A / B can mean A or B. The "and / or" in the text is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist simultaneously, and B exists alone. In addition, in the description of the embodiments of this application, "multiple" means two or more.
[0068] In some processes described in the embodiments of this application, multiple operations or steps are included in a specific order. However, it should be understood that these operations or steps may not be executed in the order they appear in the embodiments of this application, or they may be executed in parallel. The sequence number of the operation is only used to distinguish different operations, and the sequence number itself does not represent any execution order. In addition, these processes may include more or fewer operations, and these operations or steps may be executed sequentially or in parallel, and these operations or steps may be combined.
[0069] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes several instructions to cause a terminal device to execute the methods described in the various embodiments of this application.
[0070] The above are merely preferred embodiments of this application and do not limit the patent scope of this application. Any equivalent structural or procedural transformations made using the content of this application's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of this application.
Claims
1. An encryption / decryption method, characterized in that, The encryption / decryption method is applied to the business node, and the encryption / decryption method includes: Receive the encryption capabilities registered by each encryption node; Based on the encryption capabilities registered by each encryption node, each encryption node is sorted according to priority to obtain an encryption node sequence; If an encryption / decryption request is received, the encryption node sequence is traversed in descending order of priority based on the encryption / decryption request, and the target encryption node is determined by combining the state of the encryption nodes, so that the encryption / decryption request can be processed through the target encryption node.
2. The encryption / decryption method as described in claim 1, characterized in that, The encryption capabilities received from each encryption node registration include: Receive encryption capability registration requests from each encryption node; The registration request for encryption capabilities of each encryption node is validated for legality. The validity validation includes the integrity signature of the registration request, the compliance of the encryption algorithm name, and whether the identifier of the encryption algorithm is in the whitelist. If the legitimacy verification is successful, the encryption capabilities registered by the encryption node will be accepted.
3. The encryption / decryption method as described in claim 1, characterized in that, The encryption capabilities registered by each encryption node include supported encryption algorithms, supported encryption types, encryption security levels, communication bandwidth, communication latency, and communication stability. Based on the encryption capabilities registered by each encryption node, each encryption node is sorted according to priority to obtain an encryption node sequence including: For each encryption node, the supported encryption types, encryption security levels, communication bandwidth, communication latency, and communication stability are normalized to obtain the normalized values for each item. Based on the normalized values of each item and the preset weights of each item, the priority of each encrypted node is calculated. Each encrypted node is sorted according to its priority to obtain the encrypted node sequence.
4. The encryption / decryption method as described in claim 3, characterized in that, After sorting each encrypted node according to its priority to obtain the encrypted node sequence, the process includes: If the difference in priority between two adjacent encrypted nodes in the encrypted node sequence is not greater than a preset difference, the order of the two adjacent encrypted nodes is adjusted according to the priority order of whether hardware encryption is supported, communication stability, and encryption security level among the supported encryption types, to obtain an updated encrypted node sequence.
5. The encryption / decryption method as described in claim 3, characterized in that, If an encryption / decryption request is received, the encrypted node sequence is traversed in descending order of priority based on the encryption / decryption request, and the target encrypted node is determined by combining the state of the encrypted nodes, including: If an encryption / decryption request is received, the encrypted node sequence is traversed in descending order of priority. If the encryption algorithm supported by the currently traversed encryption node matches the encryption algorithm required by the encryption / decryption request and is available, then the currently traversed encryption node will be the target encryption node.
6. The encryption / decryption method as described in claim 5, characterized in that, Following the traversal of the encrypted node sequence in descending priority order, the following is also included: If all candidate encryption nodes in the encryption node sequence that support encryption algorithms and match the encryption algorithm required by the encryption / decryption request are busy, then the target encryption node is selected from the candidate encryption nodes in the order of minimum backlog, minimum packet loss rate, and minimum encryption failure rate.
7. The encryption / decryption method as described in claim 3, characterized in that, The encryption / decryption method also includes: For each business node, when a new encryption node's encryption capability registration request is detected or the status of an existing encryption node changes, the priority of the new encryption node or the changed encryption node is calculated. Each encrypted node is reordered according to priority to obtain an updated sequence of encrypted nodes.
8. An encryption / decryption device, characterized in that, The encryption / decryption device is applied to the service node, and the encryption / decryption device includes: The receiving module is used to receive the encryption capabilities registered by each encryption node; The sorting module is used to sort each encryption node according to its priority based on the encryption capabilities registered by each encryption node, so as to obtain a sequence of encryption nodes; The determination module is used to, upon receiving an encryption / decryption request, traverse the sequence of encrypted nodes in descending order of priority based on the encryption / decryption request, and determine the target encryption node by combining the state of the encrypted nodes, so that the encryption / decryption request can be processed through the target encryption node.
9. An encryption / decryption device, characterized in that, The encryption / decryption device includes a processor, a memory, and an encryption / decryption program stored in the memory and executable by the processor, wherein when the encryption / decryption program is executed by the processor, it implements the steps of the encryption / decryption method as described in any one of claims 1 to 7.
10. A readable storage medium, characterized in that, The readable storage medium stores an encryption / decryption program, wherein when the encryption / decryption program is executed by a processor, it implements the steps of the encryption / decryption method as described in any one of claims 1 to 7.