Data encryption and decryption method, apparatus, device, and system, and storage medium

Abstract

The present application relates to the field of data processing, and disclosed thereby are a data encryption and decryption method, apparatus, device, and system, and a storage medium. The method comprises: invoking by an encryption and decryption execution platform on the basis of a key mapping relationship, and receiving an encryption and decryption request sent by the encryption and decryption execution platform, the key mapping relationship being maintained by a key management platform and comprising a mapping relationship between a target master key physical index, a master key unique identifier, a hardware security module cluster identifier, and a master key physical index, the encryption and decryption request comprising data to be processed and target working key indication data, the data to be processed comprising data to be encrypted or data to be decrypted, and the target working key indication data being used for indicating a target working key ciphertext; using a first target master key to decrypt the target working key ciphertext so as to obtain a target working key; using the target working key to encrypt or decrypt the data to be processed so as to obtain result data; and feeding back the result data to the encryption and decryption execution platform.

Description

Data encryption and decryption method, device, equipment, system and storage medium

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to Chinese patent application No. 202310723993.4, filed on June 16, 2023, entitled “Methods, devices, equipment, systems and storage media for encryption and decryption of data,” and the entire contents of that application are incorporated herein by reference. Technical Field

[0003] The present application relates to the field of data processing, and in particular to a data encryption and decryption method, device, equipment, system and storage medium. Background Art

[0004] With the development of information network technology, more and more businesses need to collect and process user data to complete their business. However, some data is private, and its security is a key concern.

[0005] To improve data security, data can be encrypted using a working key. When data sharing is required, the encrypted data and key are transmitted. When decryption is needed, the working key is used to decrypt the encrypted data, obtaining the plaintext data. However, the working key required by both the encrypting and decrypting parties is exposed in plaintext, posing a risk of leakage. Leakage of the working key can also pose significant security risks to the data.

[0006] Summary of the Invention

[0007] The embodiments of the present application provide a data encryption and decryption method, apparatus, device, system and storage medium, which can prevent the leakage of working keys and improve the security of data.

[0008] In the first aspect, an embodiment of the present application provides a data encryption and decryption method, which is applied to an encryption machine, and the encryption machine has a first target master key. The method includes: the encryption and decryption execution platform is called based on the key mapping relationship, and receives the encryption and decryption request sent by the encryption and decryption execution platform. The key mapping relationship is maintained by the key management platform, including the mapping relationship between the master key unique identifier, the encryption machine cluster identifier and the master key physical index. The encryption and decryption request includes the target master key physical index, the data to be processed and the target working key indication data. The target master key physical index is the master key physical index of the first target master key. The data to be processed includes the data to be encrypted or the data to be decrypted. The target working key indication data is used to indicate the target working key ciphertext; the target working key ciphertext is decrypted using the first target master key to obtain the target working key; the target working key is used to encrypt or decrypt the data to be processed to obtain the result data; and the result data is fed back to the encryption and decryption execution platform.

[0009] In the second aspect, an embodiment of the present application provides a method for encrypting and decrypting data, which is applied to an encryption and decryption execution platform. The method includes: based on the key mapping relationship maintained by the key management platform, calling an encryption machine with a first target master key, the key mapping relationship includes a mapping relationship between a master key unique identifier, an encryption machine cluster identifier and a master key physical index; sending an encryption and decryption request to the encryption machine, the encryption and decryption request includes a target master key physical index, data to be processed and target working key indication data, the target master key physical index is the master key physical index of the first target master key, the data to be processed includes data to be encrypted or data to be decrypted, the target working key indication data is used to indicate a target working key ciphertext, the encryption and decryption request is used to enable the encryption machine to use the first target master key to decrypt the target working key ciphertext to obtain the target working key, and use the target working key to encrypt or decrypt the data to be processed to obtain result data; and receive the result data fed back by the encryption machine.

[0010] In the third aspect, an embodiment of the present application provides a method for encrypting and decrypting data, which is applied to a key management platform. The method includes: interacting with an encryption and decryption execution platform so that the encryption and decryption execution platform calls an encryption machine with a first target master key based on the key mapping relationship maintained by the key management platform, and the encryption machine uses the first target master key to decrypt the target working key ciphertext indicated by the target working key indication data in the encryption and decryption request to obtain the target working key, and then uses the target working key to encrypt or decrypt the data to be processed in the encryption and decryption request, and the result data is fed back to the encryption and decryption execution platform, wherein the key mapping relationship includes a mapping relationship between a master key unique identifier, an encryption machine cluster identifier and a master key physical index, the encryption and decryption request is sent by the encryption and decryption execution platform to the encryption machine, the data to be processed includes data to be encrypted or data to be decrypted, and the encryption and decryption request also includes a target master key physical index, which is the master key physical index of the first target master key.

[0011] In a fourth aspect, an embodiment of the present application provides an encryption machine, which has a first target master key. The encryption machine includes: a receiving module, which is used to be called by the encryption and decryption execution platform based on the key mapping relationship, and receives the encryption and decryption request sent by the encryption and decryption execution platform. The key mapping relationship is maintained by the key management platform, and includes a mapping relationship between the master key unique identifier, the encryption machine cluster identifier and the master key physical index. The encryption and decryption request includes the target master key physical index, the data to be processed and the target working key indication data. The target master key physical index is the master key physical index of the first target master key. The data to be processed includes the data to be encrypted or the data to be decrypted. The target working key indication data is used to indicate the target working key ciphertext; the encryption and decryption module is used to decrypt the target working key ciphertext using the first target master key to obtain the target working key; and is used to encrypt or decrypt the data to be processed using the target working key to obtain the result data; the sending module is used to feedback the result data to the encryption and decryption execution platform.

[0012] In the fifth aspect, an embodiment of the present application provides a data encryption and decryption device, which is applied to an encryption and decryption execution platform. The device includes: a sending module, which is used to call an encryption machine with a first target master key based on a key mapping relationship maintained by a key management platform, and send an encryption and decryption request to the encryption machine. The key mapping relationship includes a mapping relationship between a master key unique identifier, an encryption machine cluster identifier and a master key physical index. The encryption and decryption request includes a target master key physical index, data to be processed and target working key indication data. The target master key physical index is the master key physical index of the first target master key. The data to be processed includes data to be encrypted or data to be decrypted. The target working key indication data is used to indicate a target working key ciphertext. The encryption and decryption request is used to enable the encryption machine to use the first target master key to decrypt the target working key ciphertext to obtain the target working key, and use the target working key to encrypt or decrypt the data to be processed to obtain result data; a receiving module, which is used to receive the result data fed back by the encryption machine.

[0013] In the sixth aspect, an embodiment of the present application provides a data encryption and decryption device, which is applied to a key management platform. The device includes: a communication module, which is used to interact with an encryption and decryption execution platform, so that the encryption and decryption execution platform calls an encryption machine with a first target master key based on the key mapping relationship maintained by the key management platform, and the encryption machine uses the first target master key to decrypt the target working key ciphertext indicated by the target working key indication data in the encryption and decryption request to obtain the target working key, and then uses the target working key to encrypt or decrypt the data to be processed in the encryption and decryption request, and the result data is fed back to the encryption and decryption execution platform, wherein the key mapping relationship includes a mapping relationship between a master key unique identifier, an encryption machine cluster identifier and a master key physical index, the encryption and decryption request is sent by the encryption and decryption execution platform to the encryption machine, the data to be processed includes data to be encrypted or data to be decrypted, and the encryption and decryption request also includes a target master key physical index, which is the master key physical index of the first target master key.

[0014] In the seventh aspect, an embodiment of the present application provides an electronic device, comprising: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, it implements the encryption and decryption method of the data of the first aspect, the encryption and decryption method of the data of the second aspect, or the encryption and decryption method of the data of the third aspect.

[0015] In an eighth aspect, an embodiment of the present application provides a data encryption and decryption system, comprising: an encryption machine for executing the data encryption and decryption method of the first aspect; an encryption and decryption execution platform, communicating with the encryption machine, for executing the data encryption and decryption method of the second aspect; and a key management platform, communicating with the encryption machine and the encryption and decryption execution platform, for executing the data encryption and decryption method of the third aspect.

[0016] In the ninth aspect, an embodiment of the present application provides a computer-readable storage medium, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the encryption and decryption method of the data of the first aspect, the encryption and decryption method of the data of the second aspect, or the encryption and decryption method of the data of the third aspect is implemented.

[0017] The embodiments of the present application provide a method, apparatus, device, system and storage medium for data encryption and decryption. The encryption and decryption execution platform calls an encryption machine with a first target master key based on the key mapping relationship maintained by the key management platform, and sends an encryption and decryption request to the encryption machine. The encryption and decryption request includes a physical index of the target master key, data to be processed and target working key indication data that can indicate the ciphertext of the target working key. The encryption machine can use the first target master key indicated by the physical index of the master key to decrypt the target working key ciphertext indicated by the target working key indication data to obtain the target working key, and use the target working key to encrypt or decrypt the data to be processed to obtain the result data. The encryption and decryption execution platform receives the result data fed back by the encryption machine. In this encryption and decryption process, the plaintext of the working key is only obtained when the encryption machine uses the master key to decrypt the working key ciphertext when encrypting or decrypting the data to be processed. The plaintext of the working key is not transmitted between different platforms and devices. What is transmitted is the working key indication data indicating the ciphertext of the working key, which can prevent the working key from being exposed in plaintext, thereby avoiding leakage of the working key and improving data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0019] FIG1 is a schematic diagram of an application architecture of an example of a method for encrypting and decrypting data provided in an embodiment of the present application;

[0020] FIG2 is a flow chart of a method for encrypting and decrypting data provided by an embodiment of the first aspect of the present application;

[0021] FIG3 is a schematic diagram of an example of structured information implemented as a protocol message provided in an embodiment of the present application;

[0022] FIG4 is a flow chart of a method for encrypting and decrypting data provided by another embodiment of the first aspect of the present application;

[0023] FIG5 is a flow chart of a method for encrypting and decrypting data provided by an embodiment of the second aspect of the present application;

[0024] FIG6 is a flow chart of a method for encrypting and decrypting data provided by an embodiment of the third aspect of the present application;

[0025] FIG7 is a flow chart of a method for encrypting and decrypting data provided by another embodiment of the third aspect of the present application;

[0026] FIG8 is a schematic diagram of an example of a data encryption and decryption process provided in an embodiment of the present application;

[0027] FIG9 is a schematic diagram of another example of a data encryption and decryption process provided in an embodiment of the present application;

[0028] FIG10 is a schematic structural diagram of an encryption machine provided in an embodiment of the fourth aspect of the present application;

[0029] FIG11 is a schematic diagram of the structure of a data encryption and decryption device provided in an embodiment of the fifth aspect of the present application;

[0030] FIG12 is a schematic diagram of the structure of a data encryption and decryption device provided in an embodiment of the sixth aspect of the present application;

[0031] Figure 13 is a structural diagram of an electronic device provided in an embodiment of the seventh aspect of the present application. DETAILED DESCRIPTION

[0032] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is merely to provide a better understanding of the present application by illustrating the examples of the present application.

[0033] With the development of information network technology, more and more businesses require the collection and processing of user data to complete their operations. However, some data is private, and its security is a key concern. To improve data security, data can be encrypted using a working key. This encrypted data is transmitted during data transmission and then decrypted using the working key when needed to obtain the plaintext data. However, the working keys required for data encryption and decryption by both the encrypting and decrypting parties are exposed in plaintext, posing a risk of leakage. Leakage of the working keys can also pose significant security risks to data.

[0034] The present application provides a data encryption and decryption method, device, equipment, system and storage medium, establishes a centralized and distributed encryption and decryption service and key management mechanism, and can transmit working key indication data that can indicate the working key ciphertext across systems or platforms. The working key ciphertext is obtained by encrypting the working key with the master key. When the encryption machine encrypts or decrypts the data to be processed, it obtains the working key ciphertext based on the working key indication data, decrypts the working key ciphertext with its own master key, and then uses the decrypted working key to encrypt or decrypt the data to be processed. During the entire encryption and decryption process, the plaintext of the working key only appears during the encryption and decryption process of the encryption machine and will not be transmitted across systems or platforms, preventing the working key from being exposed in plaintext, thereby avoiding the leakage of the working key and improving the security of the data.

[0035] For ease of understanding, the application architecture of the data encryption and decryption method in the embodiments of this application is first described here. Figure 1 is a schematic diagram of an application architecture of an example of the data encryption and decryption method provided in the embodiments of this application. As shown in Figure 1, the data encryption and decryption method may involve a key management platform 11, an encryption and decryption execution platform 12, and an encryption engine 13.

[0036] The key management platform 11 provides a key management service (KMS). The key management platform 11 maintains the master key (MK) and manages the sharing, circulation, and use of the master key's unique identifier, which identifies the master key. The master key serves as a primary key, protecting the working key. The master key can be used to encrypt the working key to obtain the working key ciphertext. The working key serves as a secondary key, protecting data security. The working key can be used to encrypt the data to be encrypted to obtain the encrypted data ciphertext. The key management platform 11 also maintains key mappings related to the master key, such as the master key unique identifier, the encryption machine cluster identifier, and the master key physical index. The master key unique identifier identifies the master key. A master key has only one master key unique identifier, and the master key unique identifier is unique. The encryption machines in the system can be divided into multiple encryption machine clusters. The encryption machine cluster identifier identifies the encryption machine cluster, and different encryption machine clusters have different encryption machine cluster identifiers. The master key physical index indicates the physical location of the master key within the encryption machine cluster. The corresponding master key can be retrieved using the master key physical index. The key management platform 11 can interact with the encryption and decryption execution platform 12 to enable the encryption and decryption execution platform to obtain relevant information related to the key mapping relationship required during the encryption and decryption process. The key management platform 11 can also manage the lifecycle of master keys and working keys. When the master key or working key needs to be replaced, the encryption engine 13 can be called to complete the trans-encryption of the master key and the trans-encryption of the working key. The key management platform 11 can be implemented by modules, devices, and equipment, and the type and number of modules, devices, and equipment that implement the key management platform 11 are not limited.

[0037] The encryption and decryption execution platform 12 provides encryption and / or decryption service functions. It can be owned by an independent encryption and decryption service provider or by a user that requires encryption and / or decryption of data to be processed, without limitation. Based on the key mapping relationships maintained by the key management platform 11, the encryption and decryption execution platform 12 can determine the encryption engine 13 containing the master key corresponding to the working key ciphertext required for encryption or decryption, and invoke the encryption engine 13 to perform encryption or decryption. The encryption and decryption execution platform 12 can be implemented by modules, devices, or equipment, and the type and number of modules, devices, or equipment that implement the encryption and decryption execution platform 12 are not limited.

[0038] The encryption engine 13 has encryption and / or decryption functions and can encrypt or decrypt pending data. The encryption engine 13 stores a master key. When encryption or decryption of pending data is required, it obtains the corresponding working key ciphertext, decrypts the working key ciphertext using the master key, obtains the working key, and uses the working key to encrypt or decrypt the pending data. The plaintext working key only appears after the working key ciphertext is decrypted in the encryption engine 13 using the master key; the plaintext working key is not transmitted outside of the encryption engine 13. The encryption engine 13 can be the same entity as the encryption and decryption execution platform 12, the same entity as the key management platform 11, or independent of the encryption and decryption execution platform 12 and the key management platform 11, without limitation herein.

[0039] The data encryption and decryption methods, devices, equipment, systems and storage media provided in this application are described below.

[0040] In a first aspect, the present application provides a method for encrypting and decrypting data, which is applied to an encryption machine, i.e., the method for encrypting and decrypting data can be executed by the encryption machine. FIG2 is a flowchart of the method for encrypting and decrypting data provided in an embodiment of the first aspect of the present application. As shown in FIG2 , the method for encrypting and decrypting data can include steps S201 to S204.

[0041] In step S201, the encryption and decryption execution platform is called based on the key mapping relationship and receives the encryption and decryption request sent by the encryption and decryption execution platform.

[0042] The encryption and decryption execution platform can determine the encryption machine where the master key required for encryption or decryption of the data to be processed is located based on the key mapping relationship, and thus call the encryption machine. In the embodiment of the present application, the master key required for encryption or decryption of the data to be processed is the first target master key, and the encryption machine has the first target master key.

[0043] The key mapping relationship is maintained by the key management platform, including the mapping relationship between the master key unique identifier, the encryption machine cluster identifier, and the master key physical index. Based on the key mapping relationship, the encryption and decryption execution platform can determine the master key physical index of the master key required for this encryption or decryption, thereby determining the alternative encryption machine. In some examples, the encryption machine is called by the encryption and decryption execution platform based on the obtained target master key unique identifier, target encryption machine cluster identifier, and key mapping relationship. In the key mapping relationship, the target master key physical index corresponds to the target master key unique identifier and the target encryption machine cluster identifier, and the target master key physical index is the master key physical index of the first target master key. For example, the key mapping relationship is shown in Table 1 below:

[0044] Table 1

[0045] Table 1 shows the key mapping relationship, including the mapping relationship between the master key unique identifier, the encryption machine cluster identifier, and the master key physical index. The same master key can exist in different encryption machine clusters. The master key unique identifier of master key MK1 is gIndex1. Master key MK1 exists in two encryption machine clusters, and the master key physical index of master key MK1 in the two encryption machine clusters is also different. The encryption machine cluster identifiers of the two encryption machine clusters are hsmClusterId1 and hsmClusterId2, respectively. Correspondingly, the master key physical index corresponding to the encryption machine cluster identifier hsmClusterId1 is hsmIndex1, and the master key physical index corresponding to the encryption machine cluster identifier hsmClusterId2 is hsmIndex2. If the target master key unique identifier is gIndex1 and the target encryption machine cluster identifier is hsmClusterId1, then the target master key physical index is hsmIndex1. The corresponding master key MK1 can be obtained based on the target master key physical index hsmIndex1.

[0046] In some examples, the key mapping relationship can be pre-synchronized by the key management platform to the encryption and decryption execution platform. The encryption and decryption execution platform can determine the target master key physical index in the pre-synchronized key mapping relationship based on the target master key unique identifier and the target encryption machine cluster identifier, and then determine the encryption machine to be called based on the target master key physical index.

[0047] In some examples, the target master key physical index is obtained by the encryption / decryption execution platform by querying the key management platform for a key mapping relationship. The encryption / decryption execution platform may provide the obtained target master key unique identifier and target encryption machine cluster identifier to the key management platform. The key management platform determines the target master key physical index from the key mapping relationship based on the target master key unique identifier and target encryption machine cluster identifier, and feeds the target master key physical index back to the encryption / decryption execution platform, so that the encryption / decryption execution platform can determine the encryption machine to be invoked based on the target master key physical index.

[0048] The encryption / decryption request may include data to be processed and target working key indication data. The data to be processed may include data to be encrypted or data to be decrypted. The encryption / decryption request may be specifically implemented as an encryption request or a decryption request. If the data to be processed includes data to be encrypted, the encryption / decryption request is implemented as an encryption request, and the encryption engine subsequently encrypts the data to be encrypted. If the data to be processed includes data to be decrypted, the encryption / decryption request is implemented as a decryption request, and the encryption engine subsequently decrypts the data to be decrypted. The working key indication data may indicate a working key ciphertext; that is, the corresponding working key ciphertext can be obtained based on the working key indication data. Different working key ciphertexts correspond to different working key indication data. The target working key indication data is the working key indication data in the encryption / decryption request, and is used to indicate the target working key ciphertext. In some examples, the working key indication data may include a working key ciphertext index or a working key ciphertext. Correspondingly, the target working key indication data may include a target working key ciphertext index or a target working key ciphertext. The target working key ciphertext index points to the target working key ciphertext, and the target working key ciphertext can be obtained based on the target working key ciphertext index.

[0049] In step S202, the target working key ciphertext is decrypted using the first target master key to obtain the target working key.

[0050] The working key ciphertext is obtained by encrypting the working key using the master key. Correspondingly, the target working key ciphertext is obtained by encrypting the target working key using the first target master key. The encryption engine can obtain the target working key ciphertext based on the target working key indication data and decrypt the target working key using the first target master key to obtain the target working key. The encryption engine can obtain the working key ciphertext based on the working key indication data. The working key ciphertext does not need to be stored in the encryption engine. The amount of working keys, or working key ciphertext, is not limited by the encryption engine's capacity, providing more flexible management of working keys or working key ciphertext.

[0051] In step S203, the target working key is used to encrypt or decrypt the data to be processed to obtain result data.

[0052] The result data may include data obtained by encrypting or decrypting the data to be processed using the target working key, and may also include data related to the encryption process or the decryption process. If the data to be processed is encrypted data, the target working key is used to encrypt the data to be processed, and the result data obtained may include the encrypted ciphertext of the encrypted data and the target working key indication data. If the data to be processed is decrypted data, the target working key is used to decrypt the data to be decrypted, and the result data obtained may include the decrypted plaintext of the decrypted data. In some cases, the result data may also include the target working key indication data.

[0053] In step S204, the result data is fed back to the encryption and decryption execution platform.

[0054] Upon receiving the result data, the encryption and decryption execution platform may store the result data or transmit the result data to other devices, equipment, or platforms for storage by such other devices, equipment, or platforms. For example, if the encryption and decryption execution platform belongs to the user, the result data may be directly stored; if the encryption and decryption execution platform is independent of the user, the result data may be sent to the user and stored on the user's device, equipment, or platform. The encryption and decryption execution platform, other devices, equipment, or platforms may be configured with an application database to store the result data in the format required by the application database. The encryption and decryption execution platform may also transmit the result data to downstream systems, enabling such downstream systems to also have the ability to decrypt and use the data.

[0055] In an embodiment of the present application, an encryption engine with a first target master key can be invoked by an encryption / decryption execution platform based on a key mapping relationship maintained by a key management platform. The encryption engine uses the first target master key indicated by the physical index of the target master key in the encryption / decryption request sent by the encryption / decryption execution platform to decrypt the target working key ciphertext indicated by the target working key indication data in the encryption / decryption request to obtain the target working key. The target working key is then used to encrypt or decrypt the pending data in the encryption / decryption request, obtaining the result data and feeding it back to the encryption / decryption execution platform. During this encryption / decryption process, the plaintext working key is only obtained when the encryption engine decrypts the working key ciphertext using the master key when encrypting or decrypting the pending data. The plaintext working key is not transmitted between different platforms or devices; instead, the working key indication data indicating the working key ciphertext is transmitted. This prevents the working key from being exposed in plaintext, thereby preventing the working key from being leaked and improving data security. Furthermore, the working key indication data circulates between different platforms and devices, ensuring that all platforms and devices that obtain the working key indication data are capable of decrypting data while maintaining data security, thereby improving the applicability of the data encryption / decryption method.

[0056] In some embodiments, the information carrying the encrypted ciphertext can be structured so that it can be generated and used in a unified format. The encrypted ciphertext here can include the encrypted ciphertext of the data to be encrypted or the data to be decrypted. The encrypted ciphertext of the data to be encrypted is the ciphertext obtained by encrypting the data to be encrypted during the encryption process; the data to be decrypted is the ciphertext obtained during the decryption process and needs to be decrypted.

[0057] In the case where the data to be processed includes data to be encrypted, that is, during the encryption process, the result data includes structured information. In the case where the data to be processed includes data to be decrypted, that is, during the decryption process, the data to be processed includes structured information. Structured information is information with a fixed structure and format. The structured information may include a first field, and the first field may include target working key indication data, encryption auxiliary data, and encrypted ciphertext. The target working key indication data may indicate the target working key ciphertext. In the key management platform, the corresponding target working key ciphertext and the corresponding master key physical index may be obtained based on the target working key indication data. The target working key indication data in the first field may be filled in during the encryption process, specifically, may be filled in the first field by the encryption party or other parties. The specific content of the encrypted ciphertext can refer to the relevant content in the above embodiments and will not be repeated here. The encryption auxiliary data includes the auxiliary data required in the encryption process. In some examples, the encryption auxiliary data may include one or more of the following: encryption algorithm data, random vector data, encryption mode data, encryption and decryption encoding data. Encryption algorithm data can represent the encryption algorithm used to encrypt the ciphertext. It can use an enumerated data type. The meaning of the encryption algorithm data value can be customized. The encryption algorithm data can be entered during encryption and can be specifically entered into the first field by the encrypting party or other party. Random vector data can represent the random initialization vector required for encrypting the ciphertext. The random initialization vector can be randomly generated by the encryption machine or encryption party and entered into the first field. Encryption model data can represent the encryption mode used to encrypt the ciphertext. Encryption models may include but are not limited to Electronic Codebook (ECB) mode and Cipher Block Chaining (CBC) mode. Encryption model data can use an enumerated data type. The meaning of the encryption mode data value can be customized. The encryption mode data can be entered during encryption and can be specifically entered into the first field by the encrypting party or other party. In some cases, encryption algorithm data and encryption mode data can be combined into encryption algorithm and mode data, which can represent the encryption algorithm and encryption mode. The encryption and decryption encoding data indicates the conversion between bytes and characters during the encryption and decryption processes. Enumeration-type data types can be used, and the meaning of the encryption and decryption encoding data values ​​can be customized. The encryption and decryption encoding data can be entered during encryption, specifically by the encrypting party or another party, into the first field. Encrypting the plaintext corresponding to the encrypted ciphertext using the encryption auxiliary data in the first field yields the encrypted ciphertext within the structured information.

[0058] In some examples, the first field may also include check data and / or data reserved bits. The check data includes a check value and a check algorithm data. The check value is a check value for the integrity of the plaintext corresponding to the encrypted ciphertext, which can be obtained by processing the encryption machine and filled in the first field. The check value may include a MAC check value. The check algorithm data represents the check algorithm used to calculate the check value. The check algorithm represented by the check algorithm data may include but is not limited to the type and specific algorithm of the check algorithm. The check algorithm data may use an enumeration data type. The value meaning of the check algorithm data may be customized. The check algorithm data may be filled in before calculating the check value. Specifically, it may be filled in by the encryption party or other party into the first field. The check algorithm represented by the check algorithm data may include a MAC check algorithm. The type of MAC check algorithm is not limited here.

[0059] In some examples, the structured information may further include a second field, which includes hash data. The hash data includes a hash value of the plaintext corresponding to the encrypted ciphertext. The hash data can be obtained by processing the plaintext corresponding to the encrypted ciphertext using a predetermined algorithm. The hash data corresponds one-to-one to the plaintext corresponding to the encrypted ciphertext, that is, different plaintexts correspond to different hash data. Hash data can also be regarded as summary data, and a suitable algorithm can be selected here based on the scenario, requirements, experience, etc. For example, the algorithm required to obtain the hash data may include but is not limited to the SM3 algorithm. For example, if the data to be encrypted includes a mobile phone number, the SM3 algorithm can be used to process the mobile phone number to obtain the SM3 hash data of the mobile phone number. The algorithm required to process the hash data is not limited here. It should be noted that the hash data can be used to retrieve the encrypted ciphertext, that is, the hash data can be used to retrieve structured information including the encrypted ciphertext. For example, a device storing structured information can receive a ciphertext search message that includes target hash data. The target hash data includes hash data obtained by processing the plaintext to be searched using a predetermined algorithm. The device storing structured information searches the stored structured information for hash data that matches the target hash data, identifies the structured information containing the hash data that matches the target hash data as the structured information to be searched, and identifies the encrypted ciphertext in the structured information as the encrypted ciphertext to be searched. This solves the problem of ciphertext being unable to be searched, and allows the desired encrypted ciphertext to be retrieved while ensuring data security, thereby obtaining the corresponding plaintext based on the encrypted ciphertext. Data reserved bits are reserved blank data spaces that can be used to add new data to the structured information when needed.

[0060] The content of the structured information can be increased or decreased based on application scenarios, actual needs, etc., and is not limited here. In some examples, when the structured information includes target work key indication data, encryption algorithm data, random vector data, encryption mode data, encryption and decryption coding data, check value, check algorithm data, data reserved bits, encrypted ciphertext, and hash data, the target work key indication data, encryption algorithm data, random vector data, encryption mode data, encryption and decryption coding data, check value, check algorithm data, data reserved bits, and encrypted ciphertext can be one field, namely the first field, and the hash data can be another field, namely the second field.

[0061] Structured information can be implemented as, but is not limited to, information formats with a fixed structure, such as protocol messages, key-value pairs, or JSON structured data.

[0062] When the structured information is implemented as a protocol message, the protocol message may include a protocol header and a protocol body. The protocol header includes target working key indication data and encryption auxiliary data, and the protocol body includes encrypted ciphertext. The protocol header may also include check data and / or data reserved bits. For example, Figure 3 is a schematic diagram of an example of structured information implemented as a protocol message provided in an embodiment of the present application. As shown in Figure 3, the protocol message may include a protocol header, a protocol body and hash data. The protocol header and the protocol body may be one field, namely the first field, and the hash data may be another field, namely the second field. The protocol header may include target working key indication data, random vector data, check value, verification algorithm data, encryption algorithm and mode data, encryption and decryption coding data, data reserved bit and other fields. The protocol body includes encrypted ciphertext and other fields. The length of the above fields can be set according to scenarios, requirements, experience, etc., and is not limited here. For example, the length of the target working key indication data may be 16 bytes, the length of the random vector data may be 32 bytes, the length of the check value may be 32 bytes, the length of the verification algorithm data may be 1 byte, the length of the encryption algorithm and mode data may be 1 byte, the length of the encryption and decryption coding data may be 1 byte, the length of the data reserved bit may be 17 bytes, and the length of the encrypted ciphertext may be greater than or equal to 2 times the length of the plaintext.

[0063] When the structured information is implemented as a key-value pair, the target working key indication data, random vector data, check value, verification algorithm data, encryption algorithm and pattern data, encryption and decryption coding data, data reserved bit, encrypted ciphertext, hash data, etc. can all be used as the key (key) in the key-value pair, and the values ​​of the target working key indication data, random vector data, check value, verification algorithm data, encryption algorithm and pattern data, encryption and decryption coding data, data reserved bit, encrypted ciphertext, hash data, etc. can be used as the value (value) in the key-value pair.

[0064] When the structured information is implemented as JSON structured data, the structured information can be implemented in the form of {"name":"value pair"}, and the target working key indication data, random vector data, check value, verification algorithm data, encryption algorithm and pattern data, encryption and decryption coding data, data reserved bit, encrypted ciphertext, hash data, etc. can be used as names in the JSON structured data, and the values ​​of the target working key indication data, random vector data, check value, verification algorithm data, encryption algorithm and pattern data, encryption and decryption coding data, data reserved bit, encrypted ciphertext, hash data, etc. can be used as value pairs in the JSON structured data.

[0065] The party performing encryption may generate and store structured information based on the aforementioned target working key indication data, random vector data, check value, verification algorithm data, encryption algorithm and mode data, encryption and decryption encoding data, data reserved bits, encrypted ciphertext, hash data, etc. The party performing decryption may implement intra-system and cross-system decryption of encrypted ciphertext based on the structured information and the key mapping relationship maintained by the key management platform.

[0066] The structured information in the above-described embodiments can be used to store and / or transmit between two or more devices, which may belong to the same system or different systems. If the two or more devices transmitting the structured information belong to the same system, the encrypted ciphertext can be transmitted within the same system; if the two or more devices transmitting the structured information belong to different systems, the encrypted ciphertext can be transmitted across systems. Moreover, since the structure of the structured information is pre-set and universal across different systems, this solves the inconvenience of transmitting and using encrypted data across systems and simplifies the processing flow of encrypted data during cross-system transmission. Structured information that meets storage and transmission requirements can be obtained without repeated encryption and decryption in different systems.

[0067] The widespread application of structured information in various systems requires a certain process, requiring each system to be modified to adapt the structured information to each system. If both systems are capable of transmitting data, the two systems can transmit data using the structured information described in the above embodiments. If one system is capable of transmitting structured information and the other is not yet fully modified, then the two systems will transmit plaintext data until both systems are capable of transmitting structured information. At this point, the structured information described in the above embodiments will be used instead of plaintext data.

[0068] In some embodiments, the master key needs to be replaced. Since the working key ciphertext is obtained by encrypting the working key using the master key, when the master key is replaced, the working key needs to be re-encrypted using the replaced master key to obtain a new working key ciphertext, that is, to achieve trans-encryption of the working key. Figure 4 is a flow chart of the data encryption and decryption method provided by another embodiment of the first aspect of the present application. The difference between Figure 4 and Figure 2 is that the data encryption and decryption method shown in Figure 4 also includes steps S205 to S208.

[0069] In step S205, when the first target master key expires or is about to expire, it is called by the key management platform to use the first target master key to decrypt the working key ciphertexts encrypted with the first target master key one by one to obtain the working key.

[0070] The expiration of the first target master key can be due to expiration of its validity period or in response to a corresponding request, and this is not limited here. The expiration of the master key can be determined by the key management platform or the encryption and decryption execution platform through online interface monitoring. The working key ciphertext before re-encryption is still the working key encrypted with the first target master key. The encryption engine is called by the key management platform and decrypts each working key using the first target master key to obtain the working key corresponding to each working key ciphertext.

[0071] In step S206, the working keys are encrypted one by one using the second target master key to obtain new working key ciphertexts.

[0072] The second target master key is a master key that replaces the first target master key and can be obtained in response to user input. The key management platform can configure a corresponding master key unique identifier for the second target master key and add a mapping relationship between the master key unique identifier of the second target master key, the encryption machine cluster identifier, and the master key index to the key mapping relationship. The working key is not deleted during the trans-encryption process to ensure security.

[0073] In some examples, before using the second target master key to encrypt the working key, the key management platform may first add a working key ciphertext record and the master key unique identifier of the second target master key, but at this time the content of the working key ciphertext in the newly added working key ciphertext record is empty; after using the second target master key to encrypt the working key, the obtained new working key ciphertext is used to update the previously added working key ciphertext record, that is, the new working key ciphertext is written into the content of the working key ciphertext in the newly added working key ciphertext record.

[0074] In step S207, the randomly generated plaintext data to be verified is encrypted using the working key obtained based on the working key ciphertext to obtain the ciphertext of the data to be verified.

[0075] Since master key replacement is a relatively infrequent and rigorous process, after obtaining the new working key ciphertext encrypted using the second target master key, the new working key ciphertext needs to be verified. In this embodiment of the present application, the new working key ciphertext can be verified using the randomly generated plaintext data to be verified, combined with the working key obtained from the original working key ciphertext and the second target master key.

[0076] In step S208, the new working key ciphertext is verified based on the plaintext data to be verified, the ciphertext data to be verified, the new working key ciphertext and the second target master key.

[0077] The ciphertext of the data to be verified is the ciphertext of the plaintext data to be verified encrypted using the working key derived from the working key ciphertext before transencryption. The working key does not change before and after transencryption; what changes is the working key ciphertext. That is, the working key ciphertext before transencryption differs from the working key ciphertext after transencryption. If transencryption is successful, for the same data, the ciphertext encrypted using the working key corresponding to the working key ciphertext before transencryption should be consistent with the ciphertext encrypted using the working key corresponding to the working key ciphertext after transencryption, i.e., the new working key ciphertext. The plaintext decrypted using the working key corresponding to the working key ciphertext before transencryption should be consistent with the plaintext decrypted using the working key corresponding to the working key ciphertext after transencryption, i.e., the new working key ciphertext. This fact can be used to verify the new working key ciphertext. Based on the plaintext of the data to be verified, the new working key ciphertext and the second target master key, the ciphertext obtained by encrypting the working key corresponding to the new working key ciphertext can be obtained; based on the ciphertext of the data to be verified, the new working key ciphertext and the second target master key, the plaintext obtained by decrypting the working key corresponding to the new working key ciphertext can be obtained; by comparing the ciphertexts obtained before and after the encryption of the same data, and / or comparing the plaintexts obtained before and after the encryption of the same data, the new working key ciphertext can be verified.

[0078] Specifically, the encryption machine can use the second target master key to decrypt the new working key ciphertext to obtain the working key; use the decrypted working key to decrypt the ciphertext of the data to be verified to obtain the first data, compare the first data with the plaintext of the data to be verified, and / or use the decrypted working key to encrypt the plaintext to be verified to obtain the second data, and compare the second data with the ciphertext of the data to be verified; when the first data is consistent with the plaintext of the data to be verified, and / or the second data is consistent with the ciphertext of the data to be verified, it is determined that the new working key ciphertext verification is successful.

[0079] The first data is the plaintext obtained using the trans-encrypted working key. If the first data matches the plaintext data to be verified, the trans-encrypted working key ciphertext is valid for use. The second data is the ciphertext obtained using the trans-encrypted working key. The ciphertext data to be verified is the ciphertext obtained using the working key before trans-encryption. If the second data matches the ciphertext data to be verified, the trans-encrypted working key ciphertext is valid for use. You can perform either one or both of the comparisons between the first data and the plaintext data to be verified and the second data and the ciphertext data to be verified.

[0080] Correspondingly, if the first data is inconsistent with the plaintext data to be verified, or if the second data is inconsistent with the ciphertext data to be verified, verification of the new working key ciphertext is determined to have failed. This failure may be caused by a trans-encryption failure, the presence of invisible special characters in the randomly generated plaintext data to be verified, or uncontrollable factors during the operation of the encryption machine, such as a power outage during trans-encryption. The plaintext data to be verified can be verified, and appropriate actions can be taken based on the verification results.

[0081] Specifically, when the verification of the new working key ciphertext fails, the encryption machine can verify the plaintext of the data to be verified based on the plaintext of the data to be verified, the ciphertext of the data to be verified, the working key ciphertext and the first target master key; when the verification of the plaintext of the data to be verified fails, obtain a randomly generated new plaintext of the data to be verified, and use the working key obtained based on the working key ciphertext to encrypt the new plaintext of the data to be verified to obtain a new ciphertext of the data to be verified; and verify the new working key ciphertext based on the new plaintext of the data to be verified, the new ciphertext of the data to be verified, the new working key ciphertext and the second target master key.

[0082] The step of verifying the plaintext of the data to be verified based on the plaintext of the data to be verified, the ciphertext of the data to be verified, the working key ciphertext, and the first target master key is similar to the step of verifying the new working key ciphertext based on the plaintext of the data to be verified, the ciphertext of the data to be verified, the new working key ciphertext, and the second target master key in the above embodiment. The encryption machine can use the first target master key to decrypt the working key ciphertext, i.e., the working key ciphertext before encryption, to obtain the working key, and use the decrypted working key to decrypt the ciphertext of the data to be verified to obtain third data, and compare the third data with the plaintext of the data to be verified, and / or, use the decrypted working key to encrypt the plaintext of the data to be verified to obtain fourth data, and compare the fourth data with the ciphertext of the data to be verified; if the third data is consistent with the plaintext of the data to be verified, and / or the fourth data is consistent with the ciphertext of the data to be verified, it is determined that the plaintext of the data to be verified has been successfully verified; if the third data is inconsistent with the plaintext of the data to be verified, or the fourth data is inconsistent with the ciphertext of the data to be verified, it is determined that the plaintext of the data to be verified has failed verification. The third data is the plaintext obtained by decrypting the working key before trans-encryption, and the fourth data is the ciphertext obtained by encrypting the working key before trans-encryption. The third data is consistent with the plaintext of the data to be verified, indicating that there is no problem with the randomly generated plaintext of the data to be verified, that is, the verification of the plaintext of the data to be verified is successful; the fourth data is consistent with the ciphertext of the data to be verified, indicating that there is no problem with the randomly generated plaintext of the data to be verified, that is, the verification of the plaintext of the data to be verified is successful; in the comparison between the third data and the plaintext of the data to be verified and the comparison between the fourth data and the ciphertext of the data to be verified, one comparison can be performed, or both comparisons can be performed. If there is no problem with the plaintext of the data to be verified, the above-mentioned failure to verify the new working key ciphertext may be caused by factors other than the plaintext of the data to be verified. The new working key ciphertext can be re-verified using the plaintext of the data to be verified. The specific steps can be found in the relevant description in the above embodiment, which will not be repeated here. If the third data is inconsistent with the plaintext data to be verified, or the fourth data is inconsistent with the ciphertext data to be verified, this indicates that the randomly generated plaintext data to be verified may have a problem. A new plaintext data to be verified can be randomly generated, and a new ciphertext data to be verified corresponding to the new plaintext data to be verified can be obtained. The new ciphertext data to be verified is encrypted using the working key corresponding to the working key ciphertext before transcryption. The steps for verifying the new working key ciphertext based on the new plaintext data to be verified, the new ciphertext data to be verified, the new working key ciphertext, and the second target master key are similar to the steps for verifying the new working key ciphertext based on the plaintext data to be verified, the ciphertext data to be verified, the new working key ciphertext, and the second target master key in the above-described embodiment. Please refer to the relevant description in the above-described embodiment and will not be repeated here.

[0083] In the above embodiment, the transencryption of the working key is performed one by one, and records must be kept before and after the transencryption to ensure that the new working key ciphertext is verified one by one to avoid missing the transencryption of the working key and the verification of the new working key ciphertext.

[0084] In some embodiments, the working key has a validity period. When the validity period is reached, the working key needs to be replaced, and the protected data to be processed needs to be trans-encrypted. The life cycle of the working key may include the working key validity period, the working key replacement period, and the working key expiration period in chronological order. For example, 0 to 2.5 years is the working key validity period, 2.5 to 3 years is the working key replacement period, and after 3 years is the working key expiration period. When the current time point is in the validity period of the working key, the original working key is valid, and the encryption machine uses the original working key to encrypt the encrypted data and uses the original working key to decrypt the decrypted data. When the current time point is in the working key replacement period, the original working key is gradually replaced with a new working key. The encryption machine can use the original working key to decrypt the decrypted data and use the new working key to encrypt the encrypted data, and feed back the working key indication data indicating the working key ciphertext corresponding to the new working key to the encryption and decryption execution platform to achieve implicit trans-encryption of the data to be processed. When the current time point is in the working key expiration period, that is, after the working key replacement period, the new working key has completely replaced the original working key, and the encryption machine can use the new working key to decrypt the data to be decrypted, and use the new working key to encrypt the data to be encrypted. In some examples, when the current time point is in the working key expiration period, the encryption and decryption execution platform can provide the pending data that has not been trans-encrypted during the working key replacement period to the encryption machine based on the actual needs of data activity, and the encryption machine uses the new working key to encrypt or decrypt the pending data to be processed, completing the trans-encryption of the pending data. For example, the encryption machine can use the new working key to encrypt or decrypt the pending data whose generation time is within a preset time period from the current time point and has not been trans-encrypted during the working key replacement period, completing the trans-encryption; the encryption machine does not trans-encrypt the pending data whose generation time exceeds the preset time period from the current time point.

[0085] The embodiment of the present application can realize the senseless transencryption of working keys and data to be processed. When the amount of working keys and data to be processed is large, transencryption can be performed one by one in a centralized manner to improve the efficiency of transencryption.

[0086] In some embodiments, a root encryption machine may also be provided. The root encryption machine is used to maintain all master keys and can record master keys based on user input. If the encryption machine in the above embodiment is a root encryption machine, the encryption machine can store the master key and also determine the master key's physical index in the root encryption machine as the master key's unique master key identifier, which is synchronized to the key management platform.

[0087] A second aspect of the present application provides a data encryption and decryption method, which is applied to an encryption and decryption execution platform. That is, the data encryption and decryption method can be executed by the encryption and decryption execution platform. Figure 5 is a flowchart of the data encryption and decryption method provided in an embodiment of the second aspect of the present application. As shown in Figure 5, the data encryption and decryption method may include steps S301 to S303.

[0088] In step S301, based on the key mapping relationship maintained by the key management platform, an encryption machine with a first target master key is called.

[0089] The key mapping relationship may include the mapping relationship between the master key unique identifier, the encryption machine cluster identifier and the master key physical index.

[0090] Specifically, the encryption and decryption execution platform can determine the target master key physical index based on the obtained target master key unique identifier, target encryption machine cluster identifier and key mapping relationship; according to the target master key physical index, determine the encryption machine with the first target master key and call it.

[0091] In some examples, the encryption and decryption execution platform may query the master key physical index corresponding to the target master key unique identifier and the target encryption machine cluster identifier in the key mapping relationship pre-synchronized from the key management platform to determine it as the target master key physical index.

[0092] In other examples, the encryption and decryption execution platform may query the key management platform for the master key physical index corresponding to the key mapping relationship and the target master key unique identifier and the target encryption machine cluster identifier based on the target master key unique identifier and the target encryption machine cluster identifier, and determine it as the target master key physical index.

[0093] In step S302, an encryption and decryption request is sent to the encryption machine.

[0094] The encryption / decryption request includes the data to be processed and target working key indication data. The data to be processed includes data to be encrypted or decrypted. The target working key indication data indicates the target working key ciphertext. The encryption / decryption request causes the encryption engine to decrypt the target working key ciphertext using the first target master key to obtain the target working key, and then to encrypt or decrypt the data to be processed using the target working key to obtain the result data.

[0095] In some examples, the target working key indication data includes a target working key ciphertext index or a target working key ciphertext. The target working key ciphertext index points to the target working key ciphertext, which is obtained by encrypting the target working key according to the first target master key.

[0096] In step S303, the result data fed back by the encryption machine is received.

[0097] In some examples, when the data to be processed includes data to be encrypted, the result data includes the encrypted ciphertext of the data to be encrypted and target working key indication data. When the data to be processed includes data to be decrypted, the result data includes the decrypted plaintext of the data to be decrypted.

[0098] In some examples, when the data to be processed includes data to be encrypted, the result data includes structured information. When the data to be processed includes data to be decrypted, the data to be processed includes structured information. The structured information includes a first field, the first field includes target work key indication data, encryption auxiliary data, and encrypted ciphertext, and the encrypted ciphertext includes encrypted ciphertext of the data to be encrypted or data to be decrypted.

[0099] In some examples, the encryption auxiliary data includes one or more of the following: encryption algorithm data, random vector data, encryption mode data, and encryption / decryption encoding data.

[0100] In some examples, the first field further includes check data and / or data reserved bits, wherein the check data includes a check value and check algorithm data.

[0101] In some examples, the structured information further includes a second field, the second field includes hash data, and the hash data includes a hash value of the plaintext corresponding to the encrypted ciphertext.

[0102] In some examples, the structured information is implemented as a protocol message, a key-value pair, or JSON structured data, wherein the protocol message includes a protocol header and a protocol body, the protocol header includes target working key indication data and encryption auxiliary data, and the protocol body includes encrypted ciphertext.

[0103] In some examples, structured information is used to store or transmit between two or more devices, where the two or more devices belong to the same system or different systems.

[0104] The specific contents of the above steps S301 to S303 can be found in the relevant descriptions in the above embodiments, which will not be repeated here.

[0105] In an embodiment of the present application, the encryption and decryption execution platform calls an encryption machine with a first target master key based on the key mapping relationship maintained by the key management platform, and sends an encryption and decryption request to the encryption machine. The encryption and decryption request includes a physical index of the target master key, data to be processed, and target working key indication data that can indicate the ciphertext of the target working key. The encryption machine can use the first target master key indicated by the physical index of the target master key to decrypt the target working key ciphertext indicated by the target working key indication data to obtain the target working key, and use the target working key to encrypt or decrypt the data to be processed to obtain the result data. The encryption and decryption execution platform receives the result data fed back by the encryption machine. In this encryption and decryption process, the plaintext of the working key is only obtained when the encryption machine uses the master key to decrypt the working key ciphertext when encrypting or decrypting the data to be processed. The plaintext of the working key is not transmitted between different platforms and devices. What is transmitted is the working key indication data indicating the ciphertext of the working key, which can prevent the working key from being exposed in plaintext, thereby avoiding leakage of the working key and improving data security. Moreover, the work key indication data flows between different platforms and devices, which can enable the platforms and devices that obtain the work key indication data to have the ability to decrypt data on the basis of data security, thereby improving the applicability of the data encryption and decryption method.

[0106] In some embodiments, if the current time point is during the working key replacement period, the encryption and decryption execution platform may call the encryption engine to decrypt the decrypted data using the original working key and encrypt the encrypted data using the new working key. If the current time point is after the working key replacement period, the encryption and decryption execution platform may call the encryption engine to decrypt the decrypted data using the new working key and encrypt the encrypted data using the new working key.

[0107] The specific content of the data encryption and decryption method executed by the encryption and decryption execution platform can be found in the relevant content of the data encryption and decryption method executed by the encryption machine in the above embodiment, which will not be repeated here.

[0108] A third aspect of the present application provides a data encryption and decryption method, which is applied to a key management platform. That is, the data encryption and decryption method is performed by the key management platform. FIG6 is a flowchart of the data encryption and decryption method provided in an embodiment of the third aspect of the present application. As shown in FIG6 , the data encryption and decryption method may include step S401.

[0109] In step S401, the encryption and decryption execution platform interacts with the encryption and decryption execution platform so that the encryption and decryption execution platform calls an encryption machine with a first target master key based on the key mapping relationship maintained by the key management platform. The encryption machine uses the first target master key to decrypt the target working key ciphertext indicated by the target working key indication data in the encryption and decryption request to obtain the target working key, and then uses the target working key to encrypt or decrypt the data to be processed in the encryption and decryption request, and obtains the result data and feeds it back to the encryption and decryption execution platform.

[0110] The key mapping relationship includes the mapping relationship between the master key unique identifier, the encryption machine cluster identifier, and the master key physical index. The encryption and decryption request is sent by the encryption and decryption execution platform to the encryption machine. The data to be processed includes the data to be encrypted or the data to be decrypted.

[0111] In some examples, the target working key indication data includes a target working key ciphertext index or a target working key ciphertext. The target working key ciphertext index points to the target working key ciphertext. The target working key ciphertext is obtained by encrypting the target working key according to the first target master key.

[0112] In some examples, the target master key physical index is the master key physical index of the first target master key, and in the key mapping relationship, the target master key physical index corresponds to the target master key unique identifier and the target encryption machine cluster identifier.

[0113] The steps of interaction between the above-mentioned key management platform and the encryption and decryption execution platform can be specifically implemented as follows: synchronizing the key mapping relationship to the encryption and decryption execution platform; or, based on the target master key unique identifier and target encryption machine cluster identifier sent by the encryption and decryption execution platform, querying the physical index of the target master key in the key mapping relationship and feeding back to the encryption and decryption execution platform.

[0114] In some examples, when the data to be processed includes data to be encrypted, the result data includes the encrypted ciphertext of the data to be encrypted and target working key indication data. When the data to be processed includes data to be decrypted, the result data includes the decrypted plaintext of the data to be decrypted.

[0115] In some examples, when the data to be processed includes data to be encrypted, the result data includes structured information. When the data to be processed includes data to be decrypted, the data to be processed includes structured information. The structured information includes a first field, the first field includes target work key indication data, encryption auxiliary data, and encrypted ciphertext, and the encrypted ciphertext includes encrypted ciphertext of the data to be encrypted or data to be decrypted.

[0116] In some examples, the encryption auxiliary data includes one or more of the following: encryption algorithm data, random vector data, encryption mode data, and encryption / decryption encoding data.

[0117] In some examples, the first field further includes check data and / or data reserved bits, wherein the check data includes a check value and check algorithm data.

[0118] In some examples, the structured information may further include a second field, the second field including hash data, and the hash data including a hash value of the plaintext corresponding to the encrypted ciphertext.

[0119] In some examples, the structured information is implemented as a protocol message, a key-value pair, or JSON structured data, wherein the protocol message includes a protocol header and a protocol body, the protocol header includes target working key indication data and encryption auxiliary data, and the protocol body includes encrypted ciphertext.

[0120] In some examples, structured information is used to store or transmit between two or more devices, where the two or more devices belong to the same system or different systems.

[0121] In an embodiment of the present application, a key management platform interacts with an encryption and decryption execution platform, so that the encryption and decryption execution platform calls an encryption machine with a first target master key based on the key mapping relationship maintained by the key management platform. The encryption and decryption execution platform sends an encryption and decryption request to the encryption machine, which includes a physical index of the target master key, data to be processed, and target working key indication data that can indicate the ciphertext of the target working key. The encryption machine can use the first target master key indicated by the physical index of the target master key to decrypt the target working key ciphertext indicated by the target working key indication data to obtain the target working key, and use the target working key to encrypt or decrypt the data to be processed to obtain the result data. The encryption and decryption execution platform receives the result data fed back by the encryption machine. In this encryption and decryption process, the plaintext of the working key is only obtained when the encryption machine uses the master key to decrypt the working key ciphertext when encrypting or decrypting the data to be processed. The plaintext of the working key is not transmitted between different platforms and devices. What is transmitted is the working key indication data indicating the ciphertext of the working key. This can prevent the working key from being exposed in plaintext, thereby avoiding leakage of the working key and improving data security. Moreover, the work key indication data flows between different platforms and devices, which can enable the platforms and devices that obtain the work key indication data to have the ability to decrypt data on the basis of data security, thereby improving the applicability of the data encryption and decryption method.

[0122] In some embodiments, the key management platform can establish a key mapping relationship. In response to a first user input, the key management platform can input a master key unique identifier for a master key, where the input master key unique identifier is generated by an encryption machine; obtain a master key physical index of the master key indicated by the input master key unique identifier and an encryption machine cluster identifier of the encryption machine cluster where the master key resides; and establish the key mapping relationship based on the master key unique identifier, the master key physical index of the master key indicated by the master key unique identifier, and the encryption machine cluster identifier of the encryption machine cluster where the master key resides.

[0123] When the master key needs to be replaced, added, or deleted, the key management platform can perform corresponding replacement, addition, or deletion operations on the information associated with the master key that needs to be replaced, added, or deleted in the key mapping relationship.

[0124] In some embodiments, the master key needs to be replaced. Figure 7 is a flowchart of a data encryption and decryption method provided by another embodiment of the third aspect of the present application. The difference between Figure 7 and Figure 6 is that the data encryption and decryption method shown in Figure 7 further includes steps S402 to S404.

[0125] In step S402 , when the first target master key expires or is about to expire, a second target master key is entered.

[0126] The second target master key is generated by the encryption engine. That is, when the first target master key expires or is about to expire, the encryption engine can generate the second target master key.

[0127] In step S403, the encryption engine is called to decrypt the working key ciphertexts encrypted with the first target master key one by one using the first target master key to obtain the working key, and to encrypt the working key one by one using the second target master key to obtain a new working key ciphertext.

[0128] In step S404, the encryption machine is called to encrypt the randomly generated plaintext of the data to be verified using the working key obtained based on the working key ciphertext to obtain the ciphertext of the data to be verified, and the new working key ciphertext is verified based on the plaintext of the data to be verified, the ciphertext of the data to be verified, the new working key ciphertext and the second target master key.

[0129] The specific contents of the above steps S402 to S404 can be found in the relevant descriptions in the above embodiments, which will not be repeated here.

[0130] In some embodiments, the encryption machine includes a root encryption machine, which stores a master key. Correspondingly, the key management platform can receive the master key physical index of the master key sent by the root encryption machine, and determine the master key physical index of the master key as the master key unique identifier of the master key. For specific details, please refer to the relevant descriptions in the above embodiments and will not be repeated here.

[0131] For ease of understanding, the following two examples are used to illustrate the data encryption and decryption process. The data encryption and decryption process involves a key management platform, an encryption party, an encryption and decryption execution platform, an encryption machine, and a decryption party. The encryption party can be regarded as a user party that has encryption requirements for encrypted data, and the decryption party can be regarded as a user party that has decryption requirements for decrypted data. The encryption and decryption execution platform that interacts with the encryption party and the encryption and decryption execution platform that interacts with the decryption party can be the same or different, and the encryption machines called by the encryption and decryption execution platforms in the encryption process and the decryption process can be the same or different. In this example, for the sake of convenience of description, the encryption and decryption execution platform that interacts with the encryption party and the encryption and decryption execution platform that interacts with the decryption party are the same, and the encryption machines called by the encryption and decryption execution platforms in the encryption process and the decryption process are the same are used as an example for explanation.

[0132] FIG8 is a schematic diagram of an example of a data encryption and decryption process provided in an embodiment of the present application. As shown in FIG8 , the data encryption process may include steps a1 to a15.

[0133] In step a1, the key management platform maintains the key mapping relationship.

[0134] In step a2, the encryption direction sends a data encryption request to the encryption and decryption execution platform, and the data encryption request includes the data to be encrypted, the target working key ciphertext, the target master key unique identifier and the target encryption machine cluster identifier.

[0135] In step a3, the encryption and decryption execution platform sends a first query request to the key management platform. The first query request includes a target master key unique identifier and a target encryption machine cluster identifier.

[0136] In step a4, the key management platform determines the target master key physical index in the key mapping relationship according to the target master key unique identifier and the target encryption machine cluster identifier, and feeds back the target master key physical index to the encryption and decryption execution platform.

[0137] In step a5, the encryption and decryption execution platform calls the corresponding encryption machine according to the physical index of the target master key and sends an encryption request to the encryption machine. The encryption request includes the data to be encrypted and the target working key ciphertext.

[0138] In step a6, the encryption engine decrypts the target working key ciphertext using the master key indicated by the target master key physical index to obtain the target working key, and then uses the target working key to encrypt the data to be encrypted to obtain the encrypted ciphertext.

[0139] In step a7, the encryption engine generates first result data according to the encrypted ciphertext, the target working key ciphertext and the target master key unique identifier, and feeds the first result data back to the encryption and decryption execution platform.

[0140] In step a8, the encryption and decryption execution platform feeds back the first result data to the encryption party.

[0141] In step a9, the decryption direction sends a data decryption request to the encryption and decryption execution platform. The data decryption request includes the data to be decrypted, the target working key ciphertext, the target master key unique identifier and the target encryption machine cluster identifier.

[0142] In step a10, the encryption and decryption execution platform sends a second query request to the key management platform. The second query request includes the target master key unique identifier and the target encryption machine cluster identifier.

[0143] In step a11, the key management platform determines the target master key physical index in the key mapping relationship according to the target master key unique identifier and the target encryption machine cluster identifier, and feeds back the target master key physical index to the encryption and decryption execution platform.

[0144] In step a12, the encryption and decryption execution platform calls the corresponding encryption machine according to the physical index of the target master key and sends a decryption request to the encryption machine. The decryption request includes the data to be decrypted and the target working key ciphertext.

[0145] In step a13, the encryption machine uses the master key indicated by the physical index of the target master key to decrypt the target working key ciphertext to obtain the target working key, and then uses the target working key to decrypt the data to be decrypted to obtain the decrypted plaintext.

[0146] In step a14, the encryption engine generates second result data according to the decrypted plaintext, the target working key ciphertext and the target master key unique identifier, and feeds the second result data back to the encryption and decryption execution platform.

[0147] In step a15, the encryption and decryption execution platform feeds back the second result data to the decryption party.

[0148] FIG9 is a schematic diagram of another example of a data encryption and decryption process provided in an embodiment of the present application. As shown in FIG9 , the data encryption process may include steps b1 to b17.

[0149] In step b1, the key management platform maintains the key mapping relationship.

[0150] In step b2, the encryption direction sends a data encryption request to the encryption and decryption execution platform, and the data encryption request includes the data to be encrypted, the target working key ciphertext index, the target master key unique identifier and the target encryption machine cluster identifier.

[0151] In step b3, the encryption and decryption execution platform obtains the target working key ciphertext according to the target working key ciphertext index.

[0152] In step b4, the encryption and decryption execution platform sends a third query request to the key management platform. The third query request includes the target master key unique identifier and the target encryption machine cluster identifier.

[0153] In step b5, the key management platform determines the target master key physical index in the key mapping relationship according to the target master key unique identifier and the target encryption machine cluster identifier, and feeds back the target master key physical index to the encryption and decryption execution platform.

[0154] In step b6, the encryption and decryption execution platform calls the corresponding encryption machine according to the physical index of the target master key and sends an encryption request to the encryption machine. The encryption request includes the data to be encrypted and the target working key ciphertext.

[0155] In step b7, the encryption machine uses the master key indicated by the physical index of the target master key to decrypt the target working key ciphertext to obtain the target working key, and then uses the target working key to encrypt the data to be encrypted to obtain the encrypted ciphertext.

[0156] In step b8, the encryption machine generates third result data based on the encrypted ciphertext, and feeds the third result data back to the encryption and decryption execution platform.

[0157] In step b9, the encryption and decryption execution platform feeds back fourth result data to the encryption party, where the fourth result data includes the encrypted ciphertext and the target working key ciphertext index.

[0158] In step b10, the decryption direction sends a data decryption request to the encryption and decryption execution platform. The data decryption request includes the data to be decrypted, the target working key ciphertext index, the target master key unique identifier and the target encryption machine cluster identifier.

[0159] In step b11, the encryption and decryption execution platform obtains the target working key ciphertext according to the target working key ciphertext index.

[0160] In step b12, the encryption and decryption execution platform sends a fourth query request to the key management platform. The fourth query request includes the target master key unique identifier and the target encryption machine cluster identifier.

[0161] In step b13, the key management platform determines the target master key physical index in the key mapping relationship according to the target master key unique identifier and the target encryption machine cluster identifier, and feeds back the target master key physical index to the encryption and decryption execution platform.

[0162] In step b14, the encryption and decryption execution platform calls the corresponding encryption machine according to the physical index of the target master key and sends a decryption request to the encryption machine. The decryption request includes the data to be decrypted and the target working key ciphertext.

[0163] In step b15, the encryption machine decrypts the target working key ciphertext using the master key indicated by the physical index of the target master key to obtain the target working key, and then uses the target working key to decrypt the data to be decrypted to obtain the decrypted plaintext.

[0164] In step b16, the encryption engine generates fifth result data based on the decrypted plaintext, and feeds the fifth result data back to the encryption and decryption execution platform.

[0165] In step b17, the encryption and decryption execution platform feeds back sixth result data to the decryption party, where the sixth result data includes the encrypted ciphertext and the target working key ciphertext index.

[0166] A fourth aspect of the present application provides an encryption machine having a first target master key. FIG10 is a schematic diagram of the structure of an encryption machine provided in an embodiment of the fourth aspect of the present application. As shown in FIG10 , the encryption machine 500 may include a receiving module 501, an encryption / decryption module 502, and a sending module 503.

[0167] The receiving module 501 may be configured to be called by the encryption and decryption execution platform based on the key mapping relationship, and receive an encryption and decryption request sent by the encryption and decryption execution platform.

[0168] The key management platform maintains key mappings, including the mapping between the unique identifier of the master key, the identifier of the encryption machine cluster, and the physical index of the master key. An encryption / decryption request includes the physical index of the target master key, the data to be processed, and the target working key indicator. The target master key physical index is the physical index of the first target master key, the data to be processed includes the data to be encrypted or decrypted, and the target working key indicator indicates the ciphertext of the target working key.

[0169] In some examples, the target working key indication data includes a target working key ciphertext index or a target working key ciphertext. The target working key ciphertext index points to the target working key ciphertext, which is obtained by encrypting the target working key according to the first target master key.

[0170] In some examples, the receiving module 501 may be specifically configured to receive an encryption / decryption request sent by the encryption / decryption execution platform based on the obtained target master key unique identifier, target encryption machine cluster identifier, and key mapping relationship. In the key mapping relationship, the target master key physical index corresponds to the target master key unique identifier and the target encryption machine cluster identifier.

[0171] In some examples, the key mapping relationship is pre-synchronized from the key management platform to the encryption and decryption execution platform.

[0172] In some examples, the physical index of the target master key is obtained by the encryption and decryption execution platform querying the key management platform for a key mapping relationship.

[0173] The encryption / decryption module 502 may be used to decrypt the target working key ciphertext using the first target master key to obtain the target working key; and to encrypt or decrypt the data to be processed using the target working key to obtain result data.

[0174] In some examples, when the data to be processed includes data to be encrypted, the result data includes the encrypted ciphertext of the data to be encrypted and target working key indication data. When the data to be processed includes data to be decrypted, the result data includes the decrypted plaintext of the data to be decrypted.

[0175] The sending module 503 may be used to feed back result data to the encryption and decryption execution platform.

[0176] In an embodiment of the present application, an encryption engine with a first target master key can be called by an encryption / decryption execution platform based on a key mapping relationship maintained by a key management platform. The first target master key is used to decrypt the target working key ciphertext indicated by the target working key indication data in the encryption / decryption request sent by the encryption / decryption execution platform to obtain the target working key. The target working key is then used to encrypt or decrypt the pending data in the encryption / decryption request to obtain the result data and feed it back to the encryption / decryption execution platform. In this encryption / decryption process, the plaintext of the working key is only obtained when the encryption engine decrypts the working key ciphertext using the master key when encrypting or decrypting the pending data. The plaintext of the working key is not transmitted between different platforms or devices. Instead, the working key indication data indicating the working key ciphertext is transmitted. This prevents the working key from being exposed in plaintext, thereby avoiding leakage of the working key and improving data security. Moreover, the working key indication data circulates between different platforms and devices. On the basis of data security, the platform or device that obtains the working key indication data can have the ability to decrypt the data, thereby improving the applicability of the data encryption / decryption method.

[0177] In some examples, when the data to be processed includes data to be encrypted, the result data includes structured information. When the data to be processed includes data to be decrypted, the data to be processed includes structured information. The structured information includes a first field, the first field includes target work key indication data, encryption auxiliary data, and encrypted ciphertext, and the encrypted ciphertext includes encrypted ciphertext of the data to be encrypted or data to be decrypted.

[0178] In some examples, the encryption auxiliary data includes one or more of the following: encryption algorithm data, random vector data, encryption mode data, and encryption / decryption encoding data.

[0179] In some examples, the first field further includes check data and / or data reserved bits, wherein the check data includes a check value and check algorithm data.

[0180] In some examples, the structured information further includes a second field, the second field includes hash data, and the hash data includes a hash value of the plaintext corresponding to the encrypted ciphertext.

[0181] In some examples, the structured information is implemented as a protocol message, a key-value pair, or JSON structured data, wherein the protocol message includes a protocol header and a protocol body, the protocol header includes target working key indication data and encryption auxiliary data, and the protocol body includes encrypted ciphertext.

[0182] In some examples, structured information is used to store or transmit between two or more devices, where the two or more devices belong to the same system or different systems.

[0183] In some embodiments, the above-mentioned encryption and decryption module 502 can also be used to be called by the key management platform when the first target master key expires or is about to expire, and use the first target master key to decrypt the working key ciphertext encrypted with the first target master key one by one to obtain the working key; use the second target master key to encrypt the working key one by one to obtain a new working key ciphertext.

[0184] In some embodiments, the above-mentioned encryption and decryption module 502 can also be used to: encrypt the randomly generated plaintext of the data to be verified using the working key obtained based on the working key ciphertext to obtain the ciphertext of the data to be verified; and verify the new working key ciphertext based on the plaintext of the data to be verified, the ciphertext of the data to be verified, the new working key ciphertext and the second target master key.

[0185] In some examples, the above-mentioned encryption and decryption module 502 can be specifically used to: use the second target master key to decrypt the new working key ciphertext to obtain the working key; use the decrypted working key to decrypt the ciphertext of the data to be verified to obtain first data, compare the first data with the plaintext of the data to be verified, and / or use the decrypted working key to encrypt the plaintext to be verified to obtain second data, and compare the second data with the ciphertext of the data to be verified; when the first data is consistent with the plaintext of the data to be verified, and / or the second data is consistent with the ciphertext of the data to be verified, determine that the verification of the new working key ciphertext is successful.

[0186] In some examples, the encryption and decryption module 502 can also be used to: determine that the verification of the new working key ciphertext fails when the first data is inconsistent with the plaintext of the data to be verified, or when the second data is inconsistent with the ciphertext of the data to be verified; verify the plaintext of the data to be verified based on the plaintext of the data to be verified, the ciphertext of the data to be verified, the working key ciphertext and the first target master key when the verification of the new working key ciphertext fails; obtain a randomly generated new plaintext of the data to be verified, encrypt the new plaintext of the data to be verified using the working key obtained based on the working key ciphertext to obtain a new ciphertext of the data to be verified; verify the new working key ciphertext based on the new plaintext of the data to be verified, the new ciphertext of the data to be verified, the new working key ciphertext and the second target master key.

[0187] In some embodiments, the above-mentioned encryption and decryption module 502 can also be used for: when the current time point is in the working key replacement period, using the original working key to decrypt the decrypted data, and using the new working key to encrypt the encrypted data; when the current time point is after the working key replacement period, using the new working key to decrypt the decrypted data, and using the new working key to encrypt the encrypted data.

[0188] In some embodiments, when the encryption machine is a root encryption machine, the encryption machine 500 may further include a storage module and a synchronization module.

[0189] The storage module may be used to store the master key.

[0190] The synchronization module can be used to determine the master key physical index of the master key in the root encryption machine as the master key unique identifier of the master key, and synchronize it to the key management platform.

[0191] A fifth aspect of the present application provides a data encryption and decryption device that can be applied to an encryption and decryption execution platform. That is, the encryption and decryption execution platform can be implemented by the data encryption and decryption device. Figure 11 is a schematic diagram of the structure of the data encryption and decryption device provided in an embodiment of the fifth aspect of the present application. As shown in Figure 11, the data encryption and decryption device 600 may include a sending module 601 and a receiving module 602.

[0192] The sending module 601 can be used to call the encryption machine with the first target master key based on the key mapping relationship maintained by the key management platform, and send an encryption and decryption request to the encryption machine.

[0193] The key mapping relationship includes the mapping relationship between the master key unique identifier, the encryption machine cluster identifier, and the master key physical index. The encryption / decryption request includes the target master key physical index, the data to be processed, and the target working key indication data. The target master key physical index is the master key physical index of the first target master key. The data to be processed includes data to be encrypted or data to be decrypted. The target working key indication data is used to indicate the target working key ciphertext. The encryption / decryption request is used to cause the encryption machine to decrypt the target working key ciphertext using the first target master key to obtain the target working key, and then use the target working key to encrypt or decrypt the data to be processed to obtain the result data.

[0194] In some examples, the target working key indication data includes a target working key ciphertext index or a target working key ciphertext. The target working key ciphertext index points to the target working key ciphertext, which is obtained by encrypting the target working key according to the first target master key.

[0195] In some examples, when the data to be processed includes data to be encrypted, the result data includes the encrypted ciphertext of the data to be encrypted and target working key indication data. When the data to be processed includes data to be decrypted, the result data includes the decrypted plaintext of the data to be decrypted.

[0196] The receiving module 602 may be configured to receive result data fed back by the encryption machine.

[0197] In an embodiment of the present application, the encryption and decryption execution platform calls an encryption machine with a first target master key based on the key mapping relationship maintained by the key management platform, and sends an encryption and decryption request to the encryption machine. The encryption and decryption request includes a physical index of the target master key, data to be processed, and target working key indication data that can indicate the ciphertext of the target working key. The encryption machine can use the first target master key indicated by the physical index of the target master key to decrypt the target working key ciphertext indicated by the target working key indication data to obtain the target working key, and use the target working key to encrypt or decrypt the data to be processed to obtain the result data. The encryption and decryption execution platform receives the result data fed back by the encryption machine. In this encryption and decryption process, the plaintext of the working key is only obtained when the encryption machine uses the master key to decrypt the working key ciphertext when encrypting or decrypting the data to be processed. The plaintext of the working key is not transmitted between different platforms and devices. What is transmitted is the working key indication data indicating the ciphertext of the working key, which can prevent the working key from being exposed in plaintext, thereby avoiding leakage of the working key and improving data security. Moreover, the work key indication data flows between different platforms and devices, which can enable the platforms and devices that obtain the work key indication data to have the ability to decrypt data on the basis of data security, thereby improving the applicability of the data encryption and decryption method.

[0198] In some examples, when the data to be processed includes data to be encrypted, the result data includes structured information. When the data to be processed includes data to be decrypted, the data to be processed includes structured information. The structured information includes a first field, the first field includes target work key indication data, encryption auxiliary data, and encrypted ciphertext, and the encrypted ciphertext includes encrypted ciphertext of the data to be encrypted or data to be decrypted.

[0199] In some examples, the encryption auxiliary data includes one or more of the following: encryption algorithm data, random vector data, encryption mode data, and encryption / decryption encoding data.

[0200] In some examples, the first field further includes check data and / or data reserved bits, wherein the check data includes a check value and check algorithm data.

[0201] In some examples, the structured information further includes a second field, the second field includes hash data, and the hash data includes a hash value of the plaintext corresponding to the encrypted ciphertext.

[0202] In some examples, the structured information is implemented as a protocol message, a key-value pair, or JSON structured data, wherein the protocol message includes a protocol header and a protocol body, the protocol header includes target working key indication data and encryption auxiliary data, and the protocol body includes encrypted ciphertext.

[0203] In some examples, structured information is used to store or transmit between two or more devices, where the two or more devices belong to the same system or different systems.

[0204] In some embodiments, the data encryption and decryption device 600 may also include a calling module, which can be used to: determine the target master key physical index based on the obtained target master key unique identifier, target encryption machine cluster identifier and key mapping relationship; determine the encryption machine with the first target master key and call it according to the target master key physical index.

[0205] In some examples, the calling module can be specifically used to: in the key mapping relationship pre-synchronized from the key management platform, query the master key physical index corresponding to the target master key unique identifier and the target encryption machine cluster identifier to determine it as the target master key physical index.

[0206] In some examples, the sending module 601 and the receiving module 602 can be used to: based on the target master key unique identifier and the target encryption machine cluster identifier, query the key management platform for the master key physical index corresponding to the key mapping relationship and the target master key unique identifier and the target encryption machine cluster identifier, and determine it as the target master key physical index.

[0207] In some examples, the calling module can be used to: when the current time point is in the working key replacement period, call the encryption machine to decrypt the decrypted data using the original working key and encrypt the encrypted data using the new working key; when the current time point is after the working key replacement period, call the encryption machine to decrypt the decrypted data using the new working key and encrypt the encrypted data using the new working key.

[0208] A sixth aspect of the present application provides a data encryption and decryption device that can be applied to a key management platform. That is, the key management platform can be implemented by the data encryption and decryption device. Figure 12 is a schematic diagram of the structure of the data encryption and decryption device provided in an embodiment of the sixth aspect of the present application. As shown in Figure 12, the encryption and decryption device 700 may include a communication module 701.

[0209] The communication module 701 can be used to interact with the encryption and decryption execution platform so that the encryption and decryption execution platform calls an encryption machine with a first target master key based on the key mapping relationship maintained by the key management platform. The encryption machine uses the first target master key to decrypt the target working key ciphertext indicated by the target working key indication data in the encryption and decryption request to obtain the target working key, and then uses the target working key to encrypt or decrypt the data to be processed in the encryption and decryption request, and obtains the result data and feeds it back to the encryption and decryption execution platform.

[0210] The key mapping relationship includes the mapping relationship between the unique identifier of the master key, the encryption machine cluster identifier, and the physical index of the master key. The encryption and decryption request is sent by the encryption and decryption execution platform to the encryption machine. The data to be processed includes data to be encrypted or data to be decrypted. The encryption and decryption request also includes the physical index of the target master key, which is the physical index of the master key of the first target master key.

[0211] The communication module 701 may include a sending unit and a receiving unit, and the sending unit and the receiving unit may jointly implement the steps of interacting with the encryption and decryption execution platform.

[0212] In some examples, the target working key indication data includes a target working key ciphertext index or a target working key ciphertext. The target working key ciphertext index points to the target working key ciphertext, which is obtained by encrypting the target working key according to the first target master key.

[0213] In some examples, the target master key physical index is the master key physical index of the first target master key, and in the key mapping relationship, the target master key physical index corresponds to the target master key unique identifier and the target encryption machine cluster identifier.

[0214] In some examples, when the data to be processed includes data to be encrypted, the result data includes the encrypted ciphertext of the data to be encrypted and target working key indication data. When the data to be processed includes data to be decrypted, the result data includes the decrypted plaintext of the data to be decrypted.

[0215] In an embodiment of the present application, a key management platform interacts with an encryption and decryption execution platform, so that the encryption and decryption execution platform calls an encryption machine with a first target master key based on the key mapping relationship maintained by the key management platform. The encryption and decryption execution platform sends an encryption and decryption request to the encryption machine, which includes a physical index of the target master key, data to be processed, and target working key indication data that can indicate the ciphertext of the target working key. The encryption machine can use the first target master key indicated by the physical index of the target master key to decrypt the target working key ciphertext indicated by the target working key indication data to obtain the target working key, and use the target working key to encrypt or decrypt the data to be processed to obtain the result data. The encryption and decryption execution platform receives the result data fed back by the encryption machine. In this encryption and decryption process, the plaintext of the working key is only obtained when the encryption machine uses the master key to decrypt the working key ciphertext when encrypting or decrypting the data to be processed. The plaintext of the working key is not transmitted between different platforms and devices. What is transmitted is the working key indication data indicating the ciphertext of the working key. This can prevent the working key from being exposed in plaintext, thereby avoiding leakage of the working key and improving data security. Moreover, the work key indication data flows between different platforms and devices, which can enable the platforms and devices that obtain the work key indication data to have the ability to decrypt data on the basis of data security, thereby improving the applicability of the data encryption and decryption method.

[0216] In some examples, when the data to be processed includes data to be encrypted, the result data includes structured information. When the data to be processed includes data to be decrypted, the data to be processed includes structured information. The structured information includes a first field, the first field includes target work key indication data, encryption auxiliary data, and encrypted ciphertext, and the encrypted ciphertext includes encrypted ciphertext of the data to be encrypted or data to be decrypted.

[0217] In some examples, the encryption auxiliary data includes one or more of the following: encryption algorithm data, random vector data, encryption mode data, and encryption / decryption encoding data.

[0218] In some examples, the first field further includes check data and / or data reserved bits, wherein the check data includes a check value and check algorithm data.

[0219] In some examples, the structured information further includes a second field, the second field includes hash data, and the hash data includes a hash value of the plaintext corresponding to the encrypted ciphertext.

[0220] In some examples, the structured information is implemented as a protocol message, a key-value pair, or JSON structured data, wherein the protocol message includes a protocol header and a protocol body, the protocol header includes target working key indication data and encryption auxiliary data, and the protocol body includes encrypted ciphertext.

[0221] In some examples, structured information is used to store or transmit between two or more devices, where the two or more devices belong to the same system or different systems.

[0222] In some examples, the above-mentioned communication module 701 can be used to: synchronize the key mapping relationship to the encryption and decryption execution platform; or, based on the target master key unique identifier and target encryption machine cluster identifier sent by the encryption and decryption execution platform, query the physical index of the target master key in the key mapping relationship and feedback to the encryption and decryption execution platform.

[0223] In some embodiments, the data encryption and decryption device 700 may further include a key maintenance module and a calling module.

[0224] The key maintenance module can be used to: in response to the user's first input, enter the master key unique identifier of the master key, where the entered master key unique identifier is generated by the encryption machine; obtain the master key physical index of the master key indicated by the entered master key unique identifier and the encryption machine cluster identifier of the encryption machine cluster where the master key is located; establish a key mapping relationship based on the master key unique identifier, the master key physical index of the master key indicated by the master key unique identifier, and the encryption machine cluster identifier of the encryption machine cluster where the master key is located.

[0225] The key maintenance module can be used to: when the first target master key expires or is about to expire, enter the second target master key. The second target master key is generated by the encryption machine.

[0226] The calling module can be used to: call the encryption machine to use the first target master key to decrypt the working key ciphertext encrypted with the first target master key one by one to obtain the working key, and use the second target master key to encrypt the working key one by one to obtain a new working key ciphertext.

[0227] In some examples, the calling module can be used to: call the encryption machine to use the working key obtained based on the working key ciphertext to encrypt the randomly generated plaintext of the data to be verified, obtain the ciphertext of the data to be verified, and verify the new working key ciphertext based on the plaintext of the data to be verified, the ciphertext of the data to be verified, the new working key ciphertext and the second target master key.

[0228] In some embodiments, the encryption engine may include a root encryption engine that stores a master key. The communication module 701 may also be configured to receive a master key physical index of a master key sent by the root encryption engine. The key maintenance module may also be configured to determine the master key physical index of the master key as a master key unique identifier for the master key.

[0229] A seventh aspect of the present application further provides an electronic device that can implement the encryption engine, encryption and decryption execution platform, and key management platform in the above-mentioned embodiments. Figure 13 is a schematic diagram of the structure of an electronic device provided in an embodiment of the seventh aspect of the present application. As shown in Figure 13, electronic device 800 includes a memory 801, a processor 802, and a computer program stored in memory 801 and executable on processor 802.

[0230] In some examples, the processor 802 may include a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0231] The memory 801 may include a read-only memory (ROM), a random access memory (RAM), a disk storage medium device, an optical storage medium device, a flash memory device, an electrical, optical or other physical / tangible memory storage device. Therefore, generally, the memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., a memory device) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the encryption and decryption method for data of the first aspect, the encryption and decryption method for data of the second aspect, or the encryption and decryption method for data of the third aspect in the embodiment of the present application. In the case where the electronic device 800 implements the encryption machine in the above embodiment, when the software in the memory 801 is executed, it is operable to execute the encryption and decryption method for data of the first aspect in the embodiment of the present application. In the case where the electronic device 800 implements the encryption and decryption execution platform in the above embodiment, when the software in the memory 801 is executed, it is operable to execute the encryption and decryption method for data of the second aspect in the embodiment of the present application. In the case where the electronic device 800 implements the key management platform in the above embodiment, when the software in the memory 801 is executed, it can be operated to execute the data encryption and decryption method according to the third aspect of the embodiment of the present application.

[0232] The processor 802 reads the executable program code stored in the memory 801 to run the computer program corresponding to the executable program code, so as to implement the data encryption and decryption method of the first aspect, the data encryption and decryption method of the second aspect, or the data encryption and decryption method of the third aspect in the above-mentioned embodiments. In the case where the electronic device 800 implements the encryption machine in the above-mentioned embodiments, the processor 802 reads the executable program code stored in the memory 801 to run the computer program corresponding to the executable program code, so as to implement the data encryption and decryption method of the first aspect in the above-mentioned embodiments. In the case where the electronic device 800 implements the encryption and decryption execution platform in the above-mentioned embodiments, the processor 802 reads the executable program code stored in the memory 801 to run the computer program corresponding to the executable program code, so as to implement the data encryption and decryption method of the second aspect in the above-mentioned embodiments. In the case where the electronic device 800 implements the key management platform in the above-mentioned embodiments, the processor 802 reads the executable program code stored in the memory 801 to run the computer program corresponding to the executable program code, so as to implement the data encryption and decryption method of the third aspect in the above-mentioned embodiments.

[0233] In some examples, the electronic device 800 may further include a communication interface 803 and a bus 804. As shown in FIG13 , the memory 801, the processor 802, and the communication interface 803 are connected via the bus 804 and communicate with each other.

[0234] The communication interface 803 is mainly used to implement communication between the modules, devices, units and / or equipment in the embodiment of the present application. Input devices and / or output devices can also be connected through the communication interface 803.

[0235] The bus 804 includes hardware, software, or both that couples the components of the electronic device 800 to each other. By way of example, and not limitation, the bus 804 may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a HyperTransport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an InfiniBand interconnect, a Low Pin Count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-E) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VLB) bus, or other suitable buses, or a combination of two or more of the above. Where appropriate, the bus 804 may include one or more buses. Although embodiments herein describe and illustrate a particular bus, this application contemplates any suitable bus or interconnect.

[0236] In an eighth aspect, the present application provides a data encryption and decryption system, which may include an encryption machine, an encryption and decryption execution platform, and a key management platform.

[0237] The encryption machine is used to execute the data encryption and decryption method of the first aspect of the above embodiment.

[0238] The encryption and decryption execution platform is in communication with the encryption machine and is used to execute the data encryption and decryption method of the second aspect of the above embodiment.

[0239] The key management platform is in communication with the encryption machine and the encryption and decryption execution platform, and is used to execute the data encryption and decryption method of the third aspect of the above embodiment.

[0240] The specific contents of the encryption machine, encryption and decryption execution platform, key management platform and data encryption and decryption method in the data encryption and decryption system can be referred to the relevant descriptions in the above embodiments, and the same technical effects can be achieved. To avoid repetition, they will not be repeated here.

[0241] In the ninth aspect of the present application, a computer-readable storage medium is provided, on which a computer program instruction is stored. When the computer program instruction is executed by the processor, the data encryption and decryption method of the first aspect, the data encryption and decryption method of the second aspect, or the data encryption and decryption method of the third aspect in the above-mentioned embodiment can be implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here. Among them, the above-mentioned computer-readable storage medium may include a non-transitory computer-readable storage medium, such as a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, etc., which is not limited here.

[0242] An embodiment of the present application provides a computer program product. When the instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes the data encryption and decryption method of the first aspect, the data encryption and decryption method of the second aspect, or the data encryption and decryption method of the third aspect in the above-mentioned embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0243] It should be understood that the various embodiments in this specification are described in a progressive manner. The same or similar portions between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from the other embodiments. For the encryption machine embodiments, device embodiments, electronic device embodiments, system embodiments, computer-readable storage medium embodiments, and computer program product embodiments, relevant portions can be referenced to the description of the method embodiments. This application is not limited to the specific steps and structures described above and illustrated in the figures. Those skilled in the art may make various changes, modifications, and additions, or change the order of the steps, after understanding the spirit of this application. Furthermore, for the sake of brevity, detailed descriptions of known methods and techniques are omitted here.

[0244] Aspects of the present application have been described above with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present application. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer or other programmable data processing device to produce a machine so that these instructions executed via the processor of the computer or other programmable data processing device enable the implementation of the function / action specified in one or more boxes of the flowchart and / or block diagram. This processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor or a field programmable logic circuit. It is also understood that each box in the block diagram and / or the flowchart and the combination of the boxes in the block diagram and / or the flowchart can also be implemented by the dedicated hardware that performs the specified function or action, or can be implemented by the combination of dedicated hardware and computer instructions.

[0245] Those skilled in the art should understand that the above embodiments are illustrative rather than restrictive. Different technical features appearing in different embodiments can be combined to achieve beneficial effects. Based on a study of the drawings, the specification and the claims, those skilled in the art should be able to understand and implement other variations of the disclosed embodiments. In the claims, the term "comprising" does not exclude other devices or steps; the quantifier "one" does not exclude a plurality; the terms "first" and "second" are used to identify names rather than to indicate any specific order. Any figure marks in the claims should not be understood as limiting the scope of protection. The functions of multiple parts appearing in the claims can be implemented by a separate hardware or software module. The fact that certain technical features appear in different dependent claims does not mean that these technical features cannot be combined to achieve beneficial effects.

Claims

1. A method for encrypting and decrypting data, characterized in that: Applied to an encryption machine, the encryption machine having a first target master key, the method comprising: The encryption and decryption execution platform is called based on the key mapping relationship, and receives the encryption and decryption request sent by the encryption and decryption execution platform. The key mapping relationship is maintained by the key management platform, and includes the mapping relationship between the master key unique identifier, the encryption machine cluster identifier and the master key physical index. The encryption and decryption request includes the target master key physical index, the data to be processed and the target working key indication data. The target master key physical index is the master key physical index of the first target master key. The data to be processed includes data to be encrypted or data to be decrypted. The target working key indication data is used to indicate the target working key ciphertext. Decrypting the target working key ciphertext using the first target master key to obtain the target working key; Using the target working key to encrypt or decrypt the data to be processed to obtain result data; The result data is fed back to the encryption and decryption execution platform.

2. The method according to claim 1, characterized in that The target working key indication data includes a target working key ciphertext index or the target working key ciphertext, The target working key ciphertext index points to the target working key ciphertext, and the target working key ciphertext is obtained by encrypting the target working key according to the first target master key.

3. The method according to claim 1, characterized in that The encryption and decryption execution platform is called based on the key mapping relationship, including: The encryption and decryption execution platform is called based on the acquired target master key unique identifier, target encryption machine cluster identifier and the key mapping relationship. Among them, in the key mapping relationship, the target master key physical index corresponds to the target master key unique identifier and the target encryption machine cluster identifier.

4. The method according to claim 3, characterized in that The key mapping relationship is pre-synchronized by the key management platform to the encryption and decryption execution platform; or, The physical index of the target master key is obtained by the encryption and decryption execution platform querying the key management platform for the key mapping relationship.

5. The method according to claim 1, characterized in that In the case where the data to be processed includes data to be encrypted, the result data includes the encrypted ciphertext of the data to be encrypted and the target working key indication data; In the case where the data to be processed includes data to be decrypted, the result data includes the decrypted plaintext of the data to be decrypted.

6. The method according to claim 1, characterized in that In the case where the data to be processed includes data to be encrypted, the result data includes structured information; In the case where the data to be processed includes data to be decrypted, the data to be processed includes the structured information; The structured information includes a first field, the first field includes the target working key indication data, encryption auxiliary data and encrypted ciphertext, and the encrypted ciphertext includes the encrypted ciphertext of the data to be encrypted or the data to be decrypted.

7. The method according to claim 6, characterized in that The encrypted auxiliary data includes one or more of the following: Encryption algorithm data, random vector data, encryption mode data, encryption and decryption encoding data.

8. The method according to claim 6, characterized in that The first field also includes check data and / or data reserved bits; The verification data includes a verification value and verification algorithm data.

9. The method according to claim 6, characterized in that The structured information also includes a second field, The second field includes hash data, and the hash data includes a hash value of a plain text corresponding to the encrypted ciphertext.

10. The method according to claim 6, characterized in that The structured information is implemented as a protocol message, a key-value pair or JSON structured data; The protocol message includes a protocol header and a protocol body, the protocol header includes the target working key indication data and the encryption auxiliary data, and the protocol body includes the encrypted ciphertext.

11. The method according to claim 6, characterized in that The structured information is used for storage and / or transmission in two or more devices, and the two or more devices belong to the same system or different systems.

12. The method according to claim 1, characterized in that Also includes: When the first target master key expires or is about to expire, the key management platform calls the key management platform to decrypt the working key ciphertexts encrypted with the first target master key one by one using the first target master key to obtain the working key; The working keys are encrypted one by one using the second target master key to obtain new working key ciphertext.

13. The method according to claim 12, characterized in that Also includes: Encrypting the randomly generated plaintext data to be verified using the working key obtained based on the working key ciphertext to obtain the ciphertext of the data to be verified; The new working key ciphertext is verified according to the plaintext of the data to be verified, the ciphertext of the data to be verified, the new working key ciphertext and the second target master key.

14. The method according to claim 13, characterized in that The verifying the new working key ciphertext according to the plaintext of the data to be verified, the ciphertext of the data to be verified, the new working key ciphertext and the second target master key includes: Decrypting the new working key ciphertext using the second target master key to obtain the working key; Decrypting the ciphertext of the data to be verified using the working key obtained by decryption to obtain first data, and comparing the first data with the plaintext of the data to be verified; and / or encrypting the plaintext to be verified using the working key obtained by decryption to obtain second data, and comparing the second data with the ciphertext of the data to be verified; When the first data is consistent with the plain text of the data to be verified, and / or the second data is consistent with the ciphertext of the data to be verified, it is determined that the ciphertext verification of the new working key is successful.

15. The method according to claim 14, characterized in that Also includes: When the first data is inconsistent with the plain text of the data to be verified, or when the second data is inconsistent with the ciphertext of the data to be verified, determining that the ciphertext verification of the new working key fails; In the event that the new working key ciphertext verification fails, The plaintext of the data to be verified is verified by using the ciphertext of the data to be verified, the ciphertext of the working key and the first target master key; In the case where the plaintext of the data to be verified fails to be verified, obtaining a randomly generated new plaintext of the data to be verified, and encrypting the new plaintext of the data to be verified using a working key obtained based on the working key ciphertext to obtain a new ciphertext of the data to be verified; The new working key ciphertext is verified according to the new plaintext data to be verified, the new ciphertext data to be verified, the new working key ciphertext and the second target master key.

16. The method according to claim 1, characterized in that Also includes: When the current time point is in the working key replacement period, the data to be decrypted is decrypted using the original working key, and the data to be encrypted is encrypted using the new working key; When the current time point is after the working key replacement period, the data to be decrypted is decrypted using the new working key, and the data to be encrypted is encrypted using the new working key.

17. The method according to claim 1, characterized in that Also includes: When the encryption machine is a root encryption machine, storing a master key; The master key physical index of the master key in the root encryption machine is determined as the master key unique identifier of the master key, and synchronized to the key management platform.

18. A method for encrypting and decrypting data, characterized in that: Applied to an encryption and decryption execution platform, the method includes: Based on the key mapping relationship maintained by the key management platform, calling the encryption machine with the first target master key, the key mapping relationship includes a mapping relationship between the master key unique identifier, the encryption machine cluster identifier and the master key physical index; Sending an encryption and decryption request to the encryption machine, the encryption and decryption request including a target master key physical index, data to be processed, and target working key indication data, the target master key physical index being the master key physical index of the first target master key, the data to be processed including data to be encrypted or data to be decrypted, the target working key indication data being used to indicate a target working key ciphertext, the encryption and decryption request being used to enable the encryption machine to decrypt the target working key ciphertext using the first target master key to obtain a target working key, and to encrypt or decrypt the data to be processed using the target working key to obtain result data; Receive the result data fed back by the encryption machine.

19. The method according to claim 18, characterized in that The target working key indication data includes a target working key ciphertext index or the target working key ciphertext, The target working key ciphertext index points to the target working key ciphertext, and the target working key ciphertext is obtained by encrypting the target working key according to the first target master key.

20. The method according to claim 18, characterized in that The method of calling an encryption machine having a first target master key based on a key mapping relationship maintained by a key management platform includes: Determine the physical index of the target master key based on the acquired target master key unique identifier, the target encryption machine cluster identifier and the key mapping relationship; According to the target master key physical index, the encryption machine having the first target master key is determined and called.

21. The method according to claim 20, characterized in that The determining the target master key physical index based on the acquired target master key unique identifier, the target encryption machine cluster identifier and the key mapping relationship includes: In the key mapping relationship pre-synchronized from the key management platform, query the master key physical index corresponding to the target master key unique identifier and the target encryption machine cluster identifier to determine it as the target master key physical index; or, Based on the target master key unique identifier and the target encryption machine cluster identifier, the key management platform is queried for the master key physical index corresponding to the key mapping relationship and the target master key unique identifier and the target encryption machine cluster identifier, and the target master key physical index is determined.

22. The method according to claim 18, characterized in that In the case where the data to be processed includes data to be encrypted, the result data includes the encrypted ciphertext of the data to be encrypted and the target working key indication data; In the case where the data to be processed includes data to be decrypted, the result data includes the decrypted plaintext of the data to be decrypted.

23. The method according to claim 18, characterized in that In the case where the data to be processed includes data to be encrypted, the result data includes structured information; In the case where the data to be processed includes data to be decrypted, the data to be processed includes the structured information; The structured information includes a first field, the first field includes the target working key indication data, encryption auxiliary data and encrypted ciphertext, and the encrypted ciphertext includes the encrypted ciphertext of the data to be encrypted or the data to be decrypted.

24. The method according to claim 23, characterized in that The encrypted auxiliary data includes one or more of the following: Encryption algorithm data, random vector data, encryption mode data, encryption and decryption encoding data.

25. The method according to claim 23, characterized in that The first field also includes check data and / or data reserved bits; The verification data includes a verification value and verification algorithm data.

26. The method according to claim 23, characterized in that The structured information also includes a second field, The second field includes hash data, and the hash data includes a hash value of a plain text corresponding to the encrypted ciphertext.

27. The method according to claim 23, characterized in that The structured information is implemented as a protocol message, a key-value pair or JSON structured data; The protocol message includes a protocol header and a protocol body, the protocol header includes the target working key indication data and the encryption auxiliary data, and the protocol body includes the encrypted ciphertext.

28. The method according to claim 23, characterized in that The structured information is used for storage or transmission in two or more devices, and the two or more devices belong to the same system or different systems.

29. The method according to claim 18, characterized in that Also includes: When the current time point is in the working key replacement period, calling the encryption machine to decrypt the to-be-decrypted data using the original working key and encrypt the to-be-encrypted data using the new working key; When the current time point is after the working key replacement period, the encryption machine is called to decrypt the data to be decrypted using the new working key, and to encrypt the data to be encrypted using the new working key.

30. A method for encrypting and decrypting data, characterized in that: Applied to a key management platform, the method comprises: interacting with the encryption and decryption execution platform so that the encryption and decryption execution platform calls an encryption machine with a first target master key based on the key mapping relationship maintained by the key management platform, and the encryption machine uses the first target master key to decrypt the target working key ciphertext indicated by the target working key indication data in the encryption and decryption request to obtain the target working key, and then uses the target working key to encrypt or decrypt the data to be processed in the encryption and decryption request, and obtains the result data and feeds it back to the encryption and decryption execution platform, Among them, the key mapping relationship includes the mapping relationship between the master key unique identifier, the encryption machine cluster identifier and the master key physical index, the encryption and decryption request is sent by the encryption and decryption execution platform to the encryption machine, the data to be processed includes data to be encrypted or data to be decrypted, and the encryption and decryption request also includes a target master key physical index, and the target master key physical index is the master key physical index of the first target master key.

31. The method according to claim 30, characterized in that The target working key indication data includes a target working key ciphertext index or the target working key ciphertext, The target working key ciphertext index points to the target working key ciphertext, and the target working key ciphertext is obtained by encrypting the target working key according to the first target master key.

32. The method according to claim 30, characterized in that Also includes: In response to a first input from a user, a master key unique identifier of a master key is entered, where the entered master key unique identifier is generated by the encryption machine; Obtain the master key physical index of the master key indicated by the entered master key unique identifier and the encryption machine cluster identifier of the encryption machine cluster where the master key is located; The key mapping relationship is established based on the master key unique identifier, the master key physical index of the master key indicated by the master key unique identifier, and the encryption machine cluster identifier of the encryption machine cluster where the master key is located.

33. The method according to claim 30, characterized in that In the key mapping relationship, the target master key physical index corresponds to the target master key unique identifier and the target encryption machine cluster identifier.

34. The method according to claim 33, characterized in that The interacting with the encryption and decryption execution platform includes: Synchronizing the key mapping relationship to the encryption and decryption execution platform; or, According to the target master key unique identifier and the target encryption machine cluster identifier sent by the encryption and decryption execution platform, the physical index of the target master key is queried in the key mapping relationship and fed back to the encryption and decryption execution platform.

35. The method according to claim 30, characterized in that In the case where the data to be processed includes data to be encrypted, the result data includes the encrypted ciphertext of the data to be encrypted and the target working key indication data; In the case where the data to be processed includes data to be decrypted, the result data includes the decrypted plaintext of the data to be decrypted.

36. The method according to claim 30, characterized in that In the case where the data to be processed includes data to be encrypted, the result data includes structured information; In the case where the data to be processed includes data to be decrypted, the data to be processed includes the structured information; The structured information includes a first field, the first field includes the target working key indication data, encryption auxiliary data and encrypted ciphertext, and the encrypted ciphertext includes the encrypted ciphertext of the data to be encrypted or the data to be decrypted.

37. The method according to claim 36, characterized in that The encrypted auxiliary data includes one or more of the following: Encryption algorithm data, random vector data, encryption mode data, encryption and decryption encoding data.

38. The method according to claim 36, characterized in that The structured information also includes check data and / or data reserved bits; The verification data includes a verification value and verification algorithm data.

39. The method according to claim 36, characterized in that The structured information also includes a second field, The second field includes hash data, and the hash data includes a hash value of a plain text corresponding to the encrypted ciphertext.

40. The method according to claim 36, characterized in that The structured information is implemented as a protocol message, a key-value pair or JSON structured data; The protocol message includes a protocol header and a protocol body, the protocol header includes the target working key indication data and the encryption auxiliary data, and the protocol body includes the encrypted ciphertext.

41. The method according to claim 36, characterized in that The structured information is used for storage or transmission in two or more devices, and the two or more devices belong to the same system or different systems.

42. The method according to claim 30, characterized in that Also includes: In the case where the first target master key expires or is about to expire, entering a second target master key, the second target master key being generated by the encryption machine; The encryption machine is called to use the first target master key to decrypt the working key ciphertexts encrypted by the first target master key one by one to obtain the working key, and the working key is encrypted one by one using the second target master key to obtain a new working key ciphertext.

43. The method according to claim 42, characterized in that Also includes: The encryption machine is called to encrypt the randomly generated plaintext of the data to be verified using the working key obtained based on the working key ciphertext to obtain the ciphertext of the data to be verified; and the new working key ciphertext is verified based on the plaintext of the data to be verified, the ciphertext of the data to be verified, the new working key ciphertext and the second target master key.

44. The method according to claim 30, characterized in that The encryption machine includes a root encryption machine, wherein the root encryption machine stores a master key. The method further comprises: Receive a master key physical index of the master key sent by the root encryption machine, and determine the master key physical index of the master key as a master key unique identifier of the master key.

45. An encryption machine, characterized in that: The encryption machine has a first target master key, and the encryption machine includes: A receiving module is used to be called by the encryption and decryption execution platform based on the key mapping relationship, and receive the encryption and decryption request sent by the encryption and decryption execution platform, wherein the key mapping relationship is maintained by the key management platform, including the mapping relationship between the master key unique identifier, the encryption machine cluster identifier and the master key physical index, and the encryption and decryption request includes the target master key physical index, the data to be processed and the target working key indication data, wherein the target master key physical index is the master key physical index of the first target master key, the data to be processed includes the data to be encrypted or the data to be decrypted, and the target working key indication data The data is used to indicate the target working key ciphertext; an encryption and decryption module, used to decrypt the target working key ciphertext using the first target master key to obtain the target working key; and used to encrypt or decrypt the data to be processed using the target working key to obtain result data; The sending module is used to feed back the result data to the encryption and decryption execution platform.

46. ​​A data encryption and decryption device, characterized in that: Applied to an encryption and decryption execution platform, the device comprises: A sending module, used to call an encryption machine with a first target master key based on a key mapping relationship maintained by a key management platform, and send an encryption and decryption request to the encryption machine, wherein the key mapping relationship includes a mapping relationship between a master key unique identifier, an encryption machine cluster identifier, and a master key physical index, and the encryption and decryption request includes a target master key physical index, data to be processed, and target working key indication data, wherein the target master key physical index is the master key physical index of the first target master key, the data to be processed includes data to be encrypted or data to be decrypted, and the target working key indication data is used to indicate a target working key ciphertext, and the encryption and decryption request is used to enable the encryption machine to decrypt the target working key ciphertext using the first target master key to obtain a target working key, and to encrypt or decrypt the data to be processed using the target working key to obtain result data; A receiving module is used to receive the result data fed back by the encryption machine.

47. A data encryption and decryption device, characterized in that: Applied to a key management platform, the device comprises: A communication module is used to interact with the encryption and decryption execution platform so that the encryption and decryption execution platform calls an encryption machine with a first target master key based on the key mapping relationship maintained by the key management platform, and the encryption machine uses the first target master key to decrypt the target working key ciphertext indicated by the target working key indication data in the encryption and decryption request to obtain the target working key, and then uses the target working key to encrypt or decrypt the data to be processed in the encryption and decryption request, and obtains the result data and feeds it back to the encryption and decryption execution platform. The key mapping relationship includes a mapping relationship between a master key unique identifier, an encryption machine cluster identifier, and a master key physical index. The encryption and decryption request is sent by the encryption and decryption execution platform to the encryption machine. The data to be processed includes data to be encrypted or data to be decrypted. The encryption and decryption request also includes a target master key physical index, which is the physical index of the first target master key. The master key physical index of the master key.

48. An electronic device, characterized in that: include: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, the method for encrypting and decrypting data as described in any one of claims 1 to 44 is implemented.

49. A data encryption and decryption system, characterized in that: include: An encryption machine, used to execute the data encryption and decryption method as claimed in any one of claims 1 to 17; An encryption and decryption execution platform, connected to the encryption machine for executing the data encryption and decryption method according to any one of claims 18 to 29; A key management platform is communicatively connected to the encryption machine and the encryption and decryption execution platform, and is used to execute the data encryption and decryption method as described in any one of claims 30 to 44.

50. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer program instructions, and when the computer program instructions are executed by a processor, the method for encrypting and decrypting data as described in any one of claims 1 to 44 is implemented.

Images