CN117955637A - Data encryption method and device, and data decryption method and device - Google Patents

Data encryption method and device, and data decryption method and device Download PDF

Info

Publication number
CN117955637A
CN117955637A CN202410347059.1A CN202410347059A CN117955637A CN 117955637 A CN117955637 A CN 117955637A CN 202410347059 A CN202410347059 A CN 202410347059A CN 117955637 A CN117955637 A CN 117955637A
Authority
CN
China
Prior art keywords
data
encryption
encrypted
sub
key
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN202410347059.1A
Other languages
Chinese (zh)
Other versions
CN117955637B (en
Inventor
白金义
肖桐
董勤
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
China Tower Co Ltd
Original Assignee
China Tower Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by China Tower Co Ltd filed Critical China Tower Co Ltd
Priority to CN202410347059.1A priority Critical patent/CN117955637B/en
Publication of CN117955637A publication Critical patent/CN117955637A/en
Application granted granted Critical
Publication of CN117955637B publication Critical patent/CN117955637B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Landscapes

  • Storage Device Security (AREA)

Abstract

The embodiment of the disclosure provides a data encryption method and device, and a data decryption method and device, wherein the method comprises the following steps: acquiring data to be encrypted; symmetrically encrypting the data to be encrypted according to the encryption key to obtain first sub-encrypted data, and carrying out hash encryption on the data to be encrypted according to a preset hash encryption algorithm to obtain second sub-encrypted data; the encryption key is obtained by using an asymmetric public key which is randomly generated in advance and performing asymmetric encryption on the symmetric public key which is randomly generated in advance; and combining the first sub-encrypted data and the second sub-encrypted data to obtain encrypted data corresponding to the data to be encrypted.

Description

Data encryption method and device, and data decryption method and device
Technical Field
The disclosure relates to the technical field of data processing, and in particular relates to a data encryption method and device, and a data decryption method and device.
Background
With the development of information technology, network communication has become an integral part of people's daily life and business activities. With the digital transmission of information, ensuring the security of data is an important challenge. Currently, network communications typically transmit data in the form of network plaintext, which means that data is transmitted in its original form over the network, and may be subject to various threats, such as eavesdropping, tampering, and forgery, with poor data security.
Disclosure of Invention
The embodiment of the disclosure provides a data encryption method and device and a data decryption method and device, so as to solve the problem of poor data security caused by data transmission in a network plaintext form in the related art.
In a first aspect, an embodiment of the present disclosure provides a data encryption method applied to an encryption device, the method including:
Acquiring data to be encrypted;
Symmetrically encrypting the data to be encrypted according to an encryption key to obtain first sub-encrypted data, and carrying out hash encryption on the data to be encrypted according to a preset hash encryption algorithm to obtain second sub-encrypted data; the encryption key is obtained by using an asymmetric public key which is randomly generated in advance to carry out asymmetric encryption on the symmetric public key which is randomly generated in advance;
And combining the first sub-encrypted data and the second sub-encrypted data to obtain encrypted data corresponding to the data to be encrypted.
In a second aspect, an embodiment of the present disclosure provides a data decryption method, applied to a decryption device, where the decryption device includes an asymmetric private key that is randomly generated in advance, and the asymmetric private key and an asymmetric public key that is randomly generated in advance on an encryption device are a pair of asymmetric key pairs, where the method includes:
Acquiring the encrypted data and the encryption key sent by the encryption equipment; the encryption key is obtained by the encryption equipment performing asymmetric encryption on a symmetric public key which is randomly generated in advance according to the asymmetric public key; the encrypted data is obtained according to the encryption key and a preset hash encryption algorithm;
Decrypting the encryption key by using the asymmetric private key to obtain a decrypted symmetric public key;
Decrypting the encrypted data according to the symmetric public key to obtain first sub-decrypted data which is successfully decrypted and second sub-decrypted data which is failed to be decrypted;
Carrying out hash encryption on the first sub-decrypted data according to the preset hash encryption algorithm to obtain data to be verified;
And when the data to be verified is the same as the data before the second sub decryption data is decrypted, determining the first sub decryption data as decryption data corresponding to the encryption data.
In a third aspect, an embodiment of the present disclosure provides a data encryption apparatus applied to an encryption device, the apparatus including:
The acquisition module is used for acquiring data to be encrypted;
the encryption module is used for symmetrically encrypting the data to be encrypted according to an encryption key to obtain first sub-encrypted data, and carrying out hash encryption on the data to be encrypted according to a preset hash encryption algorithm to obtain second sub-encrypted data; the encryption key is obtained by using an asymmetric public key which is randomly generated in advance to carry out asymmetric encryption on the symmetric public key which is randomly generated in advance;
and the combination module is used for combining the first sub-encrypted data and the second sub-encrypted data to obtain encrypted data corresponding to the data to be encrypted.
In a fourth aspect, an embodiment of the present disclosure provides a data decryption apparatus, applied to a decryption device, where the decryption device includes an asymmetric private key that is randomly generated in advance, and the asymmetric private key and an asymmetric public key that is randomly generated in advance on an encryption device are a pair of asymmetric key pairs, where the apparatus includes:
The acquisition module is used for acquiring the encrypted data and the encryption key sent by the encryption equipment; the encryption key is obtained by the encryption equipment performing asymmetric encryption on a symmetric public key which is randomly generated in advance according to the asymmetric public key; the encrypted data is obtained according to the encryption key and a preset hash encryption algorithm;
the first decryption module is used for decrypting the encryption key by using the asymmetric private key to obtain a decrypted symmetric public key;
The second decryption module is used for decrypting the encrypted data according to the symmetric public key to obtain first sub-decrypted data which is successfully decrypted and second sub-decrypted data which is failed to be decrypted;
The encryption module is used for carrying out hash encryption on the first sub-decrypted data according to the preset hash encryption algorithm to obtain data to be verified;
And the determining module is used for determining the first sub decryption data as decryption data corresponding to the encryption data when the data to be verified is the same as the data before the second sub decryption data is decrypted.
In a fifth aspect, embodiments of the present disclosure provide an electronic device, including: a processor; and a memory configured to store computer-executable instructions that, when executed, cause the processor to implement the steps of the method of the first or second aspect described above.
In a sixth aspect, embodiments of the present disclosure provide a computer-readable storage medium storing computer-executable instructions which, when executed by a processor, implement the steps of the method of the first or second aspects above.
The above at least one technical scheme provided by the embodiment of the invention can achieve the following technical effects:
In the embodiment of the invention, when data is encrypted, data to be encrypted can be acquired first, the data to be encrypted can be symmetrically encrypted according to an encryption key to obtain first sub-encrypted data, and the data to be encrypted can be hashed and encrypted according to a preset hash encryption algorithm to obtain second sub-encrypted data, wherein the encryption key is obtained by using an asymmetric public key which is randomly generated in advance to asymmetrically encrypt the symmetric public key which is randomly generated in advance, and then the first sub-encrypted data and the second sub-encrypted data are combined to obtain encrypted data corresponding to the data to be encrypted.
According to the embodiment of the invention, after the data is acquired, the data can be symmetrically encrypted and hashed and encrypted, and in order to further increase the safety of the data, the key which is subjected to asymmetric encryption is also used when the data is symmetrically encrypted, so that the embodiment of the invention can realize the encryption of the data from two aspects of encrypting the key and carrying out multiple encryption on the data, thereby effectively improving the safety of the data and solving the problem of poor data safety caused by the transmission of the data in a network plaintext form in the related technology.
Drawings
For a clearer description of one or more embodiments of the present disclosure or of the solutions of the prior art, the drawings that are needed in the description of the embodiments or of the prior art will be briefly described, it being obvious that the drawings in the description that follows are only some of the embodiments described in the present disclosure, and that other drawings may be obtained from these drawings by those skilled in the art without inventive effort;
FIG. 1 is a schematic flow chart of a data encryption method according to an embodiment of the present invention;
FIG. 2 is a second flow chart of a data encryption method according to an embodiment of the invention;
FIG. 3 is a flowchart of a data decryption method according to an embodiment of the present invention;
FIG. 4 is a second flowchart of a data decryption method according to an embodiment of the present invention;
Fig. 5 is a schematic block diagram of a data encryption device 500 according to an embodiment of the present invention;
Fig. 6 is a schematic block diagram of a data decryption device 600 according to an embodiment of the present invention;
fig. 7 is a schematic hardware structure of a data encryption device according to an embodiment of the present invention;
fig. 8 is a schematic hardware structure of a data decryption device according to an embodiment of the present invention.
Detailed Description
In order to better understand the technical aspects of one or more embodiments of the present disclosure, the technical aspects of the present disclosure will be clearly and completely described below with reference to specific embodiments of the present disclosure and corresponding drawings. It will be apparent that the described embodiments are only some, but not all, embodiments of the invention. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.
The following describes in detail the technical solutions provided by the embodiments of the present invention with reference to the accompanying drawings.
Referring to fig. 1, fig. 1 is a flow chart of a data encryption method according to an embodiment of the invention, as shown in fig. 1, the method includes the following steps:
Step 102: and obtaining the data to be encrypted.
Step 104: symmetrically encrypting the data to be encrypted according to the encryption key to obtain first sub-encrypted data, and carrying out hash encryption on the data to be encrypted according to a preset hash encryption algorithm to obtain second sub-encrypted data; the encryption key is obtained by using an asymmetric public key which is randomly generated in advance and performing asymmetric encryption on the symmetric public key which is randomly generated in advance.
Step 106: and combining the first sub-encrypted data and the second sub-encrypted data to obtain encrypted data corresponding to the data to be encrypted.
In the embodiment of the present invention, at the start of communication, that is, when a request message is generated and the generated request message is transmitted, the encryption device may acquire the request message and determine the request message as data to be encrypted.
When acquiring the request message, the encryption device may acquire by means of interception, for example, may intercept the request message sent to the decryption device by an interceptor, and determine the successfully intercepted request message as data to be encrypted.
After the data to be encrypted is obtained, the encryption device can symmetrically encrypt the data to be encrypted according to the encryption key to obtain first sub-encrypted data.
In one embodiment of the present invention, the encryption key may be obtained by performing asymmetric encryption on a symmetric public key generated randomly in advance, such as AES (Rivest-Shamir-Adleman) public key, by using an asymmetric public key generated randomly in advance, such as AES (Advanced Encryption Standard ) public key, by the encryption device, where in the embodiment of the present invention, the asymmetric public key on the encryption device and the asymmetric private key on the decryption device, such as RSA private key, are a pair of asymmetric keys, which are generated randomly at the same time.
Therefore, in the embodiment of the invention, the encryption device performs asymmetric encryption on the randomly generated symmetric public key according to the randomly generated asymmetric private key to obtain the encrypted symmetric public key, determines the encrypted symmetric public key as the encryption key, and then performs symmetric encryption on the acquired data to be encrypted by using the encryption key to obtain the first sub-encrypted data.
After the encrypted data is obtained, the encryption device may further perform hash encryption on the data to be encrypted according to a preset hash encryption algorithm, so as to obtain second sub-encrypted data.
In one example, the predetermined hash encryption algorithm may be hash function SHA-256.SHA-256 is a one-way hash function, and it is difficult to back-extrapolate the original input data from the hash value, so encrypting the data using SHA-256 can improve the security of the data.
It should be noted that, in the embodiment of the present invention, the encryption device and the decryption device may preset the same hash encryption algorithm, for example, all preset hash functions SHA-256, and when one party changes the hash encryption algorithm, the other party needs to change synchronously so as to keep the hash encryption algorithm consistent.
After the first sub-encrypted data and the second sub-encrypted data are obtained, the first sub-encrypted data and the second sub-encrypted data can be combined to obtain encrypted data corresponding to the data to be encrypted.
When the first sub-encrypted data and the second sub-encrypted data are combined, the first sub-encrypted data and the second sub-encrypted data can be directly spliced.
In one embodiment of the present invention, after obtaining the encrypted data corresponding to the data to be encrypted, the encrypted data corresponding to the data to be encrypted may be sent to the decryption device, where, when sending, the encrypted data corresponding to the data to be encrypted may also be sent to the decryption device together with the encryption key.
Referring to fig. 2, fig. 2 is a second flow chart of a data encryption method according to an embodiment of the present invention, as shown in fig. 2, after a request message is obtained, symmetric encryption and hash function encryption corresponding to SHA-256 may be performed respectively, wherein when a key for symmetric encryption of the request message is obtained, an AES key is dynamically generated first, and then the dynamically generated AES key is encrypted by using the generated RSA public key to obtain an encryption key, so that the request message is symmetrically encrypted according to the encryption key.
After the request message is symmetrically encrypted by using the encryption key and the request message is hashed and encrypted by using the SHA-256, the encrypted message obtained after encryption can be assembled and the combined encrypted message can be sent.
In the embodiment of the invention, when data is encrypted, data to be encrypted can be acquired first, the data to be encrypted can be symmetrically encrypted according to an encryption key to obtain first sub-encrypted data, and the data to be encrypted can be hashed and encrypted according to a preset hash encryption algorithm to obtain second sub-encrypted data, wherein the encryption key is obtained by using an asymmetric public key which is randomly generated in advance to asymmetrically encrypt the symmetric public key which is randomly generated in advance, and then the first sub-encrypted data and the second sub-encrypted data are combined to obtain encrypted data corresponding to the data to be encrypted.
According to the embodiment of the invention, after the data is acquired, the data can be symmetrically encrypted and hashed and encrypted, and in order to further increase the safety of the data, the key which is subjected to asymmetric encryption is also used when the data is symmetrically encrypted, so that the embodiment of the invention can realize the encryption of the data from two aspects of encrypting the key and carrying out multiple encryption on the data, thereby effectively improving the safety of the data and solving the problem of poor data safety caused by the transmission of the data in a network plaintext form in the related technology.
Referring to fig. 3, fig. 3 is one of flow charts of a data decryption method according to an embodiment of the present invention, where the embodiment of the present invention is applied to a decryption device, as shown in fig. 3, and the method includes the following steps:
Step 302: acquiring encryption data sent by encryption equipment and an encryption key; the encryption key is obtained by carrying out asymmetric encryption on a symmetric public key which is randomly generated in advance according to the asymmetric public key by the encryption equipment; the encrypted data is derived from the encryption key.
Step 304: and decrypting the encryption key by using the asymmetric private key to obtain a decrypted symmetric public key.
Step 306: and decrypting the encrypted data according to the symmetric public key to obtain first sub-decrypted data which is successfully decrypted and second sub-decrypted data which is failed to be decrypted.
Step 308: and carrying out hash encryption on the first sub-decrypted data according to a preset hash encryption algorithm to obtain data to be verified.
Step 310: and when the data to be verified is the same as the data before the second sub decryption data is decrypted, determining the first sub decryption data as decryption data corresponding to the encryption data.
In the embodiment of the present invention, the decryption device may include an asymmetric private key that is randomly generated in advance, for example, an RSA (Rivest-Shamir-Adleman, RSA encryption algorithm) private key, where the asymmetric private key and an asymmetric public key that is randomly generated in advance on the encryption device are a pair of asymmetric key pairs, that is, a pair of asymmetric public key and an asymmetric private key may be generated simultaneously, then the asymmetric public key is stored in the encryption device, and the asymmetric private key is stored in the decryption device.
In the embodiment of the invention, the decryption device may acquire the encrypted data and the encryption key sent by the encryption device, where the encrypted data is obtained according to the encryption key, and the encryption key is obtained by the encryption device performing asymmetric encryption on a symmetric public key, such as an AES (Advanced Encryption Standard ) public key, which is randomly generated in advance, according to the asymmetric public key.
After obtaining the encryption key, the decryption device may decrypt the encryption key using the asymmetric private key and obtain a decrypted symmetric public key.
In one embodiment of the present invention, after obtaining the decrypted symmetric public key, it may be detected whether the symmetric public key is stored in the specified cache, and a detection result may be obtained; the designated cache stores a key obtained by the decryption device in a time period preset from the current time period. In one example, the specified cache may be a specified Redis database.
When the detection result indicates that the symmetric public key is not detected in the specified cache, it may be indicated that the decryption device does not obtain the symmetric public key within a period of time from the current preset time, at this time, it may be determined that there is no replay attack currently, and at this time, further decryption processing may be performed on the current encrypted data.
When the detection result represents that the symmetric public key is detected, it can be shown that the decryption device obtains the symmetric public key within a preset time period from the current time, at this time, it can be determined that replay attack may exist at present, attack detection processing corresponding to the replay attack needs to be performed on the current encrypted data, further decryption processing is performed after the attack detection processing, or the current encrypted data is directly discarded, and no further decryption processing is performed.
When further decryption processing is performed on the current encrypted data, the encrypted data can be decrypted according to the symmetric public key, and first sub-decrypted data which is successfully decrypted and second sub-decrypted data which is failed to be decrypted are obtained. In one example, the successfully decrypted first sub-decrypted data may be plaintext data.
After the second sub-decrypted data with the decryption failure is obtained, the first sub-decrypted data with the decryption success can be subjected to hash encryption according to a preset hash encryption algorithm, such as a hash function SHA-256, so as to obtain the data to be verified.
It should be noted that, in the embodiment of the present invention, the decryption device and the encryption device may preset the same hash encryption algorithm, for example, all preset hash functions SHA-256, and when one party changes the hash encryption algorithm, the other party needs to change synchronously so as to keep the hash encryption algorithm consistent.
After obtaining the data to be verified, the data to be verified and the data before decrypting the second sub-decrypted data can be subjected to data comparison to judge whether the data to be verified and the second sub-decrypted data are identical, and when the data comparison result represents that the data comparison result and the data representation are identical, verification is passed, namely the encrypted data are not tampered in the process of being transmitted from the encryption equipment to the decryption equipment, and at the moment, the first sub-decrypted data can be determined to be the decrypted data corresponding to the encrypted data.
In one example, the encrypted data may be denoted as AB, when the encrypted data is decrypted using the symmetric public key, the first sub-decrypted data a corresponding to the encrypted data a and the second sub-decrypted data xx corresponding to the encrypted data B that are successfully decrypted may be obtained, then the first sub-decrypted data a that are successfully decrypted may be hashed and encrypted using the hash function SHA-256 to obtain the data a 'to be verified, then the data a' to be verified and the data before the second sub-decrypted data xx are compared, that is, the encrypted data B, may be obtained to determine whether the two are identical, and if so, the verification is passed.
Referring to fig. 4, fig. 4 is a second flowchart of a data decryption method according to an embodiment of the present invention, as shown in fig. 4, when encrypted data is obtained, an encryption key corresponding to the encrypted data may also be obtained, and then an RSA private key corresponding to an RSA public key on an encryption device may be used to decrypt the obtained encryption key, and a decrypted AES public key may be obtained. After the AES public key is obtained, the AES public key can be compared with the AES public key which is stored in the appointed Redis cache database and is obtained by the decryption device within a period of time from the current preset time, so that replay attack identification is carried out according to the data comparison result, and the interface replay attack is effectively prevented.
When determining that the decryption device does not obtain the AES public key within a period of time from the current preset time according to the data comparison result, the AES public key may be used to decrypt the obtained encrypted data, so as to obtain first sub-decrypted data that is successfully decrypted and second sub-decrypted data that is failed to be decrypted, where the first sub-decrypted data is plaintext data. Then, the first sub-decrypted data, that is, the plaintext data obtained currently, may be hashed and encrypted according to a hash encryption algorithm that is consistent with the encryption device, so as to obtain a data digest, and the obtained data digest is determined to be the data to be verified, after the data to be verified is obtained, whether the data to be verified is the same as the data before the second sub-decrypted data is decrypted may be determined, and if so, the first sub-decrypted data may be determined to be the decrypted data corresponding to the encrypted data.
In the embodiment of the invention, when the encryption device acquires the encrypted data sent by the encryption device, the encryption device can acquire the encryption key sent by the encryption device, wherein the encryption key is obtained by the encryption device after carrying out asymmetric encryption on a symmetric public key which is randomly generated in advance according to the asymmetric public key, the encrypted data is obtained according to the encryption key and a preset hash encryption algorithm, after acquiring the encryption key, the decryption device can decrypt the encryption key by using an asymmetric private key corresponding to the asymmetric public key on the encryption device, obtain the symmetric public key after decryption, decrypt the encrypted data according to the symmetric public key, acquire first sub-decrypted data which is successfully decrypted and second sub-decrypted data which is failed to decrypt, then carry out hash encryption on the first sub-decrypted data according to a preset hash encryption algorithm, obtain the data to be verified, and when the data to be verified is identical to the data before the decryption of the second sub-decrypted data, the first sub-decrypted data can be determined as the decrypted data corresponding to the encrypted data.
According to the embodiment of the invention, the decryption device can decrypt the encryption key corresponding to the encrypted data according to the asymmetric private key corresponding to the asymmetric public key on the encryption device and the same hash encryption algorithm on the encryption device, decrypt the encrypted data according to the decrypted key and verify the decrypted data, so that whether the data is tampered or not is verified on the basis of realizing ciphertext transmission of the data and improving the data security, the accuracy of the data is well ensured, and the problem of poor data security caused by transmitting the data in a network plaintext form in the related technology is effectively solved.
Corresponding to the above data encryption method, the embodiment of the present invention further provides a data encryption device, which is applied to an encryption apparatus, and fig. 5 is a schematic diagram of module composition of a data encryption device 500 provided by the embodiment of the present invention, as shown in fig. 5, where the data encryption device 500 includes:
An obtaining module 501, configured to obtain data to be encrypted;
The encryption module 502 is configured to symmetrically encrypt the data to be encrypted according to an encryption key to obtain first sub-encrypted data, and hash-encrypt the data to be encrypted according to a preset hash encryption algorithm to obtain second sub-encrypted data; the encryption key is obtained by using an asymmetric public key which is randomly generated in advance to carry out asymmetric encryption on the symmetric public key which is randomly generated in advance;
And a combining module 503, configured to combine the first sub-encrypted data and the second sub-encrypted data to obtain encrypted data corresponding to the data to be encrypted.
Optionally, the obtaining module 501 is configured to:
intercepting a request message sent to decryption equipment;
And determining the successfully intercepted request message as the data to be encrypted.
Optionally, the apparatus further comprises (not shown in fig. 5):
And the sending module 504 is configured to send the encrypted data corresponding to the data to be encrypted to a decryption device after the encrypted data corresponding to the data to be encrypted is obtained.
Optionally, the decryption device includes an asymmetric private key which is randomly generated in advance, and the asymmetric private key and the asymmetric public key are a pair of asymmetric key pairs;
the sending module 504 is configured to:
And sending the encrypted data corresponding to the data to be encrypted and the encryption key to decryption equipment.
In the embodiment of the invention, when data is encrypted, data to be encrypted can be acquired first, the data to be encrypted can be symmetrically encrypted according to an encryption key to obtain first sub-encrypted data, and the data to be encrypted can be hashed and encrypted according to a preset hash encryption algorithm to obtain second sub-encrypted data, wherein the encryption key is obtained by using an asymmetric public key which is randomly generated in advance to asymmetrically encrypt the symmetric public key which is randomly generated in advance, and then the first sub-encrypted data and the second sub-encrypted data are combined to obtain encrypted data corresponding to the data to be encrypted.
According to the embodiment of the invention, after the data is acquired, the data can be symmetrically encrypted and hashed and encrypted, and in order to further increase the safety of the data, the key which is subjected to asymmetric encryption is also used when the data is symmetrically encrypted, so that the embodiment of the invention can realize the encryption of the data from two aspects of encrypting the key and carrying out multiple encryption on the data, thereby effectively improving the safety of the data and solving the problem of poor data safety caused by the transmission of the data in a network plaintext form in the related technology.
In response to the above-mentioned data decryption method, the embodiment of the present invention further provides a data decryption device, which is applied to a decryption apparatus, where the decryption apparatus includes an asymmetric private key that is randomly generated in advance, the asymmetric private key and an asymmetric public key that is randomly generated in advance on an encryption apparatus are a pair of asymmetric key pairs, and fig. 6 is a schematic diagram of module components of the data decryption device 600 provided in the embodiment of the present invention, as shown in fig. 6, the data decryption device 600 includes:
an obtaining module 601, configured to obtain encrypted data sent by the encryption device and an encryption key; the encryption key is obtained by the encryption equipment performing asymmetric encryption on a symmetric public key which is randomly generated in advance according to the asymmetric public key; the encrypted data is obtained according to the encryption key and a preset hash encryption algorithm;
a first decryption module 602, configured to decrypt the encryption key using the asymmetric private key to obtain a decrypted symmetric public key;
A second decryption module 603, configured to decrypt the encrypted data according to the symmetric public key, to obtain first sub-decrypted data that is successfully decrypted, and second sub-decrypted data that is failed to be decrypted;
The encryption module 604 is configured to perform hash encryption on the first sub-decrypted data according to a preset hash encryption algorithm, so as to obtain data to be verified;
And a determining module 605, configured to determine, when the data to be verified is the same as the data before the second sub-decrypted data is decrypted, the first sub-decrypted data as decrypted data corresponding to the encrypted data.
Optionally, the second decryption module 603 is configured to:
Detecting whether the symmetric public key is stored in the designated cache or not, and obtaining a detection result; the specified cache stores a secret key obtained by the decryption device in a time period from the current preset time period;
and when the detection result represents that the symmetric public key is not detected in the designated cache, decrypting the encrypted data according to the asymmetric private key to obtain first sub-decrypted data which is successfully decrypted and second sub-decrypted data which is failed to be decrypted.
In the embodiment of the invention, when the encryption device acquires the encrypted data sent by the encryption device, the encryption device can acquire the encryption key sent by the encryption device, wherein the encryption key is obtained by the encryption device after carrying out asymmetric encryption on a symmetric public key which is randomly generated in advance according to the asymmetric public key, the encrypted data is obtained according to the encryption key and a preset hash encryption algorithm, after acquiring the encryption key, the decryption device can decrypt the encryption key by using an asymmetric private key corresponding to the asymmetric public key on the encryption device, obtain the symmetric public key after decryption, decrypt the encrypted data according to the symmetric public key, acquire first sub-decrypted data which is successfully decrypted and second sub-decrypted data which is failed to decrypt, then carry out hash encryption on the first sub-decrypted data according to a preset hash encryption algorithm, obtain the data to be verified, and when the data to be verified is identical to the data before the decryption of the second sub-decrypted data, the first sub-decrypted data can be determined as the decrypted data corresponding to the encrypted data.
According to the embodiment of the invention, the decryption device can decrypt the encryption key corresponding to the encrypted data according to the asymmetric private key corresponding to the asymmetric public key on the encryption device and the same hash encryption algorithm on the encryption device, decrypt the encrypted data according to the decrypted key and verify the decrypted data, so that whether the data is tampered or not is verified on the basis of realizing ciphertext transmission of the data and improving the data security, the accuracy of the data is well ensured, and the problem of poor data security caused by transmitting the data in a network plaintext form in the related technology is effectively solved.
Corresponding to the above data encryption method, the embodiment of the present invention further provides a data encryption device, and fig. 7 is a schematic hardware structure of the data encryption device according to one embodiment of the present invention.
The data encryption device may be a terminal device or a server or the like for encrypting data provided in the above-described embodiment.
The data encryption device may be configured or configured differently to provide a relatively large variance, and may include one or more processors 701 and a memory 702, where the memory 702 may store one or more storage applications or data. Wherein the memory 702 may be transient storage or persistent storage. The application programs stored in the memory 702 may include one or more modules (not shown), each of which may include a series of computer-executable instructions in the data encryption device. Still further, the processor 701 may be arranged to communicate with the memory 702 and execute a series of computer executable instructions in the memory 702 on a data encryption device. The data encryption device may also include one or more power supplies 703, one or more wired or wireless network interfaces 704, one or more input/output interfaces 705, and one or more keyboards 706.
In particular, in this embodiment, the data encryption device includes a memory, and one or more programs, where the one or more programs are stored in the memory, and the one or more programs may include one or more modules, and each module may include a series of computer-executable instructions in the data encryption device, and be configured to be executed by the one or more processors.
In the embodiment of the invention, when data is encrypted, data to be encrypted can be acquired first, the data to be encrypted can be symmetrically encrypted according to an encryption key to obtain first sub-encrypted data, and the data to be encrypted can be hashed and encrypted according to a preset hash encryption algorithm to obtain second sub-encrypted data, wherein the encryption key is obtained by using an asymmetric public key which is randomly generated in advance to asymmetrically encrypt the symmetric public key which is randomly generated in advance, and then the first sub-encrypted data and the second sub-encrypted data are combined to obtain encrypted data corresponding to the data to be encrypted.
According to the embodiment of the invention, after the data is acquired, the data can be symmetrically encrypted and hashed and encrypted, and in order to further increase the safety of the data, the key which is subjected to asymmetric encryption is also used when the data is symmetrically encrypted, so that the embodiment of the invention can realize the encryption of the data from two aspects of encrypting the key and carrying out multiple encryption on the data, thereby effectively improving the safety of the data and solving the problem of poor data safety caused by the transmission of the data in a network plaintext form in the related technology.
Corresponding to the above data encryption method, the embodiment of the present invention further provides a data decryption device, and fig. 8 is a schematic hardware structure of the data decryption device according to one embodiment of the present invention.
The data decryption device may be a terminal device or a server or the like for decrypting data provided in the above-described embodiment.
The data decryption device may vary considerably in configuration or performance and may include one or more processors 801 and memory 802, where the memory 802 may store one or more stored applications or data. Wherein the memory 802 may be transient storage or persistent storage. The application program stored in the memory 802 may include one or more modules (not shown), each of which may include a series of computer-executable instructions in the data decryption device. Still further, the processor 801 may be configured to communicate with the memory 802 and execute a series of computer executable instructions in the memory 802 on a data decryption device. The data decryption device may also include one or more power supplies 803, one or more wired or wireless network interfaces 804, one or more input/output interfaces 805, one or more keyboards 806.
In particular, in this embodiment, the data decryption device includes a memory, and one or more programs, where the one or more programs are stored in the memory, and the one or more programs may include one or more modules, and each module may include a series of computer-executable instructions in the data decryption device, and be configured to be executed by the one or more processors.
In the embodiment of the invention, when the encryption device acquires the encrypted data sent by the encryption device, the encryption device can acquire the encryption key sent by the encryption device, wherein the encryption key is obtained by the encryption device after carrying out asymmetric encryption on a symmetric public key which is randomly generated in advance according to the asymmetric public key, the encrypted data is obtained according to the encryption key and a preset hash encryption algorithm, after acquiring the encryption key, the decryption device can decrypt the encryption key by using an asymmetric private key corresponding to the asymmetric public key on the encryption device, obtain the symmetric public key after decryption, decrypt the encrypted data according to the symmetric public key, acquire first sub-decrypted data which is successfully decrypted and second sub-decrypted data which is failed to decrypt, then carry out hash encryption on the first sub-decrypted data according to a preset hash encryption algorithm, obtain the data to be verified, and when the data to be verified is identical to the data before the decryption of the second sub-decrypted data, the first sub-decrypted data can be determined as the decrypted data corresponding to the encrypted data.
According to the embodiment of the invention, the decryption device can decrypt the encryption key corresponding to the encrypted data according to the asymmetric private key corresponding to the asymmetric public key on the encryption device and the same hash encryption algorithm on the encryption device, decrypt the encrypted data according to the decrypted key and verify the decrypted data, so that whether the data is tampered or not is verified on the basis of realizing ciphertext transmission of the data and improving the data security, the accuracy of the data is well ensured, and the problem of poor data security caused by transmitting the data in a network plaintext form in the related technology is effectively solved.
Another embodiment of the present disclosure also provides a computer-readable storage medium for storing computer-executable instructions that, when executed by a processor, implement the above-described flow.
The storage medium in the embodiments of the present disclosure may implement the respective processes of the above-described embodiment of the method for determining model parameters, and achieve the same effects and functions, which are not repeated here.
In various embodiments of the present disclosure, the computer readable storage medium includes a Read-Only Memory (ROM), a random access Memory (Random Access Memory RAM), a magnetic disk or an optical disk, and the like.
In the 90 s of the 20 th century, improvements to one technology could clearly be distinguished as improvements in hardware (e.g., improvements to circuit structures such as diodes, transistors, switches, etc.) or software (improvements to the process flow). However, with the development of technology, many improvements of the current method flows can be regarded as direct improvements of hardware circuit structures. Designers almost always obtain corresponding hardware circuit structures by programming improved method flows into hardware circuits. Therefore, an improvement of a method flow cannot be said to be realized by a hardware entity module. For example, a programmable logic device (Programmable Logic Device, PLD) (e.g., field programmable gate array (Field Programmable GATE ARRAY, FPGA)) is an integrated circuit whose logic functions are determined by user programming of the device. A designer programs to "integrate" a digital system onto a PLD without requiring the chip manufacturer to design and fabricate application-specific integrated circuit chips. Moreover, nowadays, instead of manually manufacturing integrated circuit chips, such programming is mostly implemented with "logic compiler (logic compiler)" software, which is similar to the software compiler used in program development and writing, and the original code before being compiled is also written in a specific programming language, which is called hardware description language (Hardware Description Language, HDL), but HDL is not just one, but a plurality of kinds, such as ABEL(Advanced Boolean Expression Language)、AHDL(Altera Hardware Description Language)、Confluence、CUPL(Cornell University Programming Language)、HDCal、JHDL(Java Hardware Description Language)、Lava、Lola、MyHDL、PALASM、RHDL(Ruby Hardware Description Language), and VHDL (Very-High-SPEED INTEGRATED Circuit Hardware Description Language) and Verilog are currently most commonly used. It will also be apparent to those skilled in the art that a hardware circuit implementing the logic method flow can be readily obtained by merely slightly programming the method flow into an integrated circuit using several of the hardware description languages described above.
The controller may be implemented in any suitable manner, for example, the controller may take the form of, for example, a microprocessor or processor and a computer readable medium storing computer readable program code (e.g., software or firmware) executable by the (micro) processor, logic gates, switches, application SPECIFIC INTEGRATED Circuits (ASICs), programmable logic controllers, and embedded microcontrollers, examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, atmel AT91SAM, microchip PIC18F26K20, and Silicone Labs C8051F320, the memory controller may also be implemented as part of the control logic of the memory. Those skilled in the art will also appreciate that, in addition to implementing the controller in a pure computer readable program code, it is well possible to implement the same functionality by logically programming the method steps such that the controller is in the form of logic gates, switches, application specific integrated circuits, programmable logic controllers, embedded microcontrollers, etc. Such a controller may thus be regarded as a kind of hardware component, and means for performing various functions included therein may also be regarded as structures within the hardware component. Or even means for achieving the various functions may be regarded as either software modules implementing the methods or structures within hardware components.
The system, apparatus, module or unit set forth in the above embodiments may be implemented in particular by a computer chip or entity, or by a product having a certain function. One typical implementation is a computer. In particular, the computer may be, for example, a personal computer, a laptop computer, a cellular telephone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.
For convenience of description, the above devices are described as being functionally divided into various units, respectively. Of course, the functions of the various elements may be implemented in the same one or more software and/or hardware when implementing the embodiments of the disclosure.
One skilled in the art will appreciate that one or more embodiments of the present disclosure may be provided as a method, system, or computer program product. Accordingly, one or more embodiments of the present disclosure may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Moreover, one or more embodiments of the present disclosure may take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.
The present disclosure is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the disclosure. It will be understood that each flow and/or block of the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
It should also be noted that the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one … …" does not exclude the presence of other like elements in a process, method, article or apparatus that comprises the element.
One or more embodiments of the disclosure may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. One or more embodiments of the disclosure may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including memory storage devices.
The various embodiments in this disclosure are described in a progressive manner, and identical and similar parts of the various embodiments are all referred to each other, and each embodiment is mainly described as different from other embodiments. In particular, for system embodiments, since they are substantially similar to method embodiments, the description is relatively simple, as relevant to see a section of the description of method embodiments.
The foregoing is merely exemplary of the present disclosure and is not intended to limit the present disclosure. Various modifications and variations of this disclosure will be apparent to those skilled in the art. Any modifications, equivalent substitutions, improvements, or the like, which are within the spirit and principles of the present disclosure, are intended to be included within the scope of the claims of the present disclosure.

Claims (10)

1.A data encryption method, applied to an encryption device, comprising:
Acquiring data to be encrypted;
Symmetrically encrypting the data to be encrypted according to an encryption key to obtain first sub-encrypted data, and carrying out hash encryption on the data to be encrypted according to a preset hash encryption algorithm to obtain second sub-encrypted data; the encryption key is obtained by using an asymmetric public key which is randomly generated in advance to carry out asymmetric encryption on the symmetric public key which is randomly generated in advance;
And combining the first sub-encrypted data and the second sub-encrypted data to obtain encrypted data corresponding to the data to be encrypted.
2. The method of claim 1, wherein the obtaining the data to be encrypted comprises:
intercepting a request message sent to decryption equipment;
And determining the successfully intercepted request message as the data to be encrypted.
3. The method according to claim 2, wherein after the obtaining the encrypted data corresponding to the data to be encrypted, the method further comprises:
And sending the encrypted data corresponding to the data to be encrypted to decryption equipment.
4. A method according to claim 3, wherein the decryption device includes an asymmetric private key randomly generated in advance, the asymmetric private key and the asymmetric public key being a pair of asymmetric key pairs;
the sending the encrypted data corresponding to the data to be encrypted to the decryption device includes:
And sending the encrypted data corresponding to the data to be encrypted and the encryption key to decryption equipment.
5. A data decryption method, applied to a decryption device, where the decryption device includes an asymmetric private key that is randomly generated in advance, and the asymmetric private key and an asymmetric public key that is randomly generated in advance on an encryption device are a pair of asymmetric key pairs, and the method includes:
Acquiring the encrypted data and the encryption key sent by the encryption equipment; the encryption key is obtained by the encryption equipment performing asymmetric encryption on a symmetric public key which is randomly generated in advance according to the asymmetric public key; the encrypted data is obtained according to the encryption key and a preset hash encryption algorithm;
Decrypting the encryption key by using the asymmetric private key to obtain a decrypted symmetric public key;
Decrypting the encrypted data according to the symmetric public key to obtain first sub-decrypted data which is successfully decrypted and second sub-decrypted data which is failed to be decrypted;
Carrying out hash encryption on the first sub-decrypted data according to the preset hash encryption algorithm to obtain data to be verified;
And when the data to be verified is the same as the data before the second sub decryption data is decrypted, determining the first sub decryption data as decryption data corresponding to the encryption data.
6. The method of claim 5, wherein decrypting the encrypted data according to the asymmetric private key to obtain first sub-decrypted data that was successfully decrypted and second sub-decrypted data that was failed to be decrypted comprises:
Detecting whether the symmetric public key is stored in the designated cache or not, and obtaining a detection result; the specified cache stores a secret key obtained by the decryption device in a time period from the current preset time period;
and when the detection result represents that the symmetric public key is not detected in the designated cache, decrypting the encrypted data according to the asymmetric private key to obtain first sub-decrypted data which is successfully decrypted and second sub-decrypted data which is failed to be decrypted.
7. A data encryption apparatus, characterized by being applied to an encryption device, comprising:
The acquisition module is used for acquiring data to be encrypted;
the encryption module is used for symmetrically encrypting the data to be encrypted according to an encryption key to obtain first sub-encrypted data, and carrying out hash encryption on the data to be encrypted according to a preset hash encryption algorithm to obtain second sub-encrypted data; the encryption key is obtained by using an asymmetric public key which is randomly generated in advance to carry out asymmetric encryption on the symmetric public key which is randomly generated in advance;
and the combination module is used for combining the first sub-encrypted data and the second sub-encrypted data to obtain encrypted data corresponding to the data to be encrypted.
8. A data decryption apparatus, applied to a decryption device, where the decryption device includes an asymmetric private key that is randomly generated in advance, and the asymmetric private key and an asymmetric public key that is randomly generated in advance on an encryption device are a pair of asymmetric key pairs, the apparatus comprising:
The acquisition module is used for acquiring the encrypted data and the encryption key sent by the encryption equipment; the encryption key is obtained by the encryption equipment performing asymmetric encryption on a symmetric public key which is randomly generated in advance according to the asymmetric public key; the encrypted data is obtained according to the encryption key and a preset hash encryption algorithm;
the first decryption module is used for decrypting the encryption key by using the asymmetric private key to obtain a decrypted symmetric public key;
The second decryption module is used for decrypting the encrypted data according to the symmetric public key to obtain first sub-decrypted data which is successfully decrypted and second sub-decrypted data which is failed to be decrypted;
The encryption module is used for carrying out hash encryption on the first sub decryption data according to a preset hash encryption algorithm to obtain data to be verified;
And the determining module is used for determining the first sub decryption data as decryption data corresponding to the encryption data when the data to be verified is the same as the data before the second sub decryption data is decrypted.
9. An electronic device, comprising: memory, a processor and a computer program stored on the memory and executable on the processor, which when executed by the processor, performs the steps of the method according to any one of claims 1 to 4, or claims 5 to 6.
10. A computer-readable storage medium, on which a computer program is stored, which computer program, when being executed by a processor, carries out the steps of the method according to any one of claims 1 to 4, or claims 5 to 6.
CN202410347059.1A 2024-03-25 2024-03-25 Data encryption method and device, and data decryption method and device Active CN117955637B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202410347059.1A CN117955637B (en) 2024-03-25 2024-03-25 Data encryption method and device, and data decryption method and device

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202410347059.1A CN117955637B (en) 2024-03-25 2024-03-25 Data encryption method and device, and data decryption method and device

Publications (2)

Publication Number Publication Date
CN117955637A true CN117955637A (en) 2024-04-30
CN117955637B CN117955637B (en) 2024-06-14

Family

ID=90792422

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202410347059.1A Active CN117955637B (en) 2024-03-25 2024-03-25 Data encryption method and device, and data decryption method and device

Country Status (1)

Country Link
CN (1) CN117955637B (en)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104868996A (en) * 2014-02-25 2015-08-26 中兴通讯股份有限公司 Data encryption and decryption method, device thereof, and terminal
CN112055022A (en) * 2020-09-09 2020-12-08 浪潮卓数大数据产业发展有限公司 High-efficiency and high-security network file transmission double encryption method
US20210152351A1 (en) * 2019-04-09 2021-05-20 Mark Rodney Anson Computer System Implemented Method for Generating a Symmetric Encryption Key Used for Encrypting and Decrypting a Computer System User's Hidden Data
CN113830024A (en) * 2021-09-22 2021-12-24 中国第一汽车股份有限公司 Anti-theft control method and device for engine
CN114205142A (en) * 2021-12-09 2022-03-18 建信金融科技有限责任公司 Data transmission method and device, electronic equipment and storage medium

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104868996A (en) * 2014-02-25 2015-08-26 中兴通讯股份有限公司 Data encryption and decryption method, device thereof, and terminal
US20210152351A1 (en) * 2019-04-09 2021-05-20 Mark Rodney Anson Computer System Implemented Method for Generating a Symmetric Encryption Key Used for Encrypting and Decrypting a Computer System User's Hidden Data
CN112055022A (en) * 2020-09-09 2020-12-08 浪潮卓数大数据产业发展有限公司 High-efficiency and high-security network file transmission double encryption method
CN113830024A (en) * 2021-09-22 2021-12-24 中国第一汽车股份有限公司 Anti-theft control method and device for engine
CN114205142A (en) * 2021-12-09 2022-03-18 建信金融科技有限责任公司 Data transmission method and device, electronic equipment and storage medium

Also Published As

Publication number Publication date
CN117955637B (en) 2024-06-14

Similar Documents

Publication Publication Date Title
CN110492990B (en) Private key management method, device and system under block chain scene
US9413754B2 (en) Authenticator device facilitating file security
TWI740399B (en) Data processing method, device and electronic equipment
CN112714117B (en) Service processing method, device, equipment and system
CN109840436A (en) The application method and device of data processing method, trusted user interface resource data
US7546327B2 (en) Platform independent randomness accumulator for network applications
Shinge et al. An encryption algorithm based on ASCII value of data
CN110061957A (en) Data encryption, decryption method, user terminal, server and data management system
CN112287376B (en) Method and device for processing privacy data
CN112003697B (en) Encryption and decryption method and device for cryptographic module, electronic equipment and computer storage medium
CN109936546A (en) Data encryption storage method and device and calculating equipment
CN111726230A (en) Data storage method, data recovery method, device and equipment
CN111181944A (en) Communication system, information distribution method, device, medium, and apparatus
CN113037764B (en) System, method and device for executing service
CN113868505A (en) Data processing method and device, electronic equipment, server and storage medium
CN109040111A (en) Data ciphering method, device, computer equipment and storage medium
CN106850219B (en) Data processing method and terminal
CN117955637B (en) Data encryption method and device, and data decryption method and device
CN103605927A (en) Encryption and decryption method based on embedded Linux system
CN108270563A (en) A kind of method for interchanging data and system based on SM2 Encryption Algorithm
WO2023065772A1 (en) Log data processing method and apparatus, storage medium, and electronic device
CN115051790A (en) Data encryption method, data decryption method and device, and storage medium
CN115941336A (en) Data processing method, device and equipment
CN115499118A (en) Message key generation method, message key generation device, file encryption method, message key decryption method, file encryption device, file decryption device and medium
CN111953480B (en) Key generation device and method, operation key generation device and method

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant