TWI611316B - Text processing method for safe input method, text processing device and text processing system - Google Patents

Abstract

The invention discloses a text processing method, device and system of a secure input method, wherein the method includes: registering a security domain, obtaining the security domain identifier; applying for and obtaining a symmetric key corresponding to the security domain; using The symmetric key encrypts the plain text input by the user; and outputs the encrypted cipher text together with the security domain identifier.

Description

Text processing method, text processing device and text processing system for safe input method

The present invention relates to the technical field of information security, and in particular, to a text processing method, device, and system for a secure input method.

With the development of the mobile Internet, text communication has become an important way for people to communicate, but smart devices and transmission channels are not secure by themselves. People ’s chat messages, short messages, and email messages are all being stolen by trojans or hackers. The possibility of interception often occurs that users' bank account numbers, login passwords, and other information contained in online communication content are intercepted by malicious third parties and cause significant losses to users. There are major threats to user security and privacy.

At present, some communication software, such as WeChat, encrypts and transmits its own communication messages, but this method is only applicable to the transmission of messages between these specific communication software. The encryption and decryption capabilities are limited to applications, such as WeChat customers. The end-to-end WeChat client does not guarantee the security of message transmission through other application software in smart devices, such as the SMS application in Android system, which does not have encryption function. In addition, in this way, the user's communication information is visible to the communication software operator. Once the communication software operator is neglected in management, it is entirely possible for internal employees to obtain the user's communication information through illegal means. And this way is all by communication software Implemented by software encryption and decryption, it can be easily attacked by malware.

The present invention hopes to provide a text processing method, device and system for a secure input method, which can simplify key management and ensure key storage and transmission on the premise of ensuring the security of text encryption and decryption of the input method and user convenience. Security.

The technical solution of the embodiment of the present invention is implemented in this way.

An embodiment of the present invention provides a text processing method for a secure input method. The method includes: registering a security domain and obtaining the security domain identifier; applying for and obtaining a symmetric key corresponding to the security domain; and using the symmetric key pair The plain text input by the user is encrypted; the encrypted cipher text is output together with the security domain identifier.

In the above solution, the encrypting the plain text input by the user using the symmetric key includes: each time the plain text input by the user is encrypted using the symmetric key, randomly generating an initial vector and using the The initial vector participates in the cryptographic operation; correspondingly, outputting the encrypted ciphertext together with the security domain identifier includes outputting the encrypted ciphertext, the security domain identifier, and the initial vector corresponding to the ciphertext together. .

In the above solution, the method further includes: obtaining a ciphertext and a first security domain identifier corresponding to the ciphertext; when the first security domain identifier is the same as a local second security domain identifier, using the second symmetry The key decrypts the ciphertext, obtains the decrypted plaintext, and outputs it; when the first security domain identifier is different from the second security domain identifier, sending the ciphertext to a security management platform, The security management platform decrypts the ciphertext before using the The second symmetric key corresponding to the second security domain is encrypted, and the ciphertext corresponding to the second security domain identifier is returned by the security management platform, and then the second symmetric key is used to decrypt the security management platform and return Ciphertext, get the decrypted plaintext and output.

In the above solution, when there is an initial vector corresponding to the ciphertext, the method further includes: while acquiring the ciphertext and the first security domain identifier corresponding to the ciphertext, also acquiring the initial vector corresponding to the ciphertext; using The initial vector participates in a decryption operation.

In the above solution, applying for and obtaining the symmetric key corresponding to the security domain includes: using security hardware to perform signature verification on the obtained symmetric key.

In the above solution, the method further includes: registering a security domain with security hardware, and obtaining a symmetric key corresponding to the security domain.

An embodiment of the present invention also provides a text processing device for a secure input method. The device includes: a security domain registration module, a symmetric key acquisition module, a plaintext encryption module, and a ciphertext output module; wherein the security domain registration module A group for registering a security domain and obtaining the security domain identifier; a symmetric key acquisition module for applying for and obtaining a symmetric key corresponding to the security domain; a plaintext encryption module for using the symmetric key The plain text input by the user is encrypted; the cipher text output module is used to output the encrypted cipher text together with the security domain identifier.

In the above solution, the device further includes: a ciphertext acquisition module for acquiring the ciphertext and a first security domain identifier corresponding to the ciphertext; a same domain decryption module for when the first security domain identifier and Local Second Security Domain ID At the same time, the second symmetric key is used to decrypt the ciphertext to obtain the decrypted plaintext and output; the foreign domain decryption module is used to identify the first security domain identifier and the second security domain identifier. At different times, the ciphertext is sent to a security management platform, the ciphertext is decrypted by the security management platform, and then encrypted with the second symmetric key, and the second security domain is identified by the security management platform The corresponding ciphertext is returned, and then the second symmetric key is used to decrypt the ciphertext returned by the security management platform to obtain the decrypted plaintext and output it.

In the above solution, the device further includes security hardware for registering a security domain using an asymmetric cryptographic algorithm and obtaining a symmetric key corresponding to the security domain.

In the above solution, the security hardware is implemented by a smart card, a sound wave card / Key, a Bluetooth card / Key, an embedded security element, or a smart wearable device.

An embodiment of the present invention provides a text processing system for a secure input method. The system includes the text processing device and a security management platform of any one of the secure input methods described above. The security management platform is used to create and manage a security domain. The text processing device of the secure input method assigns a security domain, and issues a security domain identifier and a corresponding symmetric key to the text processing device; and is used to convert the foreign domain ciphertext sent by the text processing device to the same domain ciphertext of the text processing device. After returning.

The technical solution of the present invention has the beneficial effect that a text processing device using a secure input method includes a security domain registration module, a symmetric key acquisition module, a plaintext encryption module, and a ciphertext output module. The input method registers a security domain to obtain the security domain identifier; applies for and obtains a symmetric key corresponding to the security domain; uses the symmetric key to encrypt a plain text input by a user; and encrypts the encrypted cipher text with the cipher text The security domain identifier is output together, which can simplify the key management and ensure the security of key storage and transmission on the premise of ensuring the security of the text encryption and decryption of the input method and the convenience of the user.

101-104‧‧‧step

201-204‧‧‧ steps

FIG. 1 is a schematic diagram of an implementation process of a text processing method of a secure input method according to an embodiment of the present invention.

FIG. 2 is a schematic structural diagram of a text processing device of a secure input method according to an embodiment of the present invention.

FIG. 3 is a schematic structural diagram of Embodiment 1 of the present invention.

In order to explain the embodiments and technical solutions of the present invention more clearly, the technical solutions of the present invention will be described in more detail with reference to the drawings and the embodiments. Obviously, the described embodiments are part of the present invention, but not all of them. Examples. Based on the embodiments of the present invention, all other embodiments obtained by those with ordinary knowledge in the technical field without departing from the spirit of the present invention belong to the protection scope of the present invention.

In the embodiment of the present invention, the system provides a secure input method. In addition to the basic functions of the ordinary input method, the secure input method also provides a secure input mode. In the secure mode, the plain text input to the user is performed inside the secure input method. Encryption mainly includes: using the first editing area to receive the plaintext input by the user; passing the plaintext to the encryption and decryption module for encryption, Obtain the encrypted ciphertext; format the ciphertext according to a preset rule, and return the formatted ciphertext. When the user wishes to decrypt the ciphertext, the secure input method displays the plaintext after internal decryption, which mainly includes: receiving the formatted ciphertext selected by the user; and passing the selected formatted ciphertext to the encryption and decryption module. Perform decryption to obtain the decrypted plaintext; and display the decrypted plaintext. In this way, the plain text input method is realized, and the security of the user's input message is increased.

Aiming at such a secure input method, how to more securely encrypt and decrypt the text of the secure input method is a key issue. In order to further strengthen the security of the secure input method, an embodiment of the present invention provides a text processing system for a secure input method. The system includes a security management platform and a text processing device for the secure input method. The security management platform is used to create and Manage a security domain, assign a security domain to a text processing device of a secure input method, and issue a security domain identifier and a corresponding symmetric key to the text processing device; and be used to convert foreign domain cipher text sent by the text processing device to the text processing device Returns the same domain ciphertext.

FIG. 1 is a schematic flowchart of a text processing method of a secure input method provided by an embodiment of the present invention. As shown in FIG. 1, the method includes the following steps.

Step 101: Register a security domain to obtain the security domain identifier. Specifically, the security input method needs to register a security domain with a security management platform to obtain the security domain identifier where the security domain is located.

Step 102: Apply for and obtain a symmetric key corresponding to the security domain; specifically, a secure input method applies for and obtain a symmetric key corresponding to the security domain; all secure input methods in the same security domain use the same symmetric key.

Step 103: Use the symmetric key to encrypt the plain text input by the user. Specifically, the secure input method transmits the plain text received by the first editing area to the encryption / decryption module, and the encryption / decryption module performs encryption.

Further, each time the plain text input by the user is encrypted using the symmetric key, an initial vector is randomly generated, and the initial vector is used to participate in cryptographic operations.

Accordingly, outputting the encrypted ciphertext together with the security domain identifier includes outputting the encrypted ciphertext, the security domain identifier, and an initial vector corresponding to the ciphertext together.

Step 104: output the encrypted ciphertext together with the security domain identifier. Specifically, after the encryption and decryption module completes encryption, the secure input method obtains the encrypted ciphertext from the encryption and decryption module; The ciphertext is output together with the security domain identifier; an application or user inputted using the secure input method security mode transmits, saves, copies, or deletes the encrypted ciphertext together with the security domain identifier.

When the ciphertext needs to be decrypted, the secure input method obtains the ciphertext and the first security domain identifier corresponding to the ciphertext.

When the first security domain identifier is the same as the local second security domain identifier, the ciphertext is decrypted by using the second symmetric key, and the decrypted plaintext is obtained and output.

When the first security domain identifier is different from the second security domain identifier, the ciphertext is sent to a security management platform, the ciphertext is decrypted by the security management platform, and then encrypted by using the second symmetric key , And then the security management platform returns the ciphertext corresponding to the second security domain identifier, and thereafter Use the second symmetric key to decrypt the ciphertext returned by the security management platform, obtain the decrypted plaintext, and output.

Further, when there is an initial vector corresponding to the ciphertext, that is, an initial vector participates in the cryptographic operation during encryption, the secure input method obtains the ciphertext and the first security domain identifier corresponding to the ciphertext, and also acquires An initial vector corresponding to the ciphertext; using the initial vector to participate in a decryption operation.

Further, applying for and obtaining the symmetric key corresponding to the security domain includes: using security hardware to perform signature verification on the obtained symmetric key.

Further, the secure input method uses secure hardware to register a secure domain and obtain a symmetric key corresponding to the secure domain.

The text processing method using the secure input method provided by the above embodiments simplifies key management and guarantees security of key storage and transmission on the premise of ensuring the security of text encryption and decryption of the input method and user convenience.

FIG. 2 is a schematic structural diagram of a structure of a text processing device of a secure input method according to an embodiment of the present invention. As shown in FIG. 2, the text processing device includes a security domain registration module 201, a symmetric key acquisition module 202, and plaintext encryption. Module 203 and ciphertext output module 203.

The security domain registration module 201 is configured to register a security domain and obtain the security domain identifier.

The symmetric key obtaining module 202 is configured to apply for and obtain a symmetric key corresponding to the security domain.

The plaintext encryption module 203 is configured to use the symmetric key to encrypt the plaintext input by the user.

The ciphertext output module 204 is configured to combine the encrypted ciphertext with the security The global ID is output together.

Further, the device further includes: a ciphertext acquisition module, configured to acquire the ciphertext and a first security domain identifier corresponding to the ciphertext.

The same domain decryption module is used to decrypt the ciphertext using the second symmetric key when the first security domain identifier is the same as the local second security domain identifier, obtain the decrypted plaintext, and output .

A foreign domain decryption module is configured to send the ciphertext to a security management platform when the first security domain identifier is different from the second security domain identifier, and the security management platform decrypts the ciphertext before using the ciphertext. The second symmetric key is encrypted, and the security management platform returns the ciphertext corresponding to the second security domain identifier, and then uses the second symmetric key to decrypt the ciphertext returned by the security management platform, Obtain the decrypted plaintext and output it.

Further, the device further includes: security hardware for registering a security domain using an asymmetric cryptographic algorithm, and acquiring a symmetric key corresponding to the security domain.

Further, the security hardware is implemented by a smart card, a sound wave card / Key, a Bluetooth card / Key, an embedded security element, or a smart wearable device.

Here, the smart card may be a SIM (Subscriber Identity Module) card or an SD card (Secure Digital Memory Card). The smart wearable device may be a smart bracelet, a smart watch, or the like. The SIM card can be a standard SIM card, a USIM (Universal Subscriber Identity Module) card, a UIM (User Identify Module) card, a MicroSIM card, a NanoSIM card, and other forms and sizes of communication cards. . SD cards can be secure data cards of various forms and sizes, such as standard SD cards, miniSD cards.

Specifically, when the security hardware is implemented by a smart card, the encryption and decryption processes are completed by the security chip in the smart card.

Further, in order to better ensure the security of the input method, the process of encrypting and decrypting text using a symmetric algorithm can also be completed by the aforementioned security hardware.

Here, the aforementioned asymmetric cryptographic algorithm includes, but is not limited to, asymmetric cryptographic algorithms such as RSA, ECC, SM2, and SM9, and the aforementioned symmetric cryptographic algorithm includes, but is not limited to, 3DES, AES, SM1, SM4, and SM7 symmetrical cipher algorithms.

Each of the above modules and units can be implemented by a central processing unit (CPU), a microprocessor (MPU), a digital signal processor (DSP), or field programmable in a text processing device located in a secure input method. Gate Array (FPGA) implementation.

The invention also provides a text processing system for a secure input method, which includes a text processing device and a security management platform for the secure input method according to any one of the above.

The security management platform is used to create and manage a security domain, assign a security domain to a text processing device of a secure input method, and issue a security domain identifier and a corresponding symmetric key to the text processing device; and use the text processing device The sent foreign domain ciphertext is converted into the same domain ciphertext of the text processing device and returned.

Here, the security management platform may be an independent server platform or a system management server running on a business system server. Service function.

Example 1:

FIG. 3 is a schematic structural diagram of Embodiment 1 of the present invention. As shown in FIG. 3, the secure input method includes basic functions and key management. The basic functions accept the user's entry of text input with all applications, and call the secure hardware device to complete the text encryption and decryption functions of the secure input method. Different from the traditional input method, the secure input method caches the text edited by the user. After the user confirms that the text is correct, the encrypted output button is triggered, the function of the secure hardware device is called for encryption, and the cipher text is output to the target application. Input box.

In addition, the basic function is responsible for identifying the input method ciphertext in the clipboard application and automatically decrypting it when the user pastes it; key management interacts with the system platform and the security hardware device to complete key management related functions.

The secure hardware device is a hardware module with a unique identification (ID) and symmetric and asymmetric encryption and decryption capabilities, and has the functions of generating true random numbers, generating and storing symmetric and asymmetric keys.

The security management platform is responsible for maintaining and managing the secure input method security hardware device and its related keys. For example, maintaining the registration information of the secure hardware device, receiving and saving the public key TermPubKey uploaded by the secure hardware device, generating the symmetric key K, using the public key TermPubKey of the secure hardware device to encrypt the symmetric key K, and then issuing the symmetric key K Give security hardware.

The key management method and system for the secure input method, the basic working process of the key management includes three aspects: registration of the secure hardware device, input method key application (key generation and injection), input method Encryption and decryption Use of keys).

The details are as follows.

Security hardware device registration.

Security hardware device registration includes generating a public-private key pair (TermPubKey / TermPrvKey) using the security hardware device, storing the private key TermPrvKey in the security hardware device, and passing the security hardware device identification ID and its public key TermPubKey through a secure channel Sent to a security management platform for registration. The security management platform is responsible for maintaining and managing the security input method security hardware device information (such as ID, TermPubKey, etc.), and assigning the security hardware device to a designated security domain (identified by DID The security domain), all security hardware devices in the same security domain use the same key K, and security hardware devices in different security domains use different keys K. The secure channel may be a dedicated system, a dedicated tool, a virtual private network (VPN), or the like used in the production or distribution phase of the secure hardware device.

In addition to the security domains created and assigned during the registration phase, the security management platform can also create one or more new security domains for security hardware devices whenever the application requires them. All security hardware devices in the same security domain use the same Key K, the security hardware devices in different security domains use different keys K.

Input method key application (key generation and injection)

(1) The security hardware device uses its own private key TermPrvKey to sign the security hardware device identification ID, and then sends the ID and signature together to the security management platform through the key management submodule.

(2) The security management platform authenticates the legality of the security hardware device and generates And issued a secure input method encryption key K

The security management platform checks whether the security hardware device ID is registered on the security management platform. If it is registered, the corresponding TermPubKey is used to verify the ID signature. If it is registered and the ID signature verification is passed, the security hardware device authentication is passed.

The security management platform generates a symmetric encryption key K, and associates the key K with the relevant information (ID, TermPubKey) of the security hardware device that applied for the key, that is, assigns a corresponding security domain to the security hardware device. Symmetric key K. The symmetric key K may be generated and stored temporarily or in advance by the security management platform. When the security hardware device of the secure input method applies for a key, the security management platform allocates the key K to it.

The security management platform uses TermPubKey as the key to perform an asymmetric encryption operation on K to obtain K's ciphertext K ', and then sends K' to the secure hardware device. Further, the security management platform uses its own private key, PlatPrvKey, to perform K's Sign and then send K 'and K's signature to the secure hardware device.

(3) Input method key injection

The input method key management sub-module passes the received K 'to the secure hardware device. The secure hardware device uses its own private key TermPrvKey to perform an asymmetric decryption operation on the received cipher text K' to obtain the key K, which is secure. The hardware device saves the key K; or, the input method key management submodule passes the received K 'and K' signatures to the secure hardware device. The secure hardware device first uses the public key of the security management platform PlatPubKey Verify K's signature. If the verification is successful, it means that K 'was issued by the management platform. The security hardware device then uses its own private key TermPrvKey to perform an asymmetric decryption operation on the received ciphertext K 'to obtain the key K, and the security hardware device stores the key K.

Input method encryption and decryption (use of keys)

After the key configuration is completed, the secure input method can use the key K in the secure hardware device to encrypt and decrypt the text processed by the input method.

The secure hardware device in the secure input method uses its own key K to encrypt the text processed by the input method.

Further, when the secure hardware device in the secure input method uses its own key K to encrypt the text processed by the input method, it also uses an initial vector IV to participate in the cryptographic operation, so that the secure input method encrypts the same text each time. The results are all different, further improving the security of the text. The initial vector IV is composed of a true random number generated by a secure hardware device, is bound to the ciphertext, and is transmitted, saved, copied, or deleted along with the ciphertext data.

Further, in addition to the IV, the DID that is transmitted, saved, copied, or deleted with the ciphertext data also includes the identification DID of the security domain where the security hardware device is located.

When the secure hardware device in the secure input method performs decryption, if it is determined that the security domain identifier DID carried in the ciphertext is the same as the security domain identifier, it means that the ciphertext was generated by the security hardware device of the security domain, and the security input The plaintext can be obtained through decryption by the secure hardware device using its own key K; otherwise, when the secure input method is used for decryption, if the security domain identifier (denoted as DIDb) carried by the ciphertext and the security domain identifier (denoted as DIDa) are determined Different, indicating the secret The text (referred to as Cb) is generated by a secure hardware device that is not in the security domain. The secure input method submits the ciphertext Cb to the security management platform through the key management submodule, and the security management platform uses the ciphertext Cb. Decrypt the key of the security domain DIDb (denoted as Kb) to obtain the plaintext (denoted as P), and then use the key of the security domain DIDa to encrypt the plaintext P to obtain the ciphertext Ca, and finally encrypt the encrypted ciphertext Ca Return to the secure input method. The secure input method then decrypts the plaintext P through the secure hardware device using its own key Ka.

Further, when the security management platform encrypts the plaintext P using the key Ka of the security domain DIDa to obtain the ciphertext Ca, it also uses an initial vector IV2 to participate in the cryptographic operation, so that the security management platform encrypts the same plaintext P every time. Not the same, further improving the security of the text. The initial vector IV2 is composed of a true random number generated by the security management platform or trusted hardware connected to the security management platform, and is bound to the ciphertext Ca, and is returned to the secure input method along with the ciphertext data Ca. The secure input The method then decrypts the plaintext P by the security hardware device using its own key Ka.

Each module of the text processing device of the secure input method in this embodiment corresponds to the steps described in the text processing method embodiment of the secure input method, and therefore has the same beneficial effects. In addition, it should be understood that the implementation of the text processing device described above is only schematic, and the division of the described modules is only a logical function division, and there may be another division manner in actual implementation. In addition, the coupling or communication connection between the modules may be through some interfaces, and may also be electrical or other forms.

Each of the above functional modules, as a component of a text processing device, can It may or may not be a physical frame, may be located in one place, or may be distributed on multiple network units, and may be implemented in the form of hardware or in the form of a software functional frame. Some or all of the modules can be selected according to actual needs to achieve the objective of the solution of the present invention.

Those with ordinary knowledge in the art should understand that the embodiments of the present invention may be provided as a method, a system, or a computer program product. Therefore, the present invention may take the form of a hardware embodiment, a software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, optical storage, etc.) containing computer-usable program code therein.

The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, and a combination of the process and / or block in the flowchart and / or block diagram may be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing device to generate a machine, so that the instructions generated by the processor of the computer or other programmable data processing device can be used to generate instructions. Means for implementing the functions specified in one or more flowcharts and / or one or more blocks of the block diagrams.

These computer program instructions can also be stored in a computer-readable storage that can guide a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable storage generate instructions including the instruction device. An article of manufacture, the instruction device implements a function specified in a flow chart or flow and / or a block diagram or blocks.

These computer program instructions can also be loaded on a computer or other programmable data processing device, so that a series of operating steps can be performed on the computer or other programmable device to generate a computer-implemented process, which can be executed on the computer or other programmable device. The instructions provide steps for implementing the functions specified in one or more flowcharts and / or one or more blocks of the block diagrams.

Once again, the above description is only an embodiment of the present invention, and does not limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made by using the description and drawings of the present invention, such as the technology between the embodiments The combination of features, or direct or indirect use in other related technical fields, is also included in the scope of patent protection of the present invention.

101-104‧‧‧step

Claims (9)

A text processing method for a secure input method includes: registering a security domain and obtaining a security domain identifier; applying for and obtaining a symmetric key corresponding to the security domain; using the symmetric key to encrypt a plain text input by a user; The ciphertext is output together with the security domain identifier; the ciphertext and the first security domain identifier corresponding to the ciphertext are obtained; when the first security domain identifier is the same as the local second security domain identifier, the second symmetric key is used Decrypt the ciphertext, obtain the decrypted plaintext, and output; when the first security domain identifier is different from the second security domain identifier, send the ciphertext to a security management platform, and the security management platform decrypts the ciphertext After that, the second symmetric key corresponding to the second security domain is used for encryption, and the ciphertext corresponding to the second security domain identifier is returned by the security management platform, and then the second symmetric key is used to decrypt the security management. The ciphertext returned by the platform, the decrypted plaintext is obtained and output. The text processing method described in claim 1, wherein the encrypting the plaintext input by the user using the symmetric key includes: each time the plaintext input by the user is encrypted using the symmetric key, an initial vector is randomly generated, And use the initial vector to participate in cryptographic operations; correspondingly, the output of the encrypted ciphertext along with the security domain identifier includes: The encrypted ciphertext, the security domain identifier, and the initial vector corresponding to the ciphertext are output together. The text processing method described in claim 1, wherein when an initial vector corresponding to the ciphertext exists, the method further includes: acquiring the ciphertext and the first security domain identifier corresponding to the ciphertext, and also acquiring the ciphertext The corresponding initial vector; use this initial vector to participate in the decryption operation. The text processing method as described in claim 1, wherein applying for and obtaining the symmetric key corresponding to the security domain includes: using security hardware to perform signature verification on the obtained symmetric key. The text processing method as described in claim 1, wherein the method further comprises: registering a security domain with security hardware and obtaining a symmetric key corresponding to the security domain. A text processing device for a secure input method includes a security domain registration module, a symmetric key acquisition module, a plaintext encryption module, and a ciphertext output module; wherein the security domain registration module is used to register a security domain and obtain The security domain identifier; a symmetric key acquisition module for applying for and obtaining the symmetric key corresponding to the security domain; a plaintext encryption module for using the symmetric key to encrypt the plaintext entered by the user; The ciphertext output module is used to output the encrypted ciphertext together with the security domain identifier; the ciphertext acquisition module is used to acquire the ciphertext and the first security domain identifier corresponding to the ciphertext; the same domain decryption module For decrypting the ciphertext using the second symmetric key when the first security domain identifier is the same as the local second security domain identifier, obtaining the decrypted plaintext and outputting it; the foreign domain decryption module is used for When the first security domain identifier is different from the second security domain identifier, the ciphertext is sent to a security management platform, the ciphertext is decrypted by the security management platform, and then encrypted by the second symmetric key, and then the The security management platform returns the ciphertext corresponding to the second security domain identifier, and then uses the second symmetric key to decrypt the ciphertext returned by the security management platform, obtains the decrypted plain text, and outputs it. The text processing apparatus according to claim 6, wherein the apparatus further includes: security hardware, which is used to register a security domain using an asymmetric cryptographic algorithm and obtain a symmetric key corresponding to the security domain. The text processing device according to claim 7, wherein the security hardware is implemented by a smart card, a sound wave card / Key, a Bluetooth card / Key, an embedded security element, or a smart wearable device. A text processing system for a secure input method, the system comprising: a text processing device for a secure input method as described in any one of claims 6 to 8 and a security management platform; The security management platform is used to create and manage a security domain, assign a security domain to a text processing device of a secure input method, and issue a security domain identifier and a corresponding symmetric key to the text processing device; and send the text processing device. The foreign-domain ciphertext is converted to the same-domain ciphertext of the text processing device and returned.