WO2017107642A1

WO2017107642A1 - Text processing method, apparatus and system for secure input method

Info

Publication number: WO2017107642A1
Application number: PCT/CN2016/103054
Authority: WO
Inventors: 杨贤伟
Original assignee: 国民技术股份有限公司
Priority date: 2015-12-22
Filing date: 2016-10-24
Publication date: 2017-06-29
Also published as: CN106911625B; TW201723919A; TWI611316B; CN106911625A

Abstract

Disclosed in the present invention are a text processing method, apparatus and system for a secure input method. The method comprises: registering a security domain, and obtaining an identifier of the security domain; applying for and obtaining a symmetric key corresponding to the security domain; by using the symmetric key, encrypting a plaintext inputted by a user; and outputting an encrypted ciphertext and the identifier of the security domain together.

Description

Text processing method, device and system for safe input method

Technical field

The present invention relates to the field of information security technologies, and in particular, to a text processing method, apparatus, and system for a secure input method.

Background technique

With the development of mobile Internet, text communication has become an important communication method for people, but the smart device and transmission channel itself are not safe. People's chat information, short message information, and email information are all likely to be stolen by Trojans or intercepted by hackers. It is often the case that the bank account, login password and other information contained in the network communication content are intercepted by a malicious third party and cause a great loss to the user. A major threat to users' financial security and privacy information.

At present, some communication software, such as WeChat, encrypts and transmits its own communication information, but this method is only applicable to the transmission of information between these specific communication software. The encryption and decryption capability is limited to the application, such as the WeChat client. For the WeChat client, there is no guarantee that the information transmission through other application software in the smart device, such as the SMS application in the Android system, has no encryption function. In addition, in this manner, the communication information of the user is visible to the communication software operator. Once the communication software operator is negligent in management, it is entirely possible for the internal employee to obtain the communication information of the user in an illegal manner. And this method is implemented by communication software in software encryption and decryption, and it is easy to be overcome by malware.

Summary of the invention

The present invention is intended to provide a text processing method, apparatus and system for a secure input method, which can simplify key management and ensure key storage and transmission under the premise of ensuring text encryption and decryption security of the input method and user convenience. Security.

The technical solution of the embodiment of the present invention is implemented as follows:

The embodiment of the invention provides a text processing method for a secure input method, the method comprising:

Registering a security domain to obtain the security domain identifier;

Applying for and obtaining a symmetric key corresponding to the security domain;

Encrypting the plaintext input by the user by using the symmetric key;

The encrypted ciphertext is output together with the security domain identifier.

In the foregoing solution, the encrypting the plaintext input by the user by using the symmetric key includes:

Each time the plaintext input by the user is encrypted using the symmetric key, an initial vector is randomly generated, and the initial vector is used to participate in the cryptographic operation;

Correspondingly, the outputting the encrypted ciphertext together with the security domain identifier comprises:

The encrypted ciphertext, the security domain identifier, and the initial vector corresponding to the ciphertext are output together.

In the above solution, the method further includes:

Obtaining the ciphertext and the first security domain identifier corresponding to the ciphertext;

When the first security domain identifier is the same as the local second security domain identifier, the ciphertext is decrypted by using the second symmetric key, and the decrypted plaintext is obtained and output;

When the first security domain identifier is different from the second security domain identifier, the ciphertext is sent to the security management platform, and the ciphertext is decrypted by the security management platform, and then the second security domain is used. The second symmetric key is encrypted, and the security management platform returns the ciphertext corresponding to the second security domain identifier, and then decrypts the ciphertext returned by the security management platform by using the second symmetric key to obtain decryption. After the plain text and output.

In the above solution, when there is an initial vector corresponding to the ciphertext, the method further includes:

Obtaining the ciphertext and the first security domain identifier corresponding to the ciphertext, and acquiring an initial vector corresponding to the ciphertext;

The initial vector is used to participate in the decryption operation.

In the foregoing solution, the requesting and acquiring the symmetric key corresponding to the security domain includes:

Signature verification of the obtained symmetric key using secure hardware.

In the above solution, the method further includes:

Use the security hardware to register the security domain and obtain the symmetric key corresponding to the security domain.

The embodiment of the invention further provides a text processing device for a secure input method, the device comprising: a security domain registration module, a symmetric key acquisition module, a plaintext encryption module, and a ciphertext output module;

a security domain registration module, configured to register a security domain, and obtain the security domain identifier;

a symmetric key acquisition module, configured to apply for and obtain a symmetric key corresponding to the security domain;

a plaintext encryption module, configured to encrypt the plaintext input by the user by using the symmetric key;

The ciphertext output module is configured to output the encrypted ciphertext together with the security domain identifier.

In the above solution, the device further includes:

a ciphertext obtaining module, configured to obtain the ciphertext and the first security domain identifier corresponding to the ciphertext;

a same-domain decryption module, configured to decrypt the ciphertext by using the second symmetric key to obtain the decrypted plaintext and output the same when the first security domain identifier is the same as the local second security domain identifier;

The foreign domain decryption module is configured to: send the ciphertext to the security management platform when the first security domain identifier is different from the second security domain identifier, and use the security management platform to decrypt the ciphertext and then use the The second symmetric key is encrypted, and the security management platform returns the ciphertext corresponding to the second security domain identifier, and then decrypts the ciphertext returned by the security management platform by using the second symmetric key to obtain decryption. After the plain text and output.

In the above solution, the device further includes:

The security hardware is configured to register a security domain by using an asymmetric cryptographic algorithm, and obtain a symmetric key corresponding to the security domain.

In the above solution, the security hardware is composed of a smart card, a sound card/Key, a Bluetooth card/Key, and an embedded Secured by a security element or smart wearable device.

An embodiment of the present invention provides a text processing system for a secure input method, where the system includes: a text processing device and a security management platform of any of the above security input methods;

The security management platform is configured to create and manage a security domain, assign a security domain to the text processing device of the secure input method, and send the security domain identifier and the corresponding symmetric key to the text processing device; and send the text processing device The foreign ciphertext is converted into the same-domain ciphertext of the text processing device and returned.

The beneficial effects of the technical solution of the present invention are: a text processing apparatus using a secure input method, including: a security domain registration module, a symmetric key acquisition module, a plaintext encryption module, and a ciphertext output module, and registering a security domain by using a secure input method. Obtaining the security domain identifier; applying and obtaining a symmetric key corresponding to the security domain; encrypting the plaintext input by the user by using the symmetric key; and outputting the encrypted ciphertext together with the security domain identifier, It can simplify the key management and ensure the security of key storage and transmission under the premise of ensuring the text encryption and decryption security of the input method and user convenience.

DRAWINGS

1 is a schematic flowchart of implementing a text processing method of a security input method according to an embodiment of the present invention;

2 is a schematic structural diagram of a text processing apparatus of a secure input method according to an embodiment of the present invention;

FIG. 3 is a schematic structural view of Embodiment 1 of the present invention.

detailed description

In order to explain the embodiments and technical solutions of the present invention more clearly, the technical solutions of the present invention will be described in more detail below with reference to the accompanying drawings and embodiments. It is obvious that the described embodiments are a part of the embodiments of the present invention, and not all Example. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention. Wai.

In the embodiment of the present invention, the system provides a security input method. In addition to the basic functions of the common input method, the secure input method provides a secure input mode. In the secure mode, the user inputs the plaintext in the secure input method. The encryption includes: receiving the plaintext input by the user by using the first editing area; encrypting the plaintext by the encryption and decryption module to obtain the encrypted ciphertext; formatting the ciphertext according to a preset rule, and returning Format the ciphertext. When the user wants to decrypt the ciphertext, the security input method displays the plaintext after decrypting internally, which mainly includes: receiving the formatted ciphertext selected by the user;

And the selected formatted ciphertext is decrypted by the encryption and decryption module to obtain the decrypted plaintext;

The decrypted plaintext is displayed. In this way, the input method is implemented in plain text, and the security protection of the input information of the user is increased.

For such a safe input method, how to safely encrypt and decrypt the text of the secure input method is a key issue. In order to further enhance the security of the security input method, an embodiment of the present invention provides a text processing system for a secure input method, the system comprising a security management platform and a text processing device for a secure input method; wherein the security management platform is used to create And managing the security domain, assigning a security domain to the text processing device of the secure input method, delivering the security domain identifier and the corresponding symmetric key to the text processing device; and converting the foreign ciphertext sent by the text processing device into the text processing Returns the same ciphertext of the device.

1 is a schematic flowchart of implementing a text processing method of a security input method according to an embodiment of the present invention. As shown in FIG. 1 , the method includes:

Step 101: Register a security domain, and obtain the security domain identifier.

Specifically, the security input method needs to register a security domain with the security management platform to obtain the identity of the security domain in which it is located;

Step 102: Apply for and obtain a symmetric key corresponding to the security domain.

Specifically, the security input method applies for and obtains a symmetric key corresponding to the security domain; all security input methods in the same security domain use the same symmetric key;

Step 103: Encrypt the plaintext input by the user by using the symmetric key;

Specifically, the security input method transmits the plaintext received by the first editing area to the encryption and decryption module, and is encrypted by the encryption and decryption module;

Further, each time the plaintext input by the user is encrypted by using the symmetric key, an initial vector is randomly generated, and the initial vector is used to participate in the cryptographic operation;

And outputting the encrypted ciphertext, the security domain identifier, and the initial vector corresponding to the ciphertext;

Step 104: Output the encrypted ciphertext together with the security domain identifier;

Specifically, after the encryption and decryption module completes the encryption, the security input method obtains the encrypted ciphertext from the encryption and decryption module; and outputs the encrypted ciphertext together with the security domain identifier; and uses the security input method to enter the security mode. The application or the user transmits, saves, copies, or deletes the encrypted ciphertext together with the security domain identifier.

When the ciphertext needs to be decrypted, the security input method obtains the ciphertext and the first security domain identifier corresponding to the ciphertext;

Sending the ciphertext to the security management platform when the first security domain identifier is different from the second security domain identifier, and decrypting the ciphertext by the security management platform, and then using the second symmetric key to encrypt Then, the ciphertext corresponding to the second security domain identifier is returned by the security management platform, and then the ciphertext returned by the security management platform is decrypted by using the second symmetric key, and the decrypted plaintext is obtained and output.

Further, when there is an initial vector corresponding to the ciphertext, that is, when the initial vector participates in the cryptographic operation during the encryption, the secure input method obtains the ciphertext and the first security domain identifier corresponding to the ciphertext, And acquiring an initial vector corresponding to the ciphertext;

The initial vector is used to participate in the decryption operation.

Further, the requesting and acquiring the symmetric key corresponding to the security domain includes: performing signature verification on the obtained symmetric key by using security hardware.

Further, the security input method uses a secure hardware to register a security domain and obtain a symmetric key corresponding to the security domain.

The text processing method of the secure input method provided by the above embodiment simplifies the key management and ensures the security of key storage and transmission under the premise of ensuring the text encryption and decryption security of the input method and the user's convenience.

2 is a schematic structural diagram of a text processing apparatus of a security input method according to an embodiment of the present invention. As shown in FIG. 2, the text processing apparatus includes: a security domain registration module 201, a symmetric key acquisition module 202, and a plaintext encryption module 203. And a ciphertext output module 203; wherein

The security domain registration module 201 is configured to register a security domain and obtain the security domain identifier.

The symmetric key obtaining module 202 is configured to apply for and obtain a symmetric key corresponding to the security domain;

The plaintext encryption module 203 is configured to encrypt the plaintext input by the user by using the symmetric key;

The ciphertext output module 204 is configured to output the encrypted ciphertext together with the security domain identifier.

Further, the device further includes:

The foreign domain decryption module is configured to: send the ciphertext to the security management platform when the first security domain identifier is different from the second security domain identifier, and use the security management platform to decrypt the ciphertext and then use the The second symmetric key identifies the encryption, and the security management platform identifies the second security domain corresponding to the secret The text returns, and then the ciphertext returned by the security management platform is decrypted by using the second symmetric key, and the decrypted plaintext is obtained and output.

Further, the device further includes:

Further, the security hardware is implemented by a smart card, a sound card/Key, a Bluetooth card/Key, an embedded security element, or a smart wearable device.

Here, the smart card may be a SIM (Subscriber Identity Module) card or an SD card (Secure Digital Memory Card), and the smart wearable device may be a smart bracelet, a smart watch, or the like. The SIM card can be a standard SIM card, a USIM (Universal Subscriber Identity Module) card, a UIM (User Identify Module) card, a MicroSIM card, a NanoSIM card, and the like. The SD card can be a security data card of various forms and sizes such as a standard SD card and a miniSD card.

Specifically, when the secure hardware is implemented by a smart card, the encryption and decryption process is performed by a security chip in the smart card.

Further, in order to better ensure the security of the input method, the encryption and decryption process for the text using the symmetric algorithm can also be completed by the above-mentioned security hardware.

Here, the asymmetric cryptographic algorithm includes but is not limited to asymmetric cryptographic algorithms such as RSA, ECC, SM2, and SM9. The symmetric cryptographic algorithms include but are not limited to symmetric cryptographic algorithms such as 3DES, AES, SM1, SM4, and SM7.

Each of the above modules and each unit may be implemented by a central processing unit (CPU), a microprocessor (MPU), a digital signal processor (DSP), or a field programmable gate array of a text processing device located in a secure input method. (FPGA) implementation.

The present invention also provides a text processing system for a secure input method, the system comprising the text processing device and the security management platform of the secure input method according to any one of the above;

Here, the security management platform may be a stand-alone server platform or a system management service function running on a business system server.

Example 1:

FIG. 3 is a schematic structural diagram of Embodiment 1 of the present invention. As shown in FIG. 3, the security input method includes a basic function and a key management component. The basic function undertakes the entry of text input by the user and all applications, and calls the security hardware device to complete the text addition and decryption functions of the secure input method. Different from the traditional input method, the safe input method caches the text edited by the user. After the user confirms that the text is correct, the encrypted output button is triggered, the security hardware device function is called to encrypt, and the ciphertext is output to the input box of the target application. .

In addition, the basic function is responsible for identifying the input method ciphertext in the clipboard and automatically decrypting when the user pastes; the key management interacts with the system platform and the security hardware device to complete the key management related functions.

The secure hardware device is a hardware module with a unique identifier (ID) and symmetric and asymmetric encryption and decryption capabilities, and has the function of generating true random numbers, generating and storing symmetric and asymmetric keys.

The security management platform is responsible for maintaining and managing the secure input method security hardware device and its associated keys. If the security hardware device registration information is maintained, the public key TermPubKey uploaded by the security hardware device is received and saved, the symmetric key K is generated, and the symmetric key K is encrypted by using the public key TermPubKey of the security hardware device, and then sent to the security hardware. Device.

The key management method and system for the secure input method have three aspects: the security hardware device registration, the input method key application (key generation and injection), and the input method plus Decryption (use of the key).

The specific instructions are as follows:

Security hardware device registration:

The security hardware device registration includes: generating a public-private key pair (TermPubKey/TermPrvKey) by using the security hardware device, storing the private key TermPrvKey in the security hardware device, and sending the security hardware device identification ID together with the public key TermPubKey to the security management through the secure channel. The platform is registered, and the security management platform is responsible for maintaining and managing security input method security hardware device information (such as ID, TermPubKey, etc.), and assigning the security hardware device to a designated security domain (identifying the security domain by DID), the same All secure hardware devices in the secure domain use the same key K, and the secure hardware devices in different security domains use different keys K. The secure channel may be a dedicated system, a dedicated tool, a virtual private network (VPN), etc., used during the production or release phase of the secure hardware device.

In addition to the security zones created and assigned during the registration phase, one or more new security domains can be created by the security management platform for the secure hardware device at any time required by the application, and all secure hardware devices in the same security domain use the same key. K, the security hardware devices in different security domains use different keys K.

Input method key request (key generation and injection):

(1) The security hardware device uses its own private key TermPrvKey to sign the security hardware device identification ID, and then sends the ID and the signature together to the security management platform through the key management sub-module;

(2) The security management platform authenticates the legality of the security hardware device, and generates and delivers the security input method encryption key K:

The security management platform checks whether the security hardware device ID is registered on the security management platform, and if it is registered, uses the corresponding TermPubKey to verify the ID signature. If the ID signature verification is passed, the security hardware device passes the authentication;

The security management platform generates a symmetric encryption key K, and associates the key K with the related information (ID, TermPubKey) of the security hardware device that applies for the key, that is, assigns a symmetric key corresponding to the security domain to the security hardware device. Key K. The symmetric key K may be generated or saved temporarily or in advance by the security management platform. When the secure hardware device of the secure input method performs a key application, the security management platform allocates a key K thereto;

The security management platform uses TermPubKey as the key to perform asymmetric encryption operation on K to obtain K ciphertext K', and then sends K' to the secure hardware device. Further, the security management platform signs K' using its private key PlatPrvKey. And then send the signatures of K' and K' together to the secure hardware device;

(3) Input method key injection:

The input method key management sub-module passes the received K' to the security hardware device, and the security hardware device uses its own private key TermPrvKey to perform asymmetric decryption operation on the received ciphertext K' to obtain the key K, and the security hardware device saves Key K; or, the input method key management sub-module passes the received signatures of K' and K' to the secure hardware device, and the secure hardware device first verifies the signature of K' using the public key PlatPubKey of the security management platform. If the verification is passed, it indicates that K' is issued by the management platform, and then the security hardware device uses its own private key TermPrvKey to perform asymmetric decryption operation on the received ciphertext K' to obtain the key K, and the security hardware device saves the key. K.

Input method encryption and decryption (use of key):

After the key configuration is completed, the secure input method can use the key K in the secure hardware device to encrypt and decrypt the text processed by the input method.

The secure hardware device in the secure input method uses its own key K to encrypt the text processed by the input method;

Further, when the secure hardware device in the secure input method encrypts the text processed by the input method using its own key K, it also uses an initial vector IV to participate in the cryptographic operation, so that the secure input method encrypts the same text each time. The results are different, further improving the security of the text. The initial vector IV is composed of a true random number generated by the security hardware device, and is bound to the ciphertext, and transmitted, saved, copied or deleted along with the ciphertext data;

Further, in addition to the IV, the ciphertext data is transmitted, saved, copied or deleted together, and the identifier DID of the security domain where the security hardware device is located is also included.

When the security hardware device in the security input method decrypts, if it is determined that the security domain identifier DID of the ciphertext is the same as the security domain identifier, indicating that the ciphertext is generated by the security hardware device of the security domain, the security input method is adopted. The security hardware device decrypts the plaintext using its own key K; otherwise, when the secure input method is decrypted, if the ciphertext is determined to have the security domain identifier (denoted as DIDb) and the security domain identifier The difference (denoted as DIDa) indicates that the ciphertext (denoted as Cb) is generated by a security hardware device other than the security domain, and the secure input method submits the ciphertext Cb to the security management platform through the key management submodule. The security management platform uses the key (denoted as Kb) of the security domain DIDb of the ciphertext Cb to decrypt the plaintext (denoted as P), and then encrypts the plaintext P using the key Ka of the security domain DIDa to obtain the ciphertext Ca. Finally, the encrypted ciphertext Ca is returned to the secure input method, and the secure input method is decrypted by the secure hardware device using its own key Ka to obtain the plaintext P;

Further, the security management platform uses the key Ka of the security domain DIDa to encrypt the plaintext P to obtain the ciphertext Ca, and also uses an initial vector IV2 to participate in the cryptographic operation, so that the security management platform encrypts the same plaintext P each time. Not the same, further improve the security of the text. The initial vector IV2 is composed of a security management platform or a true random number generated by trusted hardware connected to the security management platform, and is bound with the ciphertext Ca, and returned to the secure input method along with the ciphertext data Ca, and the secure input method. The plaintext P is then decrypted by the secure hardware device using its own key Ka.

The respective modules of the text processing apparatus of the secure input method of the present embodiment correspond to the steps described in the embodiment of the text processing method of the above-described secure input method, and thus have the same advantageous effects. In addition, it should be understood that the implementation of the text processing apparatus described above is merely illustrative, and the division of the described modules is only a logical function division, and may be further divided in actual implementation. In addition, the coupling or communication connection of the modules to each other may be through some interfaces, or may be electrical or other forms.

Each of the foregoing functional modules may be part of a text processing device, and may or may not be a physical frame. It may be located in one place or distributed to multiple network units, and may be implemented in the form of hardware or software. The form of the box is implemented. Some or all of the modules may be selected according to actual needs to achieve the objectives of the solution of the present invention.

Those skilled in the art will appreciate that embodiments of the present invention can be provided as a method, system, or computer program product. Accordingly, the present invention may employ hardware embodiments, software embodiments, or a combination of software and A form of embodiment of the hardware aspect. Moreover, the invention can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) including computer usable program code.

The present invention has been described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (system), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flowchart illustrations and/or FIG. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine for the execution of instructions for execution by a processor of a computer or other programmable data processing device. Means for implementing the functions specified in one or more of the flow or in a block or blocks of the flow chart.

The computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device. The apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.

These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device. The instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

It is to be noted that the above description is only an embodiment of the present invention, and thus does not limit the scope of the invention, and the equivalent structure or equivalent flow transformation using the description of the present invention and the drawings, for example, the technology between the embodiments The combination of features, or directly or indirectly, in other related technical fields, is equally included in the scope of patent protection of the present invention.

Claims

A text processing method for a secure input method, characterized in that the method comprises:

Registering a security domain to obtain the security domain identifier;

Applying for and obtaining a symmetric key corresponding to the security domain;

Encrypting the plaintext input by the user by using the symmetric key;

The encrypted ciphertext is output together with the security domain identifier.
The text processing method according to claim 1, wherein the encrypting the plaintext input by the user by using the symmetric key comprises:

Each time the plaintext input by the user is encrypted using the symmetric key, an initial vector is randomly generated, and the initial vector is used to participate in the cryptographic operation;

Correspondingly, the outputting the encrypted ciphertext together with the security domain identifier comprises:

The encrypted ciphertext, the security domain identifier, and the initial vector corresponding to the ciphertext are output together.
The text processing method according to claim 1 or 2, wherein the method further comprises:

Obtaining the ciphertext and the first security domain identifier corresponding to the ciphertext;

When the first security domain identifier is the same as the local second security domain identifier, the ciphertext is decrypted by using the second symmetric key, and the decrypted plaintext is obtained and output;

When the first security domain identifier is different from the second security domain identifier, the ciphertext is sent to the security management platform, and the ciphertext is decrypted by the security management platform, and then the second security domain is used. The second symmetric key is encrypted, and the security management platform returns the ciphertext corresponding to the second security domain identifier, and then decrypts the ciphertext returned by the security management platform by using the second symmetric key to obtain decryption. After the plain text and output.
The text processing method according to claim 3, wherein when there is an initial vector corresponding to the ciphertext, the method further comprises:

Obtaining the ciphertext and the first security domain identifier corresponding to the ciphertext, and acquiring an initial vector corresponding to the ciphertext;

The initial vector is used to participate in the decryption operation.
The text processing method according to claim 1, wherein the requesting and acquiring the symmetric key corresponding to the security domain comprises:

Signature verification of the obtained symmetric key using secure hardware.
The text processing method according to claim 1, wherein the method further comprises:

Use the security hardware to register the security domain and obtain the symmetric key corresponding to the security domain.
A text processing device for a secure input method, the device comprising: a security domain registration module, a symmetric key acquisition module, a plaintext encryption module, and a ciphertext output module;

a security domain registration module, configured to register a security domain, and obtain the security domain identifier;

a symmetric key acquisition module, configured to apply for and obtain a symmetric key corresponding to the security domain;

a plaintext encryption module, configured to encrypt the plaintext input by the user by using the symmetric key;

The ciphertext output module is configured to output the encrypted ciphertext together with the security domain identifier.
The text processing device according to claim 7, wherein the device further comprises:

a ciphertext obtaining module, configured to obtain the ciphertext and the first security domain identifier corresponding to the ciphertext;

a same-domain decryption module, configured to decrypt the ciphertext by using the second symmetric key to obtain the decrypted plaintext and output the same when the first security domain identifier is the same as the local second security domain identifier;

The foreign domain decryption module is configured to: send the ciphertext to the security management platform when the first security domain identifier is different from the second security domain identifier, and use the security management platform to decrypt the ciphertext and then use the The second symmetric key is encrypted, and the security management platform returns the ciphertext corresponding to the second security domain identifier, and then decrypts the ciphertext returned by the security management platform by using the second symmetric key to obtain decryption. After the plain text and output.
The text processing device according to claim 7 or 8, wherein the device further comprises:

The security hardware is configured to register a security domain by using an asymmetric cryptographic algorithm, and obtain a symmetric key corresponding to the security domain.
The text processing apparatus according to claim 9, wherein the secure hardware is implemented by a smart card, a sound card/Key, a Bluetooth card/Key, an embedded secure element, or a smart wearable device.
A text processing system for a secure input method, comprising: a text processing apparatus and a security management platform according to the secure input method according to any one of claims 7 to 10;

The security management platform is configured to create and manage a security domain, assign a security domain to the text processing device of the secure input method, and send the security domain identifier and the corresponding symmetric key to the text processing device; and send the text processing device The foreign ciphertext is converted into the same-domain ciphertext of the text processing device and returned.