CN115037458A - An encryption method, device, equipment and storage medium - Google Patents

Abstract

The embodiment of the application provides an encryption method, an encryption device, equipment and a storage medium, which relate to the technical field of encryption, and the method comprises the following steps: the first device sends an encryption request to the second device, the second device generates a response message aiming at the encryption request, and the second device sends the response message to the first device. The first device encrypts the data to be processed based on the first key generation algorithm and the target encryption algorithm to obtain encrypted data, and sends the encrypted data to the second device. And the second equipment decrypts the encrypted data based on the second key generation algorithm and the target decryption algorithm to obtain the data to be processed. Because the second device does not directly send the encryption key to the first device, but sends the first key generation algorithm and the target encryption algorithm, the communication security of the first device and the second device is effectively ensured.

Description

An encryption method, device, equipment and storage medium

technical field

Embodiments of the present invention relate to the field of encryption technologies, and in particular, to an encryption method, apparatus, device, and storage medium.

Background technique

With the development of the Internet and communication technology, more and more people transmit information through the network, and the types of information transmitted are becoming more and more diverse, and their importance is getting higher and higher, and the requirements for information security are getting higher and higher.

During the communication between the first device and the second device, in order to protect the security of the communication content, the first device encrypts the communication content with a key, and sends the encrypted communication content to the second device, and the second device encrypts the communication content with a key. The encrypted communication content is decrypted using the corresponding key to obtain the communication content.

However, as the computing power of the computer increases, it is easy to brute force the key stored by the first device or the second device, thereby affecting the security of the communication between the first device and the second device.

SUMMARY OF THE INVENTION

Embodiments of the present application provide an encryption method, apparatus, device, and storage medium, which are used to improve the security of communication between a first device and a second device.

On the one hand, an embodiment of the present application provides an encryption method, which is applied to a first device, and the method includes:

Receive a response message for an encryption request sent by a second device, where the encryption request is sent by the first device to the second device; the response message includes a first selected from N candidate key generation algorithms The key generation algorithm and the target encryption algorithm selected from M candidate encryption algorithms; wherein, N>1, M>1;

Encrypt the data to be processed based on the first key generation algorithm and the target encryption algorithm to obtain encrypted data;

sending the encrypted data to the second device, so that the second device decrypts the encrypted data based on the second key generation algorithm and the target decryption algorithm to obtain the data to be processed; the second The key generation algorithm corresponds to the first key generation algorithm, and the target decryption algorithm corresponds to the target encryption algorithm.

Optionally, after receiving the response message for the encryption request sent by the second device, the method further includes:

The response message is loaded into the memory, and the response message is parsed in the memory to obtain a target encrypted dynamic link library, wherein the target encrypted dynamic link library includes the first key generation algorithm and the Describe the target encryption algorithm.

Optionally, the target encryption dynamic link library also includes an encryption key acquisition interface and a data encryption interface;

The performing encryption processing on the data to be processed based on the first key generation algorithm and the target encryption algorithm to obtain encrypted data, including:

Obtain the first key generation algorithm by invoking the encryption key acquisition interface, and use the first key generation algorithm to generate an encryption key;

By invoking the data encryption interface, the target encryption algorithm is obtained, and the data to be processed is encrypted based on the encryption key and the target encryption algorithm to obtain encrypted data.

Optionally, the response message further includes second device information of the second device;

The obtaining the first key generation algorithm by invoking the encryption key obtaining interface includes:

The first device information and the second device information of the first device are used as input parameters of the encryption key acquisition interface, and the encryption key acquisition interface is called to obtain the first key generation algorithm;

The obtaining the target encryption algorithm by invoking the data encryption interface includes:

Using the encryption key as an input parameter of the data encryption interface, call the data encryption interface to obtain the target encryption algorithm.

On the one hand, an embodiment of the present application provides an encryption method, which is applied to a second device, and the method includes:

Receive an encryption request sent by the first device, and generate a response message for the encryption request, where the response message includes a first key generation algorithm selected from N candidate key generation algorithms and a first key generation algorithm selected from M candidate encryption algorithms The target encryption algorithm of , where N>1, M>1;

sending the response message to the first device, so that the first device encrypts the data to be processed based on the first key generation algorithm and the target encryption algorithm to obtain encrypted data;

Receive the encrypted data sent by the first device, and decrypt the encrypted data based on the second key generation algorithm and the target decryption algorithm to obtain the data to be processed; the second key generation algorithm and the The first key generation algorithm corresponds to the target decryption algorithm, and the target encryption algorithm corresponds to the target encryption algorithm.

Optionally, the generating a response message for the encryption request includes:

Encapsulating the first key generation algorithm and the target encryption algorithm into a target encryption dynamic link library, wherein the target encryption dynamic link library includes an encryption key acquisition interface and a data encryption interface;

The response message is generated based on the target encrypted dynamic link library and the second device information of the second device.

Optionally, the encryption request includes first device information of the first device;

Described encapsulating the first key generation algorithm and the target encryption algorithm into a target encryption dynamic link library, including:

Using the first device information and the second device information as keys, and the encryption key acquisition interface and the data encryption interface as values, perform the first key generation algorithm and the target encryption algorithm. package to obtain the target encrypted dynamic link library.

Optionally, the receiving encrypted data sent by the first device, and performing decryption processing on the encrypted data based on a second key generation algorithm and a target decryption algorithm to obtain the data to be processed, including:

receiving encrypted data sent by the first device and third device information of the first device;

If the first device information and the third device information meet a preset condition, generating a decryption key based on the second key generation algorithm;

Based on the decryption key and the target decryption algorithm, decrypt the encrypted data to obtain the data to be processed.

On the one hand, an embodiment of the present application provides an encryption device, and the device includes:

a first receiving module, for receiving a response message for an encryption request sent by a second device, where the encryption request is sent by the first device to the second device; the response message includes an algorithm generated from N candidate keys The first key generation algorithm selected in and the target encryption algorithm selected from M candidate encryption algorithms; wherein, N>1, M>1;

an encryption module, configured to perform encryption processing on the data to be processed based on the first key generation algorithm and the target encryption algorithm to obtain encrypted data;

A first sending module, configured to send the encrypted data to the second device, so that the second device decrypts the encrypted data based on the second key generation algorithm and the target decryption algorithm, and obtains the to-be-decrypted data. processing data; the second key generation algorithm corresponds to the first key generation algorithm, and the target decryption algorithm corresponds to the target encryption algorithm.

Optionally, it also includes a parsing module, and the parsing module is specifically used for:

After receiving the response message for the encryption request sent by the second device, the response message is loaded into the memory, and the response message is parsed in the memory to obtain a target encrypted dynamic link library, wherein the The target encryption dynamic link library includes the first key generation algorithm and the target encryption algorithm.

Optionally, the target encryption dynamic link library also includes an encryption key acquisition interface and a data encryption interface;

The encryption module is specifically used for:

Obtain the first key generation algorithm by invoking the encryption key acquisition interface, and use the first key generation algorithm to generate an encryption key;

By invoking the data encryption interface, the target encryption algorithm is obtained, and the data to be processed is encrypted based on the encryption key and the target encryption algorithm to obtain encrypted data.

Optionally, the response message further includes second device information of the second device;

The encryption module is specifically used for:

The first device information and the second device information of the first device are used as input parameters of the encryption key acquisition interface, and the encryption key acquisition interface is called to obtain the first key generation algorithm;

The pass-through encryption module is specifically used for:

Using the encryption key as an input parameter of the data encryption interface, call the data encryption interface to obtain the target encryption algorithm.

On the one hand, an embodiment of the present application provides an encryption device, and the device includes:

The second receiving module is configured to receive an encryption request sent by the first device, and generate a response message for the encryption request, where the response message includes a first key generation algorithm selected from N candidate key generation algorithms and a The target encryption algorithm selected from the M candidate encryption algorithms, where N>1, M>1;

The second sending module is configured to send the response message to the first device, so that the first device encrypts the data to be processed based on the first key generation algorithm and the target encryption algorithm to obtain encrypted data data;

a decryption module, configured to receive the encrypted data sent by the first device, and decrypt the encrypted data based on the second key generation algorithm and the target decryption algorithm to obtain the data to be processed; the second key The generation algorithm corresponds to the first key generation algorithm, and the target decryption algorithm corresponds to the target encryption algorithm.

Optionally, the second receiving module is specifically configured to:

Encapsulating the first key generation algorithm and the target encryption algorithm into a target encryption dynamic link library, wherein the target encryption dynamic link library includes an encryption key acquisition interface and a data encryption interface;

The response message is generated based on the target encrypted dynamic link library and the second device information of the second device.

Optionally, the encryption request includes first device information of the first device;

The second receiving module is specifically used for:

Using the first device information and the second device information as keys, and the encryption key acquisition interface and the data encryption interface as values, perform the first key generation algorithm and the target encryption algorithm. package to obtain the target encrypted dynamic link library.

Optionally, the decryption module is specifically used for:

receiving encrypted data sent by the first device and third device information of the first device;

If the first device information and the third device information meet a preset condition, generating a decryption key based on the second key generation algorithm;

Based on the decryption key and the target decryption algorithm, decrypt the encrypted data to obtain the data to be processed.

On the one hand, an embodiment of the present application provides a computer device, including a memory, a processor, and a computer program stored in the memory and running on the processor, the processor implementing the steps of the encryption method when executing the program .

On the one hand, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program executable by a computer device, and when the program runs on the computer device, causes the computer device to execute the steps of the above encryption method .

In this embodiment of the present application, the first device sends an encryption request to the second device, the second device generates a response message for the encryption request, and the second device sends the response message to the first device. The first device encrypts the data to be processed based on the first key generation algorithm and the target encryption algorithm, obtains encrypted data, and sends the encrypted data to the second device. The second device decrypts the encrypted data based on the second key generation algorithm and the target decryption algorithm to obtain data to be processed. Because the second device does not directly send the encryption key to the first device, but sends the first key generation algorithm and the target encryption algorithm, the communication security between the first device and the second device is effectively guaranteed.

Description of drawings

In order to illustrate the technical solutions in the embodiments of the present invention more clearly, the following briefly introduces the accompanying drawings used in the description of the embodiments. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained from these drawings without any creative effort.

FIG. 1 is a schematic diagram of a system architecture provided by an embodiment of the present application;

2 is a schematic flowchart of an encryption method provided by an embodiment of the present application;

3 is a schematic flowchart of a method for loading a target encryption dynamic link library provided by an embodiment of the present application;

4 is a schematic flowchart of a method for a first device to obtain encrypted data according to an embodiment of the present application;

5 is a schematic flowchart of a method for obtaining data to be processed by a second device according to an embodiment of the present application;

6 is a schematic flowchart of an encryption method provided by an embodiment of the present application;

7 is a schematic structural diagram of an encryption device according to an embodiment of the present application;

8 is a schematic structural diagram of an encryption device according to an embodiment of the present application;

FIG. 9 is a schematic structural diagram of a computer device according to an embodiment of the present application.

Detailed ways

In order to make the objectives, technical solutions and beneficial effects of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention, but not to limit the present invention.

Referring to FIG. 1 , which is an architecture diagram of an encryption system to which the embodiments of the present application are applied, the architecture diagram of the encryption system includes at least a first device 101 and a second device 102 .

The first device 101 may be an independent physical server, a server cluster or a distributed system composed of multiple physical servers, or a cloud service, cloud database, cloud computing, cloud function, cloud storage, network service, cloud Cloud servers for basic cloud computing services such as communications, middleware services, domain name services, security services, Content Delivery Network (CDN), and big data and artificial intelligence platforms.

A target application for encryption is installed in the first device 101 , and the application may be a pre-installed client, a web version application, or a small program embedded in other applications, or the like. The first device 101 may be a smart phone, a tablet computer, a notebook computer, a desktop computer, etc., but is not limited thereto.

The second device 102 may be an independent physical server, a server cluster or a distributed system composed of multiple physical servers, or a cloud service, cloud database, cloud computing, cloud function, cloud storage, network service, cloud Cloud servers for basic cloud computing services such as communications, middleware services, domain name services, security services, Content Delivery Network (CDN), and big data and artificial intelligence platforms.

The first device 101 is connected to the second device 102, which may be directly or indirectly connected through wired or wireless communication, which is not limited in this application.

Based on the system architecture diagram shown in FIG. 1 , an embodiment of the present application provides a flow of an encryption method. As shown in FIG. 2 , the flow of the method is executed interactively by the first device 101 and the second device 102 shown in FIG. 1 . , including the following steps:

Step S201, the first device sends an encryption request to the second device.

Specifically, the first device may be a terminal device or a server; the second device may be a terminal device or a server. This is not limited.

The encryption request includes first device information of the first device. The first device information includes at least one of the following: a MAC address, an IP address, a port number, a CPU model, a device model, a device serial number, a system version number, a timestamp, and a random number.

Step S202, the second device generates a response message for the encryption request.

Specifically, the second device acquires the first device information in the encryption request, and generates a unique identifier corresponding to the first device based on the first device information, which is used to manage the session connection between the first device and the second device.

The second device selects the first key generation algorithm from the N candidate key generation algorithms, and selects the target encryption algorithm from the M candidate encryption algorithms, and selects the first key generation algorithm, the target encryption algorithm, and the second device's The second device information generates a response message, where N>1 and M>1. The second device information includes at least one of the following: a MAC address, an IP address, a port number, a CPU model, a device model, a device serial number, a system version number, a timestamp, and a random number.

The second device determines a corresponding second key generation algorithm based on the first key generation algorithm, and determines a corresponding target decryption algorithm based on the target encryption algorithm.

Finally, the second device establishes an encryption/decryption algorithm correspondence between the unique identifier, the first key generation algorithm, the target encryption algorithm, the second key generation algorithm, and the target decryption algorithm corresponding to the first device, and stores them in the second device .

Step S203, the second device sends a response message to the first device.

Step S204, the first device performs encryption processing on the data to be processed based on the first key generation algorithm and the target encryption algorithm to obtain encrypted data.

Specifically, the first device generates an encryption key based on the first key generation algorithm, and then performs encryption processing on the data to be processed based on the encryption key and the target encryption algorithm to obtain encrypted data.

Step S205, the first device sends encrypted data to the second device.

Specifically, the first device sends the encrypted data and the third device information of the first device to the second device.

Step S206, the second device decrypts the encrypted data based on the second key generation algorithm and the target decryption algorithm to obtain data to be processed.

Specifically, if the first device information and the third device information meet the preset conditions, a decryption key is generated based on the second key generation algorithm, and then based on the decryption key and the target decryption algorithm, the encrypted data is decrypted to obtain the Data processing. The second device determines a second key generation algorithm corresponding to the first key generation algorithm and a target decryption algorithm corresponding to the target encryption algorithm according to the stored encryption and decryption algorithm correspondence.

If the first device information and the third device information do not meet the preset conditions, it means that the encrypted data sent by the first device is incorrect, or the session connection between the first device and the second device has timed out, and the second device directly discards the obtained data. Encrypted data.

The preset conditions that the first device information and the third device information satisfy include the following two:

If the first device information and the third device information are any one of MAC address, IP address, port number, CPU model, device model, device serial number, system version number and random number, the first device information and the third device information The preset condition that the device information satisfies is that the first device information is the same as the third device information.

If the first device information and the third device information are time stamps, the preset condition satisfied by the first device information and the third device information is the difference between the time stamp in the first device information and the time stamp in the third device information less than the preset value.

In this embodiment of the present application, the first device sends an encryption request to the second device, the second device generates a response message for the encryption request, and the second device sends the response message to the first device. The first device encrypts the data to be processed based on the first key generation algorithm and the target encryption algorithm, obtains encrypted data, and sends the encrypted data to the second device. The second device decrypts the encrypted data based on the second key generation algorithm and the target decryption algorithm to obtain data to be processed. Because the second device does not directly send the encryption key to the first device, but sends the first key generation algorithm and the target encryption algorithm, the communication security between the first device and the second device is effectively guaranteed.

Optionally, in the foregoing step S202, the candidate key generation algorithm may be a message digest algorithm selected according to requirements, such as an MD5 algorithm, a SHA algorithm, and the like. The length of the encryption key generated by the candidate key generation algorithm may be dynamically adjusted, such as 128 bits, 256 bits, and the like.

The encryption key generated by the candidate key generation algorithm can be a symmetric key or an asymmetric key. The candidate encryption algorithm may be a symmetric encryption algorithm, such as an AES algorithm (Advanced Encryption Standard), a TEA algorithm (Tiny Encryption Algorithm), etc.; or an asymmetric encryption algorithm, such as an RSA algorithm, an ECC algorithm (Ellipse Curve Ctyptography), and the like.

When the encryption key generated by the first key generation algorithm is a symmetric key, the target encryption algorithm is a symmetric encryption algorithm. The decryption key generated by the second key generation algorithm is the same as the encryption key. The target decryption algorithm is a symmetric decryption algorithm corresponding to the target encryption algorithm.

When the encryption key generated by the first key generation algorithm is an asymmetric key, the target encryption algorithm is an asymmetric encryption algorithm. The decryption key generated by the second key generation algorithm is an asymmetric key. The target decryption algorithm is an asymmetric decryption algorithm corresponding to the target encryption algorithm. The encryption key is used as the public key in the asymmetric key, and the decryption key is used as the private key in the asymmetric key.

Optionally, in the foregoing step S202, the second device generates a response message for the encryption request, including the following two possible implementation manners:

In Embodiment 1, the second device encapsulates the first key generation algorithm and the target encryption algorithm into a target encryption dynamic link library, wherein the target encryption dynamic link library includes an encryption key acquisition interface and a data encryption interface. A response message is then generated based on the target encrypted dynamic link library and the second device device information of the second device.

Specifically, the second device uses the first device information and the second device information as keys, the encryption key acquisition interface and the data encryption interface as values, and encapsulates the first key generation algorithm and the target encryption algorithm to obtain the target encryption dynamic link library.

The second device encapsulates the second key generation algorithm and the target decryption algorithm into a target decryption dynamic link library, and saves the target decryption dynamic link library in the second device, wherein the target decryption dynamic link library includes a decryption key acquisition interface and Data decryption interface.

In the embodiment of the present application, the second device encapsulates the first key generation algorithm and the target encryption algorithm into a target encryption dynamic link library, and the target encryption dynamic link library only provides an external interface, that is, an encryption key acquisition interface and a data encryption interface, The first key generation algorithm and the target encryption algorithm can be effectively hidden. At the same time, since the first key generation algorithm and the target encryption algorithm are encapsulated into a dynamic link library, the efficiency of subsequent loading of the dynamic link library by the first device can be effectively improved.

Embodiment 2: The second device encapsulates the first key generation algorithm as a first dynamic link library, and encapsulates the target encryption algorithm into a second dynamic link library, wherein the first dynamic link library includes an encryption key acquisition interface, and the second The dynamic link library includes a data encryption interface. A response message is then generated based on the first dynamic link library, the second dynamic link library and the second device information of the second device.

Specifically, the first device information and the second device information are used as keys, and the encryption key acquisition interface is used as a value, and the first key generation algorithm is encapsulated to obtain the first dynamic link library. The first device information and the second device information are used as keys, and the data encryption interface is used as a value, and the target encryption algorithm is encapsulated to obtain a second dynamic link library.

The second device encapsulates the second key generation algorithm into a third dynamic link library, and encapsulates the target decryption algorithm into a fourth dynamic link library, wherein the third dynamic link library includes a decryption key acquisition interface, and the fourth dynamic link library includes Data decryption interface.

In the embodiment of the present application, the first key generation algorithm is encapsulated into a first dynamic link library, and the target encryption algorithm is encapsulated into a second dynamic link library. The first dynamic link library only provides an encryption key acquisition interface, and the second The dynamic link library only provides a data encryption interface, which can effectively hide the first key generation algorithm and the target encryption algorithm. At the same time, since the first key generation algorithm and the target encryption algorithm are encapsulated as different dynamic link libraries, the possibility of obtaining the first key generation algorithm and the target encryption algorithm by cracking at the same time is reduced, and the relationship between the first device and the second encryption algorithm is enhanced. Two-device communication security.

Optionally, in the above step S203, the second device sends a response message to the first device, and after the first device receives the response message, two possible implementations are provided for parsing the response message:

In the first possible implementation manner, the first device saves the response message in the local disk, parses the response message in the local disk, obtains the target encrypted dynamic link library and the second device information of the second device, and then encrypts the target The dynamic link library is loaded into memory. Wherein, the target encryption dynamic link library includes a first key generation algorithm and a target encryption algorithm.

In this embodiment of the present application, the target encryption dynamic link library in the response message only includes the first key generation algorithm and the target encryption algorithm, but does not include the encryption key. Even if the first device encounters a network attack, encryption will not be caused. The leakage of the key effectively ensures the security of the communication between the first device and the second device.

In the second possible implementation manner, the first device loads the response message into the memory, and parses the response message in the memory to obtain the target encrypted dynamic link library and the second device information of the second device, wherein the target encrypted dynamic link The library includes a first key generation algorithm and a target encryption algorithm.

In this embodiment of the present application, the target encryption dynamic link library in the response message only includes the first key generation algorithm and the target encryption algorithm, but does not include the encryption key. Even if the first device encounters a network attack, encryption will not be caused. The leakage of the key effectively ensures the security of the communication between the first device and the second device. In this application, the first device directly loads the response message into the memory for parsing instead of parsing in the local disk, and no file is retained in the local disk, so the communication security of the first device can be further improved.

Optionally, after receiving the response message, the first device applies for a readable, writable and executable memory, loads the target encrypted dynamic link library into the memory, and then converts the target encrypted dynamic link library from the elf format by the method of dynamic loading. into the program format, that is, from the static file format to the running state format. The specific process is as follows:

Step S301, obtaining a target encrypted dynamic link library so.

Step S302, apply for a segment of memory, and apply for readable, writable, and executable permissions for the segment of memory.

Step S303, load the target encrypted dynamic link library so into the segment of memory.

Step S304, read the section header (section header) in the target encrypted dynamic link library so, and parse the target encrypted dynamic link library so according to the offset information of the section (section) in the section header to obtain section information.

Step S305: Read the segment header (segment header) in the target encrypted dynamic link library so, and parse the target encrypted dynamic link library so according to the offset information of the segment (segment) in the segment header to obtain segment information.

In step S306, it is judged whether the target encrypted dynamic link library so is linked with other dynamic link libraries, and if so, step S307 is executed; otherwise, the process ends.

In step S307, the other dynamic link libraries are loaded into the memory together, and the analysis is performed, and the process ends.

In the embodiment of the present application, the target encryption dynamic link library is loaded into the memory for analysis, which effectively avoids the leakage of the first key generation algorithm and the target encryption algorithm.

Optionally, in the above step S204, the first device performs encryption processing on the data to be processed based on the first key generation algorithm and the target encryption algorithm, and obtaining the encrypted data specifically includes the following steps:

Step S401, the first device obtains a first key generation algorithm by calling an encryption key acquisition interface, and uses the first key generation algorithm to generate an encryption key.

Specifically, the first device information and the second device information of the first device are used as input parameters of the encryption key acquisition interface, the encryption key acquisition interface is called, the first key generation algorithm is obtained, and the first key generation algorithm is adopted Generate encryption keys.

The input parameter may be any combination of the first device information and the second device information, which is not limited herein. For example, the input parameters may be the MAC address and port number in the first device information, and the IP address and CPU model in the second device information.

Step S402, the first device obtains the target encryption algorithm by invoking the data encryption interface, and encrypts the data to be processed based on the encryption key and the target encryption algorithm to obtain encrypted data.

Specifically, taking the encryption key as an input parameter of the data encryption interface, calling the data encryption interface to obtain the target encryption algorithm, and encrypting the data to be processed based on the encryption key and the target encryption algorithm to obtain the encrypted data.

In this embodiment of the present application, the first device obtains the first key generation algorithm by calling the encryption key acquisition interface, and uses the first key generation algorithm to generate the encryption key, instead of directly receiving the encryption key sent by the second device. key, effectively improving the security of the encryption key. The first device obtains the target encryption algorithm by calling the data encryption interface, and encrypts the data to be processed based on the encryption key and the target encryption algorithm to obtain encrypted data, instead of directly storing the target encryption algorithm by the first device, which can further ensure the data Encrypted security.

Optionally, in the above step S206, the second device decrypts the encrypted data based on the second key generation algorithm and the target decryption algorithm to obtain the data to be processed, which specifically includes the following steps:

Step S501, the second device obtains a second key generation algorithm by invoking the decryption key acquisition interface, and uses the second key generation algorithm to generate a decryption key.

Specifically, the second device uses the first device information and the second device information of the first device as input parameters of the decryption key acquisition interface, calls the decryption key acquisition interface, obtains the second key generation algorithm, and uses the second encryption key. The key generation algorithm generates the decryption key.

The input parameter may be any combination of the first device information and the second device information, which is not limited herein. For example, the input parameters may be the MAC address and port number in the first device information, and the IP address and CPU model in the second device information.

Step S502, the second device obtains the target decryption algorithm by invoking the data decryption interface, and decrypts the encrypted data based on the decryption key and the target decryption algorithm to obtain the data to be processed.

Specifically, the second device uses the decryption key as an input parameter of the data decryption interface, calls the data decryption interface, obtains the target decryption algorithm, and decrypts the encrypted data based on the decryption key and the target decryption algorithm to obtain the data to be processed.

In the embodiment of the present application, the second device obtains the second key generation algorithm by calling the decryption key acquisition interface, and uses the second key generation algorithm to generate the decryption key instead of directly storing the decryption key, which effectively improves the security of the decryption key. The second device obtains the target decryption algorithm by calling the data decryption interface, and decrypts the encrypted data based on the decryption key and the target decryption algorithm to obtain the data to be processed, instead of directly storing the target decryption algorithm by the second device, which can further ensure the security of encrypted data.

In order to better explain the embodiments of the present application, the following takes a specific implementation scenario as an example to introduce the flow of a session encryption method provided by the embodiments of the present application. In this method, the first device 101 and the second device 102 in FIG. 1 interact with each other. Execution, as shown in Figure 6, includes the following steps:

Step S601, the first device sends an encryption request to the second device, wherein the encryption request includes first device information of the first device.

Step S602, the second device selects the first key generation algorithm from the N candidate key generation algorithms.

Step S603, the second device selects a target encryption algorithm from the M candidate encryption algorithms.

Step S604, the second device encapsulates the first key generation algorithm and the target encryption algorithm into a target encryption dynamic link library.

Step S605, the second device generates a response message based on the target encrypted dynamic link library and the second device information of the second device.

Step S606, the second device sends a response message to the first device.

Step S607, the first device loads the response message into the memory, and parses the response message in the memory to obtain the target encrypted dynamic link library and the second device information of the second device. The target encryption dynamic link library includes an encryption key acquisition interface and a data encryption interface.

Step S608: Obtain the first key generation algorithm by calling the encryption key acquisition interface, and use the first key generation algorithm to generate the encryption key.

Step S609: Obtain the target encryption algorithm by invoking the data encryption interface, and perform encryption processing on the data to be processed based on the encryption key and the target encryption algorithm to obtain encrypted data.

Step S610, the first device sends the encrypted data and the third device information of the first device to the second device.

In step S611, the second device determines whether the first device information and the third device information satisfy the preset condition, and if so, executes step S612; otherwise, ends.

Step S612: Generate a decryption key based on a second key generation algorithm, where the second key generation algorithm corresponds to the first key generation algorithm.

Step S613: Decrypt the encrypted data based on the decryption key and the target decryption algorithm to obtain data to be processed, wherein the target decryption algorithm corresponds to the target encryption algorithm.

In the embodiment of the present application, because the second device does not directly send the encryption key to the first device, but sends the first key generation algorithm and the target encryption algorithm, the communication between the first device and the second device is effectively guaranteed Safety.

The second device encapsulates the first key generation algorithm and the target encryption algorithm into a target encryption dynamic link library, and the target encryption dynamic link library only provides external interfaces, that is, an encryption key acquisition interface and a data encryption interface, which can effectively hide the first encryption key. key generation algorithm and target encryption algorithm. At the same time, since the first key generation algorithm and the target encryption algorithm are encapsulated into a dynamic link library, the efficiency of subsequent loading of the dynamic link library by the first device can be effectively improved.

In this application, the first device directly loads the response message into the memory for parsing instead of parsing in the local disk, and no file is retained in the local disk, so the communication security of the first device can be further improved.

Based on the same technical concept, an embodiment of the present application provides an encryption device. As shown in FIG. 7 , the device 700 includes:

The first receiving module 701 is configured to receive a response message for an encryption request sent by a second device, where the encryption request is sent by the first device to the second device; the response message includes generated from N candidate keys The first key generation algorithm selected in the algorithm and the target encryption algorithm selected from the M candidate encryption algorithms; wherein, N>1, M>1;

An encryption module 702, configured to perform encryption processing on the data to be processed based on the first key generation algorithm and the target encryption algorithm to obtain encrypted data;

The first sending module 703 is configured to send the encrypted data to the second device, so that the second device decrypts the encrypted data based on the second key generation algorithm and the target decryption algorithm, and obtains the Data to be processed; the second key generation algorithm corresponds to the first key generation algorithm, and the target decryption algorithm corresponds to the target encryption algorithm.

Optionally, it also includes a parsing module 704, and the parsing module 704 is specifically used for:

After receiving the response message for the encryption request sent by the second device, the response message is loaded into the memory, and the response message is parsed in the memory to obtain a target encrypted dynamic link library, wherein the The target encryption dynamic link library includes the first key generation algorithm and the target encryption algorithm.

Optionally, the target encryption dynamic link library also includes an encryption key acquisition interface and a data encryption interface;

The encryption module 702 is specifically used for:

Obtain the first key generation algorithm by invoking the encryption key acquisition interface, and use the first key generation algorithm to generate an encryption key;

By invoking the data encryption interface, the target encryption algorithm is obtained, and the data to be processed is encrypted based on the encryption key and the target encryption algorithm to obtain encrypted data.

Optionally, the response message further includes second device information of the second device;

The encryption module 702 is specifically used for:

The first device information and the second device information of the first device are used as input parameters of the encryption key acquisition interface, and the encryption key acquisition interface is called to obtain the first key generation algorithm;

The pass-through encryption module 702 is specifically used for:

Using the encryption key as an input parameter of the data encryption interface, call the data encryption interface to obtain the target encryption algorithm.

Based on the same technical concept, an embodiment of the present application provides an encryption device. As shown in FIG. 8 , the device 800 includes:

The second receiving module 801 is configured to receive an encryption request sent by a first device, and generate a response message for the encryption request, where the response message includes a first key generation algorithm selected from N candidate key generation algorithms and a The target encryption algorithm selected from M candidate encryption algorithms, where N>1, M>1;

The second sending module 802 is configured to send the response message to the first device, so that the first device encrypts the data to be processed based on the first key generation algorithm and the target encryption algorithm, and obtains encrypted data;

The decryption module 803 is configured to receive the encrypted data sent by the first device, and perform decryption processing on the encrypted data based on the second key generation algorithm and the target decryption algorithm to obtain the data to be processed; The key generation algorithm corresponds to the first key generation algorithm, and the target decryption algorithm corresponds to the target encryption algorithm.

Optionally, the second receiving module 801 is specifically configured to:

Encapsulating the first key generation algorithm and the target encryption algorithm into a target encryption dynamic link library, wherein the target encryption dynamic link library includes an encryption key acquisition interface and a data encryption interface;

The response message is generated based on the target encrypted dynamic link library and the second device information of the second device.

Optionally, the encryption request includes first device information of the first device;

The second receiving module 801 is specifically used for:

Using the first device information and the second device information as keys, and the encryption key acquisition interface and the data encryption interface as values, perform the first key generation algorithm and the target encryption algorithm. package to obtain the target encrypted dynamic link library.

Optionally, the decryption module 803 is specifically used for:

receiving encrypted data sent by the first device and third device information of the first device;

If the first device information and the third device information meet a preset condition, generating a decryption key based on the second key generation algorithm;

Based on the decryption key and the target decryption algorithm, decrypt the encrypted data to obtain the data to be processed.

Based on the same technical concept, an embodiment of the present application provides a computer device. The computer device may be a terminal or a server, as shown in FIG. 9 , and includes at least one processor 901 and a memory 902 connected to the at least one processor. The specific connection medium between the processor 901 and the memory 902 is not limited in the application embodiments. In FIG. 9 , the connection between the processor 901 and the memory 902 is taken as an example through a bus. The bus can be divided into address bus, data bus, control bus and so on.

In this embodiment of the present application, the memory 902 stores instructions that can be executed by at least one processor 901 , and the at least one processor 901 can execute the steps included in the foregoing encryption method by executing the instructions stored in the memory 902 .

The processor 901 is the control center of the computer equipment, and can use various interfaces and lines to connect various parts of the computer equipment, and encrypt by running or executing the instructions stored in the memory 902 and calling the data stored in the memory 902. . Optionally, the processor 901 may include one or more processing units, and the processor 901 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, etc., and the modem The modulation processor mainly handles wireless communication. It can be understood that, the above-mentioned modulation and demodulation processor may not be integrated into the processor 901. In some embodiments, the processor 901 and the memory 902 may be implemented on the same chip, and in some embodiments, they may be implemented separately on separate chips.

The processor 901 may be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application specific integrated circuit (ASIC), a field programmable gate array or other programmable logic devices, discrete gates or transistors Logic devices and discrete hardware components can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. A general purpose processor may be a microprocessor or any conventional processor or the like. The steps of the methods disclosed in conjunction with the embodiments of the present application may be directly embodied as executed by a hardware processor, or executed by a combination of hardware and software modules in the processor.

The memory 902, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs and modules. The memory 902 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a Programmable Read Only Memory (PROM), Read Only Memory (ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Magnetic Memory, Disk, CD and so on. Memory 902 is, but is not limited to, any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer. The memory 902 in this embodiment of the present application may also be a circuit or any other device capable of implementing a storage function, for storing program instructions and/or data.

Based on the same inventive concept, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program executable by a computer device, and when the program runs on the computer device, causes the computer device to execute the steps of the above encryption method.

As will be appreciated by those skilled in the art, the embodiments of the present application may be provided as a method, a system, or a computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to the present application. It will be understood that each flow and/or block in the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to the processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing device to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing device produce Means for implementing the functions specified in a flow or flow of a flowchart and/or a block or blocks of a block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory result in an article of manufacture comprising instruction means, the instructions The apparatus implements the functions specified in the flow or flow of the flowcharts and/or the block or blocks of the block diagrams.

These computer program instructions can also be loaded on a computer or other programmable data processing device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process such that The instructions provide steps for implementing the functions specified in the flow or blocks of the flowcharts and/or the block or blocks of the block diagrams.

Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims (12)

1. an encryption method, applied to the first equipment, is characterized in that, comprises: Receive a response message for an encryption request sent by a second device, where the encryption request is sent by the first device to the second device; the response message includes a first selected from N candidate key generation algorithms The key generation algorithm and the target encryption algorithm selected from M candidate encryption algorithms; wherein, N>1, M>1; Encrypt the data to be processed based on the first key generation algorithm and the target encryption algorithm to obtain encrypted data; sending the encrypted data to the second device, so that the second device decrypts the encrypted data based on the second key generation algorithm and the target decryption algorithm to obtain the data to be processed; the second The key generation algorithm corresponds to the first key generation algorithm, and the target decryption algorithm corresponds to the target encryption algorithm. 2. The method according to claim 1, wherein after receiving the response message for the encryption request sent by the second device, the method further comprises: The response message is loaded into the memory, and the response message is parsed in the memory to obtain a target encrypted dynamic link library, wherein the target encrypted dynamic link library includes the first key generation algorithm and the Describe the target encryption algorithm. 3. The method of claim 2, wherein the target encryption dynamic link library further comprises an encryption key acquisition interface and a data encryption interface; The performing encryption processing on the data to be processed based on the first key generation algorithm and the target encryption algorithm to obtain encrypted data, including: Obtain the first key generation algorithm by invoking the encryption key acquisition interface, and use the first key generation algorithm to generate an encryption key; The target encryption algorithm is obtained by invoking the data encryption interface, and the data to be processed is encrypted based on the encryption key and the target encryption algorithm to obtain the encrypted data. 4. The method of claim 3, wherein the response message further comprises second device information of the second device; The obtaining the first key generation algorithm by invoking the encryption key obtaining interface includes: The first device information and the second device information of the first device are used as input parameters of the encryption key acquisition interface, and the encryption key acquisition interface is called to obtain the first key generation algorithm; The obtaining the target encryption algorithm by invoking the data encryption interface includes: Using the encryption key as an input parameter of the data encryption interface, call the data encryption interface to obtain the target encryption algorithm. 5. An encryption method, applied to the second device, is characterized in that, comprising: Receive an encryption request sent by the first device, and generate a response message for the encryption request, where the response message includes a first key generation algorithm selected from N candidate key generation algorithms and a first key generation algorithm selected from M candidate encryption algorithms The target encryption algorithm of , where N>1, M>1; sending the response message to the first device, so that the first device encrypts the data to be processed based on the first key generation algorithm and the target encryption algorithm to obtain encrypted data; Receive the encrypted data sent by the first device, and decrypt the encrypted data based on the second key generation algorithm and the target decryption algorithm to obtain the data to be processed; the second key generation algorithm and the The first key generation algorithm corresponds to the target decryption algorithm, and the target encryption algorithm corresponds to the target encryption algorithm. 6. The method of claim 5, wherein the generating a response message for the encryption request comprises: Encapsulating the first key generation algorithm and the target encryption algorithm into a target encryption dynamic link library, wherein the target encryption dynamic link library includes an encryption key acquisition interface and a data encryption interface; The response message is generated based on the target encrypted dynamic link library and the second device information of the second device. 7. The method of claim 6, wherein the encryption request includes first device information of the first device; Described encapsulating the first key generation algorithm and the target encryption algorithm into a target encryption dynamic link library, including: Using the first device information and the second device information as keys, and the encryption key acquisition interface and the data encryption interface as values, perform the first key generation algorithm and the target encryption algorithm. package to obtain the target encrypted dynamic link library. 8. The method according to claim 7, wherein the receiving encrypted data sent by the first device, and performing decryption processing on the encrypted data based on the second key generation algorithm and the target decryption algorithm to obtain The data to be processed includes: receiving encrypted data sent by the first device and third device information of the first device; If the first device information and the third device information meet a preset condition, generating a decryption key based on the second key generation algorithm; Based on the decryption key and the target decryption algorithm, decrypt the encrypted data to obtain the data to be processed. 9. An encryption device, characterized in that, comprising: a first receiving module, for receiving a response message for an encryption request sent by a second device, where the encryption request is sent by the first device to the second device; the response message includes an algorithm generated from N candidate keys The first key generation algorithm selected in and the target encryption algorithm selected from M candidate encryption algorithms; wherein, N>1, M>1; an encryption module, configured to perform encryption processing on the data to be processed based on the first key generation algorithm and the target encryption algorithm to obtain encrypted data; A first sending module, configured to send the encrypted data to the second device, so that the second device decrypts the encrypted data based on the second key generation algorithm and the target decryption algorithm, and obtains the to-be-decrypted data. processing data; the second key generation algorithm corresponds to the first key generation algorithm, and the target decryption algorithm corresponds to the target encryption algorithm. 10. An encryption device, comprising: The second receiving module is configured to receive an encryption request sent by the first device, and generate a response message for the encryption request, where the response message includes a first key generation algorithm selected from N candidate key generation algorithms and a The target encryption algorithm selected from the M candidate encryption algorithms, where N>1, M>1; a second sending module, configured to send the response message to the first device, so that the first device encrypts the data to be processed based on the first key generation algorithm and the target encryption algorithm to obtain encrypted data data; a decryption module, configured to receive the encrypted data sent by the first device, and decrypt the encrypted data based on the second key generation algorithm and the target decryption algorithm to obtain the data to be processed; the second key The generation algorithm corresponds to the first key generation algorithm, and the target decryption algorithm corresponds to the target encryption algorithm. 11. A computer device, comprising a memory, a processor and a computer program stored in the memory and running on the processor, wherein the processor implements any one of claims 1 to 8 when executing the program. steps of the method described. 12. A computer-readable storage medium, characterized in that it stores a computer program executable by a computer device, and when the program runs on the computer device, the computer device is made to execute any one of claims 1 to 8. steps of the method described.

Images