CN118821183A - Data security access method and system based on encryption algorithm - Google Patents

Abstract

The invention relates to a data security access method and system based on encryption algorithm, a service end applies for a secret key; the data safe generates a key pair A and a key certificate A; the service end sends storage data comprising service data; the data safe generates a key pair B and a data certificate B; splicing the key certificate A and the data certificate B to obtain an encrypted character string, encrypting service data by using the public key B and the AES algorithm to obtain encrypted data C, and configuring an AES key value by using the encrypted character string as an encryption vector value; adding salt to the key certificate A and the data certificate B by using an MD5 algorithm to obtain a character string MD5DataKey, storing the character string MD5 under a corresponding table of a database, and then returning the data certificate B to a service end; the extraction of the service data is the inverse of the above process. And various encryption modes are used, so that the secret key is encrypted, and the service data is encrypted in two layers, thereby ensuring the safety of the service data.

Description

Data security access method and system based on encryption algorithm

Technical Field

The present invention relates to the field of data encryption, and in particular to a data security access method and system based on encryption algorithm.

Background Art

Government procurement malls have a variety of transaction methods. Unlike mature e-mall markets (such as JD.com and Taobao), users can directly place orders for goods listed by merchants. Government procurement has clearer legal requirements and implementation specifications for both buyers and sellers.

The current government procurement e-mall has a variety of transaction methods such as direct purchase, online bidding, and online inquiry. Users are divided into two roles: purchasers and suppliers, corresponding to buyers and sellers. Taking online bidding as an example, it has strict transaction processes and time nodes, requiring purchasers to enter information such as commodity demand, purchase quantity, and purchase budget in advance to form a purchase project, and then publish a procurement announcement to the outside world. Suppliers match and register according to the procurement announcement and participate in the project. When the time node arrives for the supplier to quote, the supplier logs in to the system to participate in the quotation of the project. Suppliers can make multiple rounds of quotations within the quotation time. The quotation information suppliers are kept confidential from each other, and the bidding information will not be displayed in the system. When the quotation time is over, the system summarizes the last quotation information of all suppliers, takes the lowest price as the successful supplier, and publishes the procurement result announcement to the outside world. Subsequently, a series of processes such as contract signing, delivery, and payment are carried out between the purchaser and the successful supplier.

With the continuous improvement of network security requirements, and in order to prevent collusion between people inside and outside the system, the existing code stores quotation information in plain text in the database, and only hides it when it is displayed to the outside. This method obviously has shortcomings. External attackers can obtain quotation information through illegal means, and even internal personnel who are familiar with the database table can easily obtain quotation information and provide it to suppliers, allowing them to close the deal at a price that is a small amount lower than the current lowest quotation.

Therefore, we want to use an encryption scheme to encrypt and store the quotation information, and only decrypt the data when the transaction is completed. Before the transaction is completed, the data cannot be obtained by the supplier through abnormal means, including preventing external attackers from obtaining the bidding information through illegal means, preventing R&D personnel from reversely decrypting the bidding information through code logic, and preventing implementation and maintenance personnel who are familiar with the database table from checking the database to obtain the bidding information.

Summary of the invention

The purpose of the present invention is to provide a data security access method and system based on encryption algorithm, which adopts a dynamic, mixed and configurable way of multiple encryption algorithms to encrypt data, and can also be combined with business data to achieve the effect of data security access.

The present invention is implemented through the following technical solutions: a data security access method based on an encryption algorithm, the main body of which is a data safe, which is connected to a business end and a database respectively;

The storage process of business data is:

Step 1: The business end applies for a key from the data safe with the business end information;

Step 2: The data safe verifies the legitimacy of the business end information. After the verification is passed, the encryption algorithm is used to generate a key pair of public key A, private key A and key certificate A associated with the key. The key certificate A is encrypted using MD5 to obtain the encrypted key certificate A1. The encrypted key certificate A1, public key A and private key A are then stored in the database, and the key certificate A is returned to the business end. The business end obtains the key certificate A and stores it in association with the business data.

Step 3: The business end sends the storage data to the data safe with the business end information and key certificate A. The storage data includes the data storage expiration time, the relevant user list, the unit information and the business data that needs to be encrypted;

Step 4: The data safe verifies the legitimacy of the business end information. After the verification is passed, the encryption algorithm is used to generate a key pair of public key B, private key B and key-associated data certificate B. The data certificate B is encrypted using MD5 to obtain the encrypted data certificate B1, and then the encrypted data certificate B1, public key B and private key B are stored in the database;

Step 5: The data safe concatenates key certificate A and data certificate B to obtain a concatenated certificate, and then uses the MD5 algorithm to encrypt the concatenated certificate to obtain an encrypted string md5Key. Then, the business data is first encrypted using public key B to obtain encrypted data B, and then the encrypted data B is encrypted again using the AES symmetric encryption algorithm to obtain encrypted data C. At the same time, the AES key value is configured and the encrypted string md5Key is associated as the encryption vector value of the encrypted data C. Finally, the encrypted data C, data storage expiration time, relevant user list, and unit information are stored in the database.

Step 6: Use the MD5 algorithm to perform salt operation on the key certificate A and the data certificate B to obtain the string md5DataKey and store it in the table of encrypted data C in the database, and then return the data certificate B to the business end, and the business end saves the data certificate B;

The process of extracting business data is as follows:

Step 7: The business end applies to the data safe for data acquisition by carrying the business end information, key certificate A and data certificate B saved during the storage process;

Step 8: The data safe verifies the legitimacy of the business end information. After the verification is passed, the MD5 algorithm is used to perform salt operation on the key certificate A and the data certificate B to obtain the string md5DataKey. The string md5DataKey is used to locate the table storing the encrypted data C in the database and retrieve the encrypted data C.

Step 9: The data safe concatenates the key certificate A and the data certificate B, and calculates the encrypted string md5Key using the MD5 algorithm. The encrypted data C is decrypted into the encrypted data B using md5Key as the encryption vector value of the AES symmetric encryption algorithm.

Step 10, the data safe uses data certificate B to obtain encrypted data certificate B1 through MD5 encryption, retrieves the private key B associated with encrypted data certificate B1 from the database, uses private key B to decrypt encrypted data B to obtain business data, and finally sends the business data to the business end.

A data security access system based on encryption algorithm, the main body of which is a data safe, which includes:

Verification module, which verifies the legitimacy of business-side information when the business-side accesses the data safe;

A data access module, used to store the received data into a database or extract corresponding data from the database;

A key module, used to distribute keys to the business end, and save the keys of the business end to the corresponding location in the database through the data access module; and

The encryption and decryption module is used to encrypt key credentials and business data, and save the encrypted data to the corresponding location in the database through the data access module.

Compared with the previous technology, the beneficial effects of the present invention are:

1. The present invention uses a mixture of multiple encryption methods to encrypt both the key and the business data.

For the business side, although they have two keys (two tokens), they do not know the real encryption key, and R&D personnel cannot decrypt the data by themselves.

For the data safe, although the encrypted data and the corresponding keys are stored, since the two tokens are retained by the business party, it is impossible to know the association between the key and the data, and it is impossible to decrypt the data by itself.

In addition, for operation and maintenance personnel, data (including two tokens) are encrypted and stored in the data safe according to certain rules. There is no explicit association relationship, and its association relationship cannot be directly obtained through the joint table, which increases the difficulty of data cracking.

2. The present invention adopts the tenant form, and the encryption algorithms between tenants can be flexibly configured. At the same time, for each business data, the encryption key is dynamically generated, one data one key, and it is highly dynamic.

3. The present invention has strong expansibility. On the basis of the present technical solution, the dynamic nature of the key and the security of encryption (such as increasing the number of encryption layers) can be further expanded to further ensure the data security level.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a flow chart of a data security access method based on an encryption algorithm;

FIG2 is a block diagram of a data security access system based on an encryption algorithm;

FIG3 is a flow chart of the first stage of the online bidding project;

Figure 4 is a flow chart of the online bidding project phase 2;

FIG. 5 is a flow chart of the third stage of the online bidding project.

DETAILED DESCRIPTION

The present invention is described in detail below in conjunction with the accompanying drawings, but the protection content of the present invention is not limited to the following:

As shown in FIG1 , the data security access method based on the encryption algorithm has a data safe as the main body, which is connected to the business end and the database respectively;

The storage process of business data is:

Step 1: The business end applies for a key from the data safe with the business end information;

Step 2: The data safe verifies the legitimacy of the business end information. After the verification is passed, the encryption algorithm is used to generate a key pair of public key A, private key A and key certificate A associated with the key. The key certificate A is encrypted using MD5 to obtain the encrypted key certificate A1. The encrypted key certificate A1, public key A and private key A are then stored in the database, and the key certificate A is returned to the business end. The business end obtains the key certificate A and stores it in association with the business data.

Step 3: The business end sends the storage data to the data safe with the business end information and key certificate A. The storage data includes the data storage expiration time, the relevant user list, the unit information and the business data that needs to be encrypted;

Step 4: The data safe verifies the legitimacy of the business end information. After the verification is passed, the encryption algorithm is used to generate a key pair of public key B, private key B and key-associated data certificate B. The data certificate B is encrypted using MD5 to obtain the encrypted data certificate B1, and then the encrypted data certificate B1, public key B and private key B are stored in the database;

Step 5: The data safe concatenates key certificate A and data certificate B to obtain a concatenated certificate, and then uses the MD5 algorithm to encrypt the concatenated certificate to obtain an encrypted string md5Key. Then, the business data is first encrypted using public key B to obtain encrypted data B, and then the encrypted data B is encrypted again using the AES symmetric encryption algorithm to obtain encrypted data C. At the same time, the AES key value is configured and the encrypted string md5Key is associated as the encryption vector value of the encrypted data C. Finally, the encrypted data C, data storage expiration time, relevant user list, and unit information are stored in the database.

Step 6: Use the MD5 algorithm to perform salt operation on the key certificate A and the data certificate B to obtain the string md5DataKey and store it in the table of encrypted data C in the database, and then return the data certificate B to the business end, and the business end saves the data certificate B;

The process of extracting business data is as follows:

Step 7: The business end applies to the data safe for data acquisition by carrying the business end information, key certificate A and data certificate B saved during the storage process;

Step 8: The data safe verifies the legitimacy of the business end information. After the verification is passed, the MD5 algorithm is used to perform salt operation on the key certificate A and the data certificate B to obtain the string md5DataKey. The string md5DataKey is used to locate the table storing the encrypted data C in the database and retrieve the encrypted data C.

Step 9: The data safe concatenates the key certificate A and the data certificate B, and calculates the encrypted string md5Key using the MD5 algorithm. The encrypted data C is decrypted into the encrypted data B using md5Key as the encryption vector value of the AES symmetric encryption algorithm.

Step 10, the data safe uses data certificate B to obtain encrypted data certificate B1 through MD5 encryption, retrieves the private key B associated with encrypted data certificate B1 from the database, uses private key B to decrypt encrypted data B to obtain business data, and finally sends the business data to the business end.

It should be noted that the key pair public key A and private key A generated in step 2 are neither used in the storage process of business data nor in the extraction process of business data. They can have a confusing effect when others steal data, further prevent the leakage of business data, and thus improve the security of this algorithm.

In the present invention, the data safe operates as an independent module, provides an entry to the outside in the form of an interface and uses the tenant concept for business data access. Taking an online bidding project as an example, after the project is initiated, when the purchaser logs in to the user system, creates a new online bidding project, enters the procurement requirements and publishes a procurement notice, the business data storage process is entered.

Furthermore, the encryption algorithm is the SM2 algorithm.

In step 2, use the SM2 algorithm to generate the key pair sm2PubA, sm2PriA and the key certificate keyToken associated with the key;

In step 4, the SM2 algorithm is used to generate the key pair sm2PubB, sm2PriB and the data certificate dataToken associated with the key.

Furthermore, the public key, private key and key certificate generated by the SM2 algorithm are stored in the pub_key, pri_key and token fields at the corresponding positions in the database key table respectively;

Among them, sm2PubA and sm2PubB are stored in pub_key, sm2PriA and sm2PriB are stored in pri_key, and the key certificate keyToken and the data certificate dataToken are stored in token; the key table structure is as follows:

Serial number Fields type Not empty describe 1 id String Y Primary key id 2 token String Y Credentials (key credentials and data credentials), stored after being encrypted with MD5 3 pub_key String Y Public Key 4 pri_key String Y Private Key

The token field data in the key table is not stored in plain text, but encrypted by the MD5 algorithm before being stored in the key table in the database. This method avoids storing plain text tokens in the key table and avoids joint table queries, further increasing the difficulty of cracking passwords. The key certificate A and data certificate B returned by the data safe to the business end are both in plain text. The key certificate keyToken and the data certificate dataToken are both in 36-bit uuid format;

Furthermore, the token in the key table is a key credential, which is used to associate the key data of the response, that is, each time a public-private key pair is generated, a unique token will be generated and associated with it. Pub_key and pri_key store the generated public-private key pairs respectively.

Furthermore, if the encryption algorithm is a symmetric encryption algorithm, its key and the corresponding salt vector are stored. Salting means combining a randomly generated data (called salt, or Salt) with the original data (such as a password) before performing a hash operation to increase the complexity of the hash value. This can effectively prevent rainbow table attacks and other forms of hash collision attacks.

Furthermore, in step 10, using the data voucher B to retrieve the private key B associated therewith from the database also includes the following process:

The data safe uses the MD5 algorithm to calculate the data certificate B to obtain the certificate string, and uses the certificate string to find the private key B associated with it from the database.

The business end information includes the tenant id, tenant password and business identification code. It corresponds to the app_Key_Id, app_Key_Secret and biz_code fields stored in the tenant information table in the database; in addition, the algorithm_code in the table refers to the encryption and decryption algorithm for encrypting and decrypting data, which refers to the AES algorithm for encrypting and decrypting business data in the present invention, and the key_algorithm_code refers to the SM2 algorithm for the encryption key. The tenant information table structure is as follows:

Furthermore, there is no strict control over the granularity of tenants here. A system can be a tenant, a business module can be a tenant, or even a piece of business data can be a tenant. The granularity is agreed upon by the business data party.

Furthermore, the stored data is saved in a data table in the database, biz_content is used to store encrypted business data, storage_time stores the data storage expiration time of the business data (this field is in some business scenarios, when the time node reaches this time, there is no need to verify the legitimacy, but directly decrypt the data), user_id is the list of related users, org_id is the unit information, biz_detail is the unique data value generated according to certain rules (here it refers to the encrypted string md5Key obtained by splicing the two key credentials keyToken and dataToken through the MD5 algorithm).

Furthermore, the role of the data storage expiration time is as follows: when requesting to obtain data from the data safe in the subsequent process, the request parameters will carry relevant information of the requesting user, such as the user ID, the user's unit, etc. (this part of data is generated after the user logs into the system). When the data safe receives the retrieval request, it will first verify whether the data storage expiration time is later than the current request time. If so, the data is considered expired, and its user information will not be verified when the data is retrieved. Otherwise, the user information will be taken from the request parameters and compared with the user information stored in the safe for verification. Only when the comparison is consistent can the data be retrieved;

The table structure of the data table is as follows:

Furthermore, in step 6, combined with the SM2 algorithm, the biz_detail column of the data table is filled after the data is stored in the database. The filling rule is: use the MD5 algorithm to perform salt operations on the key certificate keyToken and the data certificate dataToken, obtain the string md5dataKey, and fill the md5dataKey into the biz_detail column. In this way, there is no explicit association between the key table and the data table, and relevant personnel with database operation permissions such as implementation and maintenance cannot use the joint table method to perform data association queries. In addition, due to the irreversible nature of the MD5 algorithm, it is impossible to obtain the corresponding key certificate keyToken and data certificate dataToken through reverse, and finally the data certificate dataToken can be returned to the business end.

Furthermore, the operation of configuring the AES key value in step 5 is to set a fixed string as the AES key value or to establish a new table to dynamically configure the AES key value.

It should be noted that in the present invention, based on the requirements of basic information configuration and encrypted data storage, the table structures that need to be maintained in the database are the key table, tenant information table and data table mentioned above. The database also has table structures such as business identification table and encryption algorithm table.

Business identification table: Different businesses will have different identifications. For example, online bidding business can be further divided into non-fixed-point online bidding projects (such as laptop computers, copy paper and other commodities) and fixed-point bidding projects (such as property management services, vehicle refueling, decoration projects and other non-commodity projects). For unified planning and management, it is required to configure the corresponding identification in this table and carry the identification when the business end requests. The data safe will verify whether the identification is in this table. Only in this table will the request be allowed. The table structure is as follows:

Encryption algorithm table: used to configure the data safe's encryption algorithm, such as SM2 algorithm, RSA algorithm, AES algorithm, etc. The table structure is as follows:

As shown in FIG2 , a data security access system based on an encryption algorithm, the main body of which is a data safe, includes:

Verification module, which verifies the legitimacy of business-side information when the business-side accesses the data safe;

A data access module, used to store the received data into a database or extract corresponding data from the database;

A key module, used to distribute keys to the business end, and save the keys of the business end to the corresponding location in the database through the data access module; and

The encryption and decryption module is used to encrypt key credentials and business data, and save the encrypted data to the corresponding location in the database through the data access module.

Furthermore, a key application interface, a data storage interface and a data acquisition interface are provided between the business end, the data safe and the database. The present invention realizes encrypted access of data according to the key application interface, the data storage interface and the data acquisition interface and the internal table structure of the database.

Among them, the key application interface is used by the business end to apply for encryption and decryption keys, the data storage interface is used by the business end to store data, and the data acquisition interface is used by the business end to obtain stored data.

It should be noted that the access order of the service end to access the system through the key application interface is service end, verification module, key module, data access module, database;

The order in which the business end accesses the system through the data storage interface is business end, verification module, encryption and decryption module, key module, encryption and decryption module, data access module, and database;

The access order of the business end to the system through the data acquisition interface is business end, verification module, database, data access module, encryption and decryption module, and business end.

In summary, the present invention can provide a business scenario case description:

When a designated service online bidding project is initiated, the purchaser fills in the procurement requirements and initiates the bidding project. After the project is successfully initiated, a procurement announcement will be released to the public. Each supplier (i.e., each tenant) will register for product matching for the project according to the time node specified in the procurement announcement and make multiple quotations during the bidding period.

After the quotation is completed, the last quotation of each supplier will be taken as the basis, the supplier with the lowest price will be the winning supplier, the procurement result announcement will be released, and the project will be completed.

The overall process of online bidding projects can be divided into three stages:

Phase 1: The purchaser initiates the project, as shown in Figure 3.

The purchaser logs into the system, creates a new online bidding project, enters the brand, specification and model of the goods or services to be purchased, and the corresponding purchase budget (the highest expected transaction price) and other information. After completing the entry, the purchase notice is issued and the supplier is awaiting matching quotations.

In this stage, the supplier logs in to the system as a tenant and applies for a key from the data safe. The data safe verifies its tenant ID, tenant password, and the business identification code of the participating project, and generates a key and key certificate (keyToken) after confirmation. The data safe issues the keyToken to this bidding project as the only certificate for the entire bidding project process. At the same time, the bidding project business end associates the keyToken and saves it in the corresponding table structure in the database.

Phase 2: Supplier registration and quotation phase, as shown in Figure 4.

(This stage corresponds to the storage process of the business data of the present invention).

As tenants, multiple suppliers participate in the registration and make quotations in the quotation stage according to the requirements of the bidding project procurement announcement. When suppliers make quotations, they log in to the system and fill in the price under the project. The system carries the supplier user information, quotation information, data storage expiration time (the time here is the end time of the bidding project quotation) and the project's unique key certificate (keyToken) and other information to initiate a data storage application to the data safe. The data safe generates a key and data certificate (dataToken) based on the supplier's quotation information.

At the same time, the data safe encrypts the bidding data of each supplier according to the generated key, keyToken and dataToken and the methods described in steps 5 and 6 of the present invention, and stores each information in the corresponding table structure in the database. Also stored together are the supplier user information and the data storage expiration time. Then, the data safe issues the data certificate (dataToken) to the bidding project business end. The bidding project business end associates the dataToken with the supplier information, project information, and quotation information (at this time, the quotation information fill value of the project details table is 0, and the real data is encrypted and stored in the data safe) and stores them in the corresponding table structure in the database. Moreover, each supplier corresponds to a quotation detail information and holds its own data certificate dataToken separately.

During the project quotation period, each supplier can view their own quoted bidding information and modify the quotation. Since the expiration time of the quotation information stored in the data safe during the quotation stage has not expired, when a supplier applies to the data safe to view their own quoted bidding information, it is necessary to verify whether the identity of the applicant supplier is consistent with the user information stored in the data table. Only when they are consistent can the bidding information be viewed.

Phase 3: Transaction phase, as shown in Figure 5.

(This stage corresponds to the business data extraction process of the present invention).

During the project transaction phase (i.e. after the quotation is completed), the bidding project business end will uniformly carry the project's unique key certificate keyToken and the data certificate dataToken of all quotation suppliers to the data safe to apply for all quotation information of this project. Since this is a system operation, it is impossible to carry the user information of each supplier (the user information is generated after the user logs into the system). However, since the expiration time of the quotation data storage of this project is later than the current time at this time, the data safe will not verify its user information. The system then automatically carries the keyToken and dataToken to access the data safe, and combines the methods of steps 6 to 10 in the present invention to decrypt the bidding information and return it to the business end. After receiving the bidding information, the business end will put the data of the bidding information into the price field of the project quotation details table, replacing the 0 value filled in stage two.

Finally, the system takes out all the quotation information for summary calculation, confirms the winning supplier and publishes the project transaction result announcement.

Although the present invention is illustrated and described by specific embodiments and their alternatives, it should be understood that various changes and modifications within the spirit and scope of the present invention can be implemented. Therefore, it should be understood that the present invention is not limited in any sense except by the limitations of the attached claims and their equivalents.

Claims (6)

1. The data security access method based on the encryption algorithm is characterized in that the main body is a data safe which is respectively connected with a service end and a database;

the storage process of the service data is as follows:

Step 1, a service end carries service end information and applies a secret key to a data safe;

step 2, the data safe performs validity verification on the information of the service end, after the verification is passed, an encryption algorithm is used for generating a key pair public key A, a key pair private key A and a key certificate A related to the key, the key certificate A is encrypted by using MD5 to obtain an encryption key certificate A1, the public key A and the key private key A are stored in a database, the key certificate A is returned to the service end, and the service end acquires the key certificate A and stores the key certificate A and service data in a related manner;

step 3, the service end carries service end information and the key certificate A sends storage data to the data safe, wherein the storage data comprises data storage expiration time, related user lists, unit information and service data needing encryption;

Step 4, the data safe performs validity verification on the service end information, after verification, an encryption algorithm is used for generating a key pair public key B, a key pair private key B and a data certificate B related to the key, the data certificate B is encrypted by using MD5 to obtain an encrypted data certificate B1, and then the encrypted data certificate B1, the public key B and the key private B are stored in a database;

Step 5, the data safe splice Key certificate A and the data certificate B are obtained to obtain a splice certificate, then the MD5 algorithm is used for encrypting the splice certificate to obtain an encrypted character string MD5Key, then the public Key B is used for encrypting service data for the first time to obtain encrypted data B, the AES symmetric encryption algorithm is used for encrypting the encrypted data B again to obtain encrypted data C, and meanwhile, an AES Key value is configured and the encrypted character string MD5Key is correlated to be used as an encryption vector value of the encrypted data C; finally, storing the encrypted data C, the data storage expiration time, the related user list and the unit information into a database;

Step 6, performing salt adding operation on the key certificate A and the data certificate B by using an MD5 algorithm to obtain a character string MD5DataKey, storing the character string MD5DataKey under a table of encrypted data C in a database, and then returning the data certificate B to a service end, wherein the service end stores the data certificate B;

The extraction process of the service data comprises the following steps:

Step 7, the service end carries service end information, and the key certificate A and the data certificate B stored in the storage process apply for obtaining data from the data safe;

Step 8, the data safe performs validity verification on the service end information, after the verification is passed, the MD5 algorithm is used for carrying out salifying operation on the key certificate A and the data certificate B to obtain a character string MD5DataKey, and the character string MD5DataKey is used for positioning a table storing encrypted data C in a database to take out the encrypted data C;

Step 9, the data safe splices the Key certificate A and the data certificate B, then calculates an encryption character string MD5Key through an MD5 algorithm, and decrypts the encrypted data C into encrypted data B by using the MD5Key as an encryption vector value of an AES symmetric encryption algorithm;

Step 10, the data safe uses the data certificate B to encrypt through the MD5 to obtain an encrypted data certificate B1, the encrypted data certificate B1 is used for taking out a private key B associated with the encrypted data certificate B from the database, the encrypted data B is decrypted by the private key B to obtain service data, and finally the service data is sent to the service end.

2. The data security access method based on the encryption algorithm according to claim 1, wherein: the encryption algorithm is an SM2 algorithm.

3. The data security access method based on the encryption algorithm according to claim 1, wherein: the service end information comprises tenant id, tenant password and service identification code.

4. The data security access method based on the encryption algorithm according to claim 1, wherein: the operation of configuring the AES key value in step 5 is to set a string of fixed character strings as the AES key value or otherwise create a new table to dynamically configure the AES key value.

5. A data security access system based on an encryption algorithm for performing the method of any one of claims 1-4, characterized by: the main part is data safe deposit box, and it includes:

the verification module is used for verifying the validity of the service end information when the service end accesses the data safe;

the data access module is used for storing the received data into a database or extracting corresponding data from the database;

the key module is used for distributing keys for the service end and storing the keys of the service end to corresponding positions in the database through the data access module; and

And the encryption and decryption module is used for encrypting the key certificate and the service data and storing the encrypted data to the corresponding position in the database through the data access module.

6. The data security access system based on encryption algorithm of claim 5, wherein: and a key application interface, a data storage interface and a data acquisition interface are arranged among the service end, the data safe and the database.