CN117077170A - Data encryption method, device, equipment and medium - Google Patents

Abstract

The application discloses a data encryption method, a device, equipment and a medium, and relates to the field of network security or finance. The method is applied to a target system and comprises the following steps: responding to a service scene request sent by a source system, and selecting a symmetric encryption algorithm key corresponding to the source system and the service scene request from a matrix diagram of a target system; and performing data encryption on the data corresponding to the service scene request according to the symmetric encryption algorithm key. Therefore, by arranging the source system and the service scene request affecting the symmetric encryption algorithm key into a matrix diagram, when a new source system is accessed or the stock key value is changed, the step of modifying the system code logic can be avoided, and the symmetric encryption algorithm key is directly inquired and determined in the matrix diagram, so that the operation risk is avoided, the operation cost is reduced, and the data encryption is quick and efficient.

Description

A data encryption method, device, equipment and medium

Technical field

This application relates to the field of network security or finance, and in particular to a data encryption method, device, equipment and medium.

Background technique

Financial transaction systems, including banking systems, contain important information such as national personal information, corporate capital flow information, and socioeconomic activity information. Therefore, not only do data need to be strictly reviewed when entering the transaction system, but also during the data transmission and data use process. Strict management measures and technical means should be adopted to protect it, so as to reduce the risk of illegal access, theft, tampering and damage to the data and its transaction system.

In related technologies, a financial transaction may be initiated from a different source system and then call the same target system for transaction processing. To ensure data security during transmission, the source system will encrypt the data before sending it to the target system. The target system needs to decrypt the encrypted data before processing the transaction. Among them, the symmetric encryption algorithm key used in the encryption and decryption process is agreed upon by both systems.

However, when the target system needs to receive encrypted data from multiple source systems, the target system will agree on different symmetric encryption algorithm keys with different source systems. When a new source system is connected or the existing key value changes, the target system needs to modify the system code logic. Modifying the system code logic is not only cumbersome, but also increases the operational risk of the target system.

Contents of the invention

In view of this, embodiments of the present application provide a data encryption method, device, equipment and medium, which can avoid the step of modifying the system code logic when a new source system is accessed or the existing key value changes. Through the matrix diagram Determine the corresponding symmetric encryption algorithm key to perform data encryption.

The embodiments of this application disclose the following technical solutions:

In the first aspect, this application provides a data encryption method, which is applied to the target system. The method includes:

In response to the business scenario request issued by the source system, select the symmetric encryption algorithm key corresponding to the source system and the business scenario request in the matrix diagram of the target system;

Data encryption is performed on data corresponding to the business scenario request according to the symmetric encryption algorithm key.

Optionally, the method of constructing the matrix diagram specifically includes:

Set all source systems as the first row in the matrix diagram, place all business scenario requests as the first column in the matrix diagram, and place the symmetric encryption algorithm keys corresponding to the i-th source system and the j-th business scenario request at the Describe the i-th column and j-th row in the matrix graph to construct a matrix graph, where i and j are positive integers.

Optionally, performing data encryption on data corresponding to the business scenario request according to the symmetric encryption algorithm key includes:

Convert the combined result of the source system, the business scenario request, and the symmetric encryption algorithm key corresponding to the source system and the business scenario request into a target parameter;

If the source system and/or the business scenario request changes, modify the target parameters;

Data encryption is performed on the target data according to the modified target parameters, and the target data is data corresponding to the business scenario request or the changed business scenario request.

Optionally, performing data encryption on data corresponding to the business scenario request according to the symmetric encryption algorithm key includes:

Identify sensitive data in the business scenario request, where the sensitive data is data with a sensitivity index greater than a preset threshold;

Data encryption is performed on the sensitive data based on the symmetric encryption algorithm key.

Optionally, the symmetric encryption algorithm includes one or more of a data encryption standard algorithm, a triple data encryption algorithm, and an advanced encryption standard algorithm.

In the second aspect, this application provides a data encryption device, which is applied to the target system. The device includes: a selection module and an execution module;

The selection module is configured to, in response to a business scenario request issued by the source system, select a symmetric encryption algorithm key corresponding to the source system and the business scenario request in the matrix diagram of the target system;

The execution module is configured to perform data encryption on the data corresponding to the business scenario request according to the symmetric encryption algorithm key.

Optionally, the execution module specifically includes: an identification sub-module and an encryption sub-module;

The identification submodule is used to identify sensitive data in the business scenario request, where the sensitive data is data with a sensitivity index greater than a preset threshold;

The encryption submodule is used to perform data encryption on the sensitive data according to the symmetric encryption algorithm key.

Optionally, the symmetric encryption algorithm includes one or more of a data encryption standard algorithm, a triple data encryption algorithm, and an advanced encryption standard algorithm.

In a third aspect, this application provides a data encryption device, including: a memory and a processor;

The memory is used to store programs;

The processor is configured to implement the steps of the above data encryption method when executing the computer program.

In a fourth aspect, the present application provides a computer-readable storage medium. A computer program is stored on the readable storage medium. When the computer program is executed by a processor, the steps of the above-mentioned data encryption method are implemented.

Compared with the existing technology, this application has the following beneficial effects:

This application discloses a data encryption method, device, equipment and medium. The method includes: responding to a business scenario request issued by the source system, selecting a symmetric encryption algorithm corresponding to the source system and the business scenario request in the matrix diagram of the target system. Key; perform data encryption on the data corresponding to the business scenario request based on the symmetric encryption algorithm key. Therefore, by arranging the source systems and business scenario requests that affect the symmetric encryption algorithm key into a matrix diagram, when a new source system is accessed or the existing key value changes, the step of modifying the system code logic can be avoided and directly Directly query and determine the symmetric encryption algorithm key in the matrix diagram, thereby avoiding operational risks, reducing operating costs, and making data encryption fast and efficient.

Description of the drawings

In order to explain this embodiment or the technical solution in the prior art more clearly, the drawings needed to be used in the description of the embodiment or the prior art will be briefly introduced below. Obviously, the drawings in the following description are only For some embodiments of the present application, those of ordinary skill in the art can also obtain other drawings based on these drawings without exerting creative efforts.

Figure 1 is a flow chart of a data encryption method provided by an embodiment of the present application;

Figure 2 is a schematic diagram of a data encryption device provided by an embodiment of the present application;

Figure 3 is a schematic diagram of a computer-readable medium provided by an embodiment of the present application;

Figure 4 is a schematic diagram of the hardware structure of a server provided by an embodiment of the present application.

Detailed ways

The data encryption method, device, equipment and medium provided by the present invention can be used in the network security field or the financial field. The above are only examples and do not limit the application fields of the data encryption method, device, equipment and medium provided by the present invention.

First, let’s explain the technical terms involved in this application:

Symmetric Cryptography is a type of encryption algorithm in cryptography that uses the same key for encryption and decryption.

In related technologies, a financial transaction may be initiated from a different source system and then call the same target system for transaction processing. To ensure data security during transmission, the source system will encrypt the data before sending it to the target system. The target system needs to decrypt the encrypted data before processing the transaction. Among them, the symmetric encryption algorithm key used in the encryption and decryption process is agreed upon by both systems.

However, when the target system needs to receive encrypted data from multiple source systems, the target system will agree on different symmetric encryption algorithm keys with different source systems. When a new source system is connected or the existing key value changes, the target system needs to modify the system code logic. Modifying the system code logic is not only cumbersome, but also increases the operational risk of the target system.

In view of this, the present application provides a data encryption method, device, equipment and medium. The method includes: responding to a business scenario request issued by the source system, selecting the corresponding source system and business scenario request in the matrix diagram of the target system. The symmetric encryption algorithm key; perform data encryption on the data corresponding to the business scenario request based on the symmetric encryption algorithm key. Therefore, by arranging the source systems and business scenario requests that affect the symmetric encryption algorithm key into a matrix diagram, when a new source system is accessed or the existing key value changes, the step of modifying the system code logic can be avoided and directly Directly query and determine the symmetric encryption algorithm key in the matrix diagram, thereby avoiding operational risks, reducing operating costs, and making data encryption fast and efficient.

In order to enable those in the technical field to better understand the solutions of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only These are part of the embodiments of this application, but not all of them. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative efforts fall within the scope of protection of this application.

Refer to Figure 1, which is a flow chart of a data encryption method provided by an embodiment of the present application. The method is applied to the target system and includes:

S101: In response to the business scenario request issued by the source system, select the symmetric encryption algorithm key corresponding to the source system and the business scenario request in the matrix diagram of the target system.

The symmetric encryption algorithm key means that both parties sending and receiving data (ie, the source system and the target system) must use the same key to encrypt and decrypt the plain text. In some specific implementations, the above-mentioned symmetric encryption algorithm key may include one or more of a data encryption standard algorithm, a triple data encryption algorithm, and an advanced encryption standard algorithm.

Refer to Table 1, which is a schematic table of a matrix diagram provided by the embodiment of the present application. It can be understood that the matrix diagram is constructed based on the source system, the business scenario request, and the symmetric encryption algorithm key corresponding to the source system and the business scenario request. Put all source systems as the first row in the matrix diagram, put all business scenario requests as the first column in the matrix diagram, and place the symmetric encryption algorithm key corresponding to the i-th source system and the j-th business scenario request in the matrix diagram. Column i and row j, thereby constructing a matrix graph, where i and j are positive integers.

Table 1

Source System A Source System B (Support new systems) Business scenario 1 Symmetric encryption algorithm key 1 Symmetric encryption algorithm key 2 ... Business scenario 2 Symmetric encryption algorithm key 3 Symmetric encryption algorithm key 4 ... business scenario n ... ... ...

When receiving a business scenario request from the source system, you need to select the symmetric encryption algorithm key corresponding to the source system and the business scenario request in the matrix diagram of the target system. As can be seen from Table 1, if the received request is a request issued by source system A under the conditions of business scenario 1, then the symmetric encryption algorithm key 1 can be selected in the matrix diagram of Table 1; System B sends a request under the conditions of business scenario 2, then you can select symmetric encryption algorithm key 4 in the matrix diagram of Table 1.

It should be noted that this application does not limit the specific source system, business scenario and symmetric encryption algorithm key.

S102: Perform data encryption on the data corresponding to the business scenario request based on the symmetric encryption algorithm key.

After selecting the symmetric encryption algorithm key corresponding to the source system and business scenario request in the matrix diagram of the target system, data encryption can be performed on the data corresponding to the business scenario request based on the symmetric encryption algorithm key.

It is understandable that even in financial trading systems, not all data corresponding to business scenario requests are sensitive data. Then, you can filter the data corresponding to the business scenario request and only encrypt the data that needs to be encrypted, thereby improving encryption efficiency.

In some specific implementations, sensitive data in the business scenario request may be first identified. The sensitive data may refer to data with a sensitivity index greater than a preset threshold. This sensitive data can be set by relevant technical personnel themselves. For example, relevant technical personnel can set the transaction amount as sensitive data; it can also be set by the user according to their own needs. For example, the user can set the user's annual income as sensitive data. data. It should be noted that this application does not limit the specific sensitive data and its setting method.

After identifying the sensitive data in the business scenario request, data encryption can be performed on the sensitive data based on the symmetric encryption algorithm key.

Understandably, source systems and business scenario requests may also change. If the change is to the source system and/or business scenario included in the matrix diagram, data encryption can be performed directly based on the symmetric encryption algorithm key corresponding to the changed source system and/or business scenario.

If the source system and/or business scenario request changes to a source system and/or business scenario not included in the matrix diagram, then you need to first compare the source system and business scenario request before the change with the source system and business scenario The combined result of the corresponding symmetric encryption algorithm key of the request is converted into target parameters; then, the target parameters are modified simultaneously according to the modification; finally, data encryption is performed on the target data according to the modified target parameters, where the target data is the same as Business scenario request, or data corresponding to the changed business scenario request.

To sum up, this application discloses a data encryption method, which is applied to the target system and includes: in response to the business scenario request issued by the source system, selecting the data corresponding to the source system and the business scenario request in the matrix diagram of the target system. The symmetric encryption algorithm key; perform data encryption on the data corresponding to the business scenario request based on the symmetric encryption algorithm key. Therefore, by arranging the source systems and business scenario requests that affect the symmetric encryption algorithm key into a matrix diagram, when a new source system is accessed or the existing key value changes, the step of modifying the system code logic can be avoided and directly Directly query and determine the symmetric encryption algorithm key in the matrix diagram, thereby avoiding operational risks, reducing operating costs, and making data encryption fast and efficient.

Referring to Figure 2, this figure shows a data encryption device provided by an embodiment of the present application. The data encryption device 200 includes: a selection module 201 and an execution module 202;

Specifically, the selection module 201 is configured to respond to the business scenario request issued by the source system and select the symmetric encryption algorithm key corresponding to the source system and the business scenario request in the matrix diagram of the target system;

The execution module 202 is configured to perform data encryption on data corresponding to the business scenario request according to the symmetric encryption algorithm key.

In some specific implementations, the execution module 202 specifically includes: an identification sub-module and an encryption sub-module;

The identification sub-module is used to identify sensitive data in business scenario requests. Sensitive data is data whose sensitivity index is greater than the preset threshold;

The encryption submodule is used to perform data encryption on sensitive data based on the symmetric encryption algorithm key.

In some specific implementations, the symmetric encryption algorithm includes one or more of a data encryption standard algorithm, a triple data encryption algorithm, and an advanced encryption standard algorithm.

In some specific implementations, the above-mentioned matrix diagram construction device is specifically used to: use all source systems as the first row in the matrix diagram, use all business scenario requests as the first column in the matrix diagram, and use the i-th source system and The symmetric encryption algorithm key corresponding to the j-th business scenario request is located in the i-th column and j-th row in the matrix diagram to construct a matrix diagram, where i and j are positive integers.

In some specific implementations, the execution module 202 specifically includes: a conversion sub-module, a modification sub-module and a second encryption sub-module;

Specifically, the conversion submodule is used to convert the combination result of the source system, the business scenario request, and the symmetric encryption algorithm key corresponding to the source system and the business scenario request into the target parameter;

The modification submodule is used to modify the target parameters if the source system and/or business scenario requests change;

The second encryption submodule is used to perform data encryption on the target data according to the modified target parameters. The target data is data corresponding to the business scenario request or the changed business scenario request.

In summary, this application discloses a data encryption device. The method is applied to the target system and includes: a selection module and an execution module. Therefore, by arranging the source systems and business scenario requests that affect the symmetric encryption algorithm key into a matrix diagram, when a new source system is accessed or the existing key value changes, the step of modifying the system code logic can be avoided and directly Directly query and determine the symmetric encryption algorithm key in the matrix diagram, thereby avoiding operational risks, reducing operating costs, and making data encryption fast and efficient.

The functions described above herein may be performed, at least in part, by one or more hardware logic components. For example, and without limitation, exemplary types of hardware logic components that may be used include: Field Programmable Gate Arrays (FPGAs), Application Specific Integrated Circuits (ASICs), Application Specific Standard Products (ASSPs), Systems on Chips (SOCs), Complex Programmable Logical device (CPLD) and so on.

Refer to Figure 3, which is a schematic diagram of a computer-readable medium provided by an embodiment of the present application. A computer program 311 is stored on the computer-readable medium 300. When the computer program 311 is executed by a processor, the steps of the data encryption method in Figure 1 are implemented.

It should be noted that in the context of this application, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. . The machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. Machine-readable media may include, but are not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media would include one or more wire-based electrical connections, laptop disks, hard drives, random access memory (RAM), read only memory (ROM), erasable programmable read only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above.

It should be noted that the machine-readable medium mentioned above in this application may be a computer-readable signal medium or a computer-readable storage medium, or any combination of the above two. The computer-readable storage medium may be, for example, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or any combination thereof. More specific examples of computer readable storage media may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard drive, random access memory (RAM), read only memory (ROM), removable Programmed read-only memory (EPROM or flash memory), fiber optics, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above. As used herein, a computer-readable storage medium may be any tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or device. In this application, the computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, in which computer-readable program code is carried. Such propagated data signals may take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device . Program code embodied on a computer-readable medium may be transmitted using any suitable medium, including but not limited to: wire, optical cable, RF (radio frequency), etc., or any suitable combination of the above.

The above-mentioned computer-readable medium may be included in the above-mentioned electronic device; it may also exist independently without being assembled into the electronic device.

Referring to Figure 4, this figure is a schematic diagram of the hardware structure of a server provided by an embodiment of the present application. The server 400 may vary greatly due to different configurations or performance, and may include one or more central processing units (central processing units). , CPU) 422 (eg, one or more processors) and memory 432, one or more storage media 430 (eg, one or more mass storage devices) that stores applications 440 or data 444. Among them, the memory 432 and the storage medium 430 may be short-term storage or persistent storage. The program stored in the storage medium 430 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations on the server. Furthermore, the central processor 422 may be configured to communicate with the storage medium 430 and execute a series of instruction operations in the storage medium 430 on the server 400 .

Server 400 may also include one or more power supplies 426, one or more wired or wireless network interfaces 450, one or more input and output interfaces 458, and/or, one or more operating systems 441, such as Windows Server™, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM and many more.

The steps performed by the data encryption method in the above embodiment may be based on the server structure shown in FIG. 4 .

It should also be noted that according to embodiments of the present application, the process of the data encryption method described in the flowchart in FIG. 1 can be implemented as a computer software program. For example, embodiments of the present application include a computer program product that includes a computer program carried on a non-transitory computer-readable medium, the computer program including a program for performing the method shown in the flowchart of FIG. 1 above. code.

Although the subject matter has been described in language specific to structural features and/or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are merely example forms of implementing the claims.

Although several specific implementation details are included in the above discussion, these should not be construed as limiting the scope of the application. Certain features that are described in the context of separate embodiments can also be implemented in combination in a single embodiment. Conversely, various features that are described in the context of a single embodiment can also be implemented in multiple embodiments separately or in any suitable subcombination.

The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Persons skilled in the art should understand that the disclosure scope involved in this application is not limited to technical solutions composed of specific combinations of the above technical features, but should also cover solutions consisting of the above technical features or without departing from the above disclosed concept. Other technical solutions formed by any combination of equivalent features. For example, a technical solution is formed by replacing the above features with technical features with similar functions disclosed in this application (but not limited to).

Claims (10)

1. A data encryption method, characterized in that, applied to a target system, the method includes: In response to the business scenario request issued by the source system, select the symmetric encryption algorithm key corresponding to the source system and the business scenario request in the matrix diagram of the target system; Data encryption is performed on data corresponding to the business scenario request according to the symmetric encryption algorithm key. 2. The method according to claim 1, characterized in that the construction method of the matrix diagram specifically includes: Set all source systems as the first row in the matrix diagram, place all business scenario requests as the first column in the matrix diagram, and place the symmetric encryption algorithm keys corresponding to the i-th source system and the j-th business scenario request at the Describe the i-th column and j-th row in the matrix graph to construct a matrix graph, where i and j are positive integers. 3. The method according to claim 1 or 2, characterized in that performing data encryption on data corresponding to the business scenario request according to the symmetric encryption algorithm key includes: Convert the combined result of the source system, the business scenario request, and the symmetric encryption algorithm key corresponding to the source system and the business scenario request into a target parameter; If the source system and/or the business scenario request changes, modify the target parameters; Data encryption is performed on the target data according to the modified target parameters, and the target data is data corresponding to the business scenario request or the changed business scenario request. 4. The method of claim 1, wherein performing data encryption on data corresponding to the business scenario request according to the symmetric encryption algorithm key includes: Identify sensitive data in the business scenario request, where the sensitive data is data with a sensitivity index greater than a preset threshold; Data encryption is performed on the sensitive data based on the symmetric encryption algorithm key. 5. The method of claim 1, wherein the symmetric encryption algorithm includes one or more of a data encryption standard algorithm, a triple data encryption algorithm and an advanced encryption standard algorithm. 6. A data encryption device, characterized in that it is applied to a target system, and the device includes: a selection module and an execution module; The selection module is configured to, in response to a business scenario request issued by the source system, select a symmetric encryption algorithm key corresponding to the source system and the business scenario request in the matrix diagram of the target system; The execution module is configured to perform data encryption on the data corresponding to the business scenario request according to the symmetric encryption algorithm key. 7. The method according to claim 1, characterized in that the execution module specifically includes: an identification sub-module and an encryption sub-module; The identification submodule is used to identify sensitive data in the business scenario request, where the sensitive data is data with a sensitivity index greater than a preset threshold; The encryption submodule is used to perform data encryption on the sensitive data according to the symmetric encryption algorithm key. 8. The method of claim 1, wherein the symmetric encryption algorithm includes one or more of a data encryption standard algorithm, a triple data encryption algorithm and an advanced encryption standard algorithm. 9. A data encryption device, characterized by including: a memory and a processor; The memory is used to store programs; The processor is configured to execute the program and implement each step of the method according to any one of claims 1 to 5. 10. A computer storage medium with a computer program stored thereon, characterized in that, when the computer program is executed by a processor, each step of the method according to any one of claims 1 to 5 is implemented.