Data storage encryption method, device and electronic equipment

Abstract

A data storage encryption method, device and electronic device relate to the field of data processing. In the method, respond to the encryption request of the user, and obtain the data to be encrypted; use the preset public key to encrypt the data to be encrypted to obtain the basic encrypted data; determine the encryption node for responding to the encryption request among multiple spare nodes; obtain the node public key corresponding to each encryption node; use each node public key to perform secondary encryption on the basic encrypted data to obtain multiple target encrypted data; interleave and send the target encrypted data to each encryption node for storage, wherein the first encryption node does not receive the first encrypted data, the first encryption node receives the second encrypted data, the first encryption node is any one of the multiple encryption nodes, the first encrypted data is encrypted by the first node public key corresponding to the first encryption node, the second encrypted data is encrypted by the second node public key corresponding to the second encryption node, and the second encryption node is any one of the multiple encryption nodes except the first encryption node. Implementing the technical solution provided by the present application reduces the probability of data being leaked when the node is attacked when it is stored in the node.

Description

Technical Field

[0001] The present application relates to the field of data processing, and in particular to a data storage encryption method, device and electronic device. Background Art

[0002] With the rapid development of information technology and the popularization of the Internet, the amount of data has exploded. In this data-driven era, the security of personal privacy and sensitive information has become crucial. With the frequent occurrence of hacker attacks and data leaks, the need to protect data from unauthorized access is increasing. The importance of data security lies in that it not only affects the privacy rights of individuals, but also directly affects the business interests and national security of enterprises. Therefore, how to ensure the security of data during storage and transmission has become an urgent problem to be solved in the information age.

[0003] At present, relevant data storage encryption technologies mainly rely on traditional encryption algorithms and security protocols. These technologies usually involve symmetric or asymmetric encryption of data to protect the security of data transmission. Although these methods have greatly improved the security of data, they still have limitations. For example, once the encryption key is cracked or leaked, the encrypted data will face the risk of being decrypted. In addition, once the data reaches the storage node, it may be accessed by the node operator or leaked when the node is attacked.

[0004] Therefore, there is an urgent need for a data storage encryption method, device and electronic device. Summary of the invention

[0005] The present application provides a data storage encryption method, device and electronic device, which reduce the probability of data being leaked when the node is attacked when the node is stored in the node.

[0006] In a first aspect of the present application, a data storage encryption method is provided, in which: respond to an encryption request from a user and obtain data to be encrypted; use a preset public key to encrypt the data to be encrypted to obtain basic encrypted data; determine an encryption node among multiple standby nodes for responding to the encryption request; obtain a node public key corresponding to each of the encryption nodes; use each of the node public keys to perform secondary encryption on the basic encrypted data to obtain multiple target encrypted data; send the target encrypted data to each of the encryption nodes for storage in an interleaved manner, wherein a first encryption node does not receive the first encrypted data, the first encryption node receives the second encrypted data, the first encryption node is any one of the multiple encryption nodes, the first encrypted data is encrypted by the first node public key corresponding to the first encryption node, the second encrypted data is encrypted by the second node public key corresponding to the second encryption node, and the second encryption node is any one of the multiple encryption nodes except the first encryption node.

[0007] By adopting the above technical solution, the encrypted data is encrypted multiple times, and first encrypted once with a preset public key, and then encrypted twice with the public keys of different encryption nodes. Even if an attacker can obtain the target encrypted data of a certain encryption node, he cannot decrypt the original encrypted data, which greatly increases the difficulty of cracking the encrypted data and improves the security of the data. Since each encryption node only stores the data encrypted by other encryption nodes, even if the node operator or attacker can access the data stored on the encryption node, they cannot read the original encrypted data because they do not have the necessary private key to decrypt it, which increases the protection of data privacy. At the same time, the encryption nodes are interleaved and stored on different nodes. This distributed storage method reduces the risk of single point failure. Even if one or several encryption nodes are attacked or destroyed, the data is still stored on other encryption nodes, which improves the stability of the data.

[0008] Optionally, after sending the encrypted data to each of the encryption nodes for storage in an interlaced manner, the method further includes: responding to an access request for the target encrypted data sent by a user; sending the access request to the first encryption node; obtaining the second encrypted data sent by the first encryption node and stored in the first encryption node; sending the second encrypted data to the second encryption node so that the second encryption node decrypts the second encrypted data according to the private key corresponding to the public key of the second node to obtain the basic encrypted data; obtaining the basic encrypted data sent by the second encryption node; and decrypting the basic encrypted data using the private key corresponding to the preset public key to obtain the data to be encrypted.

[0009] By adopting the above technical solution, the encryption and decryption process of multiple encryption nodes ensures that the integrity and confidentiality of the data are protected even in complex data access scenarios. Data can only be recovered with the correct decryption order and the correct key. The access and decryption of data requires the participation of multiple nodes. This distributed control mechanism enhances the security of access control and avoids the risks of centralized control. Data can only be accessed by users or entities holding the correct private key, which ensures that only authorized users can access and decrypt data. Even if an encryption node is compromised, the attacker cannot obtain the complete data because it can only access data fragments encrypted by the public keys of other nodes. This design reduces the impact that a single attack event may cause. Assuming that a node fails or the data is corrupted, the lost data can still be recovered through other nodes and the correct decryption process.

[0010] Optionally, before obtaining the node public key corresponding to each of the encryption nodes, the method further includes: sending a key generation instruction to each of the encryption nodes, so that each of the encryption nodes generates a corresponding node public key and node private key using an asymmetric encryption algorithm according to the corresponding node IP.

[0011] By adopting the above technical solution, each encryption node independently generates its own node public key and node private key, ensuring the uniqueness and security of the key. The private key is generated and stored on each node and is not transmitted over the network, which reduces the risk of the key being intercepted or leaked. By using an asymmetric encryption algorithm, it is ensured that only the encryption node with the correct private key can decrypt the corresponding data. Even if the data is intercepted during transmission, it cannot be decrypted without the corresponding private key, thereby protecting data privacy.

[0012] Optionally, after obtaining the node public key corresponding to each of the encryption nodes, the method further includes: obtaining the node ID of the encryption node; constructing a correspondence between the node ID and the node public key, and storing the correspondence in a preset database.

[0013] By adopting the above technical solution, the correspondence between the node ID and the node public key is stored in the database, which can facilitate key retrieval and management. The node ID can be used as a unique identifier to quickly index and locate a specific encryption node. When the server obtains the target encrypted data, it can determine the corresponding node ID through its node public key, and then determine which encryption node's node public key encrypted the target encrypted data, so that the server can quickly send it to the corresponding encryption node for decryption.

[0014] Optionally, after obtaining the second encrypted data sent by the first encryption node and stored with the first encryption node, the method further includes: parsing the second encrypted data to obtain a second node public key corresponding to the second encrypted data; searching for a node IP corresponding to the second node public key in the preset database; and determining the second encryption node based on the node IP corresponding to the second node public key.

[0015] By adopting the above technical solution, the node public key is obtained by parsing the encrypted data and matching it with the node IP in the database, which can ensure that the target encrypted data is sent to the correct second encryption node. Because only the second encryption node has the corresponding node private key, after determining the correct second encryption node, it can be ensured that only the second encryption node can decrypt the received data, thus strengthening the data confidentiality during the transmission process.

[0016] Optionally, determining an encryption node among multiple backup nodes for responding to an encryption request specifically includes: obtaining a CPU usage rate of the backup node; and determining, among the backup nodes, a backup node whose CPU usage rate is less than or equal to a preset threshold as the encryption node.

[0017] By adopting the above technical solution, nodes with low CPU usage are selected as encryption nodes, which can ensure that the selected nodes have sufficient computing resources to process storage tasks and avoid performance bottlenecks caused by insufficient resources. Nodes with low CPU usage often mean that these nodes are currently relatively idle, so they can respond to new encryption requests faster, thereby improving the overall response speed. By selecting nodes with low CPU usage, the task load can be evenly distributed to avoid situations where some nodes are overloaded while other nodes are idle. Because the selection of nodes is based on CPU usage, rather than all nodes, it is random. Therefore, it is still difficult for attackers to predict which node will be selected because the CPU load will continue to change, increasing uncertainty, thereby increasing the difficulty for attackers to carry out targeted attacks.

[0018] Optionally, after decrypting the basic encrypted data using the private key corresponding to the preset public key to obtain the data to be encrypted, the method further includes: performing hash calculation on the data to be encrypted to obtain a target hash value corresponding to the data to be encrypted; determining whether the target hash value is consistent with the preset hash value; if the hash value is consistent with the preset hash value, determining that the data to be encrypted has not been tampered with.

[0019] By adopting the above technical solution, by performing hash calculation on the encrypted data and comparing it with the preset hash value, it is possible to verify whether the data remains tampered with during transmission or storage, thereby ensuring the integrity of the data. This method does not require modifying the original data, and only performs security checks by calculating the hash value of the data and comparing it with the preset value. Such non-invasive detection has little interference with the data processing flow. Since the hash value is irreversible, even if the attacker obtains the hash value of the data, they cannot restore the original data, which protects the security of the data content.

[0020] In a second aspect of the present application, a data storage encryption device is provided, the device comprising an acquisition module and a processing module; the acquisition module is used to respond to a user's encryption request and acquire data to be encrypted;

[0021] The processing module is used to encrypt the data to be encrypted using a preset public key to obtain basic encrypted data; the processing module is also used to determine an encryption node among multiple standby nodes that is used to respond to an encryption request; the acquisition module is also used to obtain a node public key corresponding to each of the encryption nodes; the processing module is also used to perform secondary encryption on the basic encrypted data using each of the node public keys to obtain multiple target encrypted data; the processing module is also used to interleave the target encrypted data to each of the encryption nodes for storage, wherein the first encryption node does not receive the first encrypted data, the first encryption node receives the second encrypted data, the first encryption node is any one of the multiple encryption nodes, the first encrypted data is encrypted by the first node public key corresponding to the first encryption node, the second encrypted data is encrypted by the second node public key corresponding to the second encryption node, and the second encryption node is any one of the multiple encryption nodes except the first encryption node.

[0022] In the third aspect of the present application, an electronic device is provided, including a processor, a memory, a user interface and a network interface, the memory is used to store instructions, the user interface and the network interface are used to communicate with other devices, and the processor is used to execute the instructions stored in the memory so that the electronic device executes any one of the above methods.

[0023] In a fourth aspect of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions. When the instructions are executed, the method steps shown above are executed.

[0024] In summary, one or more technical solutions provided in the embodiments of the present application have at least the following technical effects or advantages:

[0025] 1. By encrypting the data to be encrypted multiple times, and first encrypting it once with a preset public key, and then encrypting it twice with the public keys of different encryption nodes, even if an attacker can obtain the target encrypted data of a certain encryption node, he cannot decrypt the original data to be encrypted, which greatly increases the difficulty of cracking the encrypted data and improves the security of the data; since each encryption node only stores the data encrypted by other encryption nodes, even if the node operator or attacker can access the data stored on the encryption node, they cannot read the original encrypted data because they do not have the necessary private key to decrypt it, which increases the protection of data privacy; at the same time, the encryption nodes are interleaved and stored on different nodes. This distributed storage method reduces the risk of single point failure; even if one or several encryption nodes are attacked or destroyed, the data is still stored on other encryption nodes, which improves the stability of the data.

[0026] 2. The encryption and decryption process of multiple encryption nodes ensures that the integrity and confidentiality of the data are protected even in complex data access scenarios. Data can only be recovered with the correct decryption order and the correct key. The access and decryption of data requires the participation of multiple nodes. This distributed control mechanism enhances the security of access control and avoids the risks of centralized control. Data can only be accessed by users or entities holding the correct private key, which ensures that only authorized users can access and decrypt data. Even if an encryption node is compromised, the attacker cannot obtain the complete data because it can only access data fragments encrypted by the public keys of other nodes. This design reduces the impact that a single attack event may cause. Assuming that a node fails or the data is corrupted, the lost data can still be recovered through other nodes and the correct decryption process.

[0027] 3. Selecting nodes with low CPU usage as encryption nodes can ensure that the selected nodes have sufficient computing resources to handle storage tasks and avoid performance bottlenecks caused by insufficient resources. Nodes with low CPU usage often mean that these nodes are currently idle, so they can respond to new encryption requests faster, thereby improving the overall response speed. By selecting nodes with low CPU usage, the task load can be evenly distributed to avoid situations where some nodes are overloaded while others are idle. Because the selection of nodes is based on CPU usage, not all nodes, it is random. Therefore, it is still difficult for attackers to predict which node will be selected because the CPU load will continue to change, increasing uncertainty, thereby increasing the difficulty for attackers to carry out targeted attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 It is a flowchart of a data storage encryption method provided by an embodiment of the present application;

[0029] Figure 2 This is a module schematic diagram of a data storage encryption device provided in an embodiment of the present application;

[0030] Figure 3 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application.

[0031] Explanation of the reference numerals: 201, acquisition module; 202, processing module; 300, electronic device; 301, processor; 302, communication bus; 303, user interface; 304, network interface; 305, memory. DETAILED DESCRIPTION

[0032] In order to enable technicians in this field to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments.

[0033] In the description of the embodiments of the present application, words such as "for example" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "for example" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "for example" or "for example" is intended to present related concepts in a specific way.

[0034] In the description of the embodiments of the present application, the meaning of the term "multiple" refers to two or more. For example, multiple systems refer to two or more systems, and multiple screen terminals refer to two or more screen terminals. In addition, the terms "first" and "second" are used for descriptive purposes only and cannot be understood as indicating or implying relative importance or implicitly indicating the indicated technical features. Thus, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. The terms "include", "comprise", "have" and their variations all mean "including but not limited to", unless otherwise specifically emphasized.

[0035] With the rapid development of information technology and the popularization of the Internet, data has become the core asset of modern social operations. In this data-driven era, personal privacy, corporate confidentiality and other aspects are heavily dependent on the protection of data security. Frequent security incidents such as information leakage, data tampering and service interruption have had a huge impact on society. Therefore, protecting the security of data is not only an inevitable requirement for technological development, but also an important cornerstone for social stability and economic development. At present, existing data storage encryption methods mainly rely on traditional encryption technologies, such as symmetric encryption and asymmetric encryption. In addition, existing technologies usually store encrypted data in a centralized manner. Once the encryption node is attacked, data security will be threatened. Therefore, current technologies still have shortcomings in data security.

[0036] The technical solution provided by this application improves the confidentiality and security of data by performing secondary encryption on different encryption nodes and distributing storage. By introducing multiple encryption nodes and using the public key of each node to perform secondary encryption on the data, and then interleaving the encrypted data on different nodes, the risk of single point failure and key leakage is avoided. This method will greatly enhance the security of data storage, so that even if some nodes are breached, the attacker cannot obtain the complete encrypted data, protecting the data from illegal access and use.

[0037] This application provides a data storage encryption method, referring to Figure 1 , Figure 1 1 is a flow chart of a data storage encryption method provided in an embodiment of the present application. The method is applied to a server and includes steps S101 to S106, which are as follows:

[0038] Step S101: respond to the user's encryption request and obtain the data to be encrypted.

[0039] In step S101, the user refers to an individual user or system administrator who wishes to use the server to encrypt data; the user determines the data to be encrypted and sends an encryption request to the server through the user terminal. After the server receives the encryption request from the user, it obtains the data to be encrypted and executes steps S102 to S106.

[0040] Step S102: using a preset public key to encrypt the data to be encrypted to obtain basic encrypted data.

[0041] In step S102, the server uses a random number generator to generate a random number for generating a key based on its own MAC address, and uses the random number and MAC address as inputs to an asymmetric encryption algorithm to generate a preset private key. The preset private key is then used as input to an asymmetric encryption algorithm to generate a preset private key. After the server determines the data to be encrypted, it uses the preset public key to encrypt the data to be encrypted to obtain the basic encrypted data after one encryption.

[0042] Step S103: Determine an encryption node among multiple standby nodes for responding to the encryption request.

[0043] In step S103, the CPU usage of the standby nodes is obtained; and the standby nodes whose CPU usage is less than or equal to a preset threshold are determined as the encryption nodes.

[0044] Specifically, a node refers to a computing device in a distributed network, which can be a physical server, a virtual machine, a container instance, or any device capable of performing computing tasks. In the distributed network, nodes are interconnected and work together to complete various tasks of distributed applications. After the server completes the operation in step S102, it determines the node whose CPU usage is less than or equal to the preset threshold among the standby nodes connected to it, and uses the node as an encryption node. The encryption node refers to the node selected in this solution to perform storage of encrypted data.

[0045] Step S104: Obtain the node public key corresponding to each of the encryption nodes.

[0046] Before step S104, the method further includes: sending a key generation instruction to each of the encryption nodes, so that each of the encryption nodes generates a corresponding node public key and node private key using an asymmetric encryption algorithm.

[0047] Specifically, the server sends a key generation instruction to each encryption node; the key generation instruction contains the required asymmetric encryption algorithm and related parameters. After receiving the key generation instruction, each encryption node uses its own node IP as the input of the asymmetric encryption algorithm to generate a key pair. The key pair includes a node public key and a node private key. The generation process is consistent with the steps of generating the preset private key and the preset public key. After generating the key pair, each encryption node sends its corresponding node public key back to the server.

[0048] After step S104, the method further includes: after obtaining the node public key corresponding to each of the encryption nodes, the method further includes: obtaining the node ID of the encryption node; constructing a correspondence between the node ID and the node public key, and storing the correspondence in a preset database.

[0049] Specifically, after receiving the node public keys sent by each encryption node, the server associates these node public keys with the node IPs of the corresponding encryption nodes, and stores the corresponding relationship between the node public keys and the node IPs in a preset database.

[0050] Step S105: respectively use the public keys of the nodes to perform secondary encryption on the basic encrypted data to obtain a plurality of target encrypted data.

[0051] In step S105, the server obtains the node public key of the associated encryption node from the preset database; for each encryption node, the server obtains its corresponding node public key; and uses each node public key to perform secondary encryption on the basic encrypted data obtained in step S102 to obtain multiple corresponding secondary encrypted target encrypted data. One node public key generates one target encrypted data. Finally, the server will obtain multiple target encrypted data, each of which is obtained by secondary encryption using the node public key of a different encryption node.

[0052] Step S106: Interlacedly sending the target encrypted data to each of the encryption nodes for storage, wherein the first encryption node does not receive the first encrypted data, the first encryption node receives the second encrypted data, the first encryption node is any one of the multiple encryption nodes, the first encrypted data is encrypted by the first node public key corresponding to the first encryption node, the second encrypted data is encrypted by the second node public key corresponding to the second encryption node, and the second encryption node is any one of the multiple encryption nodes except the first encryption node.

[0053] Specifically, among the multiple target encrypted data generated by the server, the first target encrypted data is one of the multiple target encrypted data, and the first target encrypted data is encrypted by the first node public key corresponding to the first encryption node, and the first encryption node is any one of the multiple encryption nodes; after the server generates multiple target encrypted data, it will send all the target encrypted data to the encryption node for storage, and one target encrypted data is sent to one encryption node. It should be noted that the first target encrypted data will not be sent to the first encryption node, but will be sent to any one of the multiple encryption nodes except the first encryption node. This rule is followed for all target encrypted data. For example, the second encrypted data is encrypted by the second node public key of the second encryption node, but the second encrypted data will not be sent to the second encryption node, but will be sent to any other encryption node except the second encryption node. The server sends the encrypted target encrypted data to different encryption nodes in an interleaved manner to ensure that each encryption node stores data encrypted by the node public key of other encryption nodes.

[0054] For example, a user initiates an encryption request through a client interface or API and uploads the data to be encrypted. The user uploads a document and wants to encrypt it before storage. The server first uses a preset public key, which is a public key owned by the server for initial encryption of data. The server encrypts the data uploaded by the user to obtain basic encrypted data. This step provides the first layer of data protection. The server is connected to multiple backup nodes and the server determines the encryption node that responds to this encryption request. Assume that there are three backup nodes in the distributed system: node 1, node 2, and node 3. The server then obtains the node public keys corresponding to these determined encryption nodes. The server uses the node public keys of each encryption node to encrypt the obtained basic encrypted data twice. The basic encrypted data will be encrypted once by the public key of node 1 to obtain encrypted data 1; the basic encrypted data will also be encrypted by the node public key of node 2 to obtain encrypted data 2; and the basic encrypted data will be encrypted by the public key of node 3 at the same time to obtain encrypted data 3. Finally, the server sends these target encrypted data to different encryption nodes for storage in an interleaved manner. Specifically, encrypted data 1 will not be sent to node 1, but to node 2 and node 3. Likewise, encrypted data 2 is not sent to node 2, but to nodes 1 and 3. Encrypted data 3 is not sent to node 3, but to nodes 1 and 2.

[0055] In this way, the encrypted data stored by each encryption node requires two different private keys to decrypt: one is the server's private key, and the other is the private key of other nodes. This increases data security, and even if a node is compromised, the attacker cannot decrypt the data because they do not have the private keys of other nodes and the server's private keys.

[0056] After step S106, the method further includes: responding to an access request for the target encrypted data sent by a user; sending the access request to the first encryption node; obtaining the second encrypted data sent by the first encryption node and stored in the first encryption node; sending the second encrypted data to the second encryption node so that the second encryption node decrypts the second encrypted data according to the private key corresponding to the public key of the second node to obtain the basic encrypted data; obtaining the basic encrypted data sent by the second encryption node; and decrypting the basic encrypted data using the private key corresponding to the preset public key to obtain the data to be encrypted.

[0057] Specifically, the user sends a request to the server to access the target encrypted data. After receiving the user's request, the server will determine the encryption node to be contacted, which can be any one of the multiple encryption nodes, such as the first encryption node, because these encryption nodes store the target encrypted data, and then send a request to the first encryption node to obtain the target encrypted data stored on the node. The first encryption node responds to the request and sends the encrypted data stored in it back to the server. The server will parse the data to obtain the node public key; thus, according to the node public key, it is determined that the data is encrypted by the second node public key of the second encryption node. After receiving the second encrypted data from the first encryption node, the server will parse it to obtain the node public key corresponding to the second encrypted data, and then determine the node corresponding to the node public key according to the correspondence between the node public key and the node IP in the preset database, that is, determine which node's node public key is encrypted by the second encrypted data, that is, the second node public key of the second encryption node. At the same time, the server will send the second encrypted data to the second encryption node so that the node can decrypt the data using the private key corresponding to its public key. The second encryption node uses its private key to decrypt the received second encrypted data to obtain the basic encrypted data. Then, the second encryption node sends this basic encrypted data back to the server. After receiving the basic encrypted data sent by the second encryption node, the server uses the private key corresponding to the preset public key to decrypt these data. After decryption, the server obtains the encrypted data that the original user wants to access (that is, the file originally uploaded by the user). The server can then provide these data to the user to complete the access request.

[0058] In a possible implementation, determining an encryption node among multiple backup nodes for responding to an encryption request specifically includes: obtaining the CPU usage of the backup nodes; and determining, among the backup nodes, a backup node whose CPU usage is less than or equal to a preset threshold as the encryption node.

[0059] Specifically, the server queries the CPU usage of all standby nodes and sets a preset threshold to evaluate whether the standby nodes have enough idle CPU resources to process encryption requests; the nodes among the standby nodes whose CPU usage is lower than or equal to the preset threshold are used as encryption nodes, which are used to process encryption requests sent by the server.

[0060] In a possible implementation, after the basic encrypted data is decrypted using the private key corresponding to the preset public key to obtain the data to be encrypted, the method further includes: performing a hash calculation on the data to be encrypted to obtain a target hash value corresponding to the data to be encrypted; determining whether the target hash value is consistent with the preset hash value; if the hash value is consistent with the preset hash value, determining that the data to be encrypted has not been tampered with.

[0061] Specifically, after the server completes the user's access request and provides the encrypted data after two decryptions to the user, the server will further verify the integrity of the decrypted data to be encrypted. The server will use a hash algorithm to perform hash calculation on the encrypted data to obtain the corresponding target hash value. At the same time, the server will compare the target hash value with the preset hash value. The preset hash value is generated by the original encrypted data that has not undergone the encryption process. If the target hash value is the same as the preset hash value, it means that the encrypted data obtained after decryption is consistent with the original encrypted data, and no unauthorized data tampering has occurred.

[0062] Reference Figure 2 The present application also provides a data storage encryption device, which is a server, and the server includes an acquisition module 201 and a processing module 202; the acquisition module 201 is used to respond to the user's encryption request and obtain the data to be encrypted; the processing module 202 is used to encrypt the data to be encrypted using a preset public key to obtain basic encrypted data; the processing module 202 is also used to determine the encryption node for responding to the encryption request among multiple standby nodes; the acquisition module 201 is also used to obtain the node public key corresponding to each of the encryption nodes; the processing module 202 is also used to respectively use each of the node public keys to encrypt the basic encryption data. The data is encrypted twice to obtain multiple target encrypted data; the processing module 202 is also used to interleave the target encrypted data to each of the encryption nodes for storage, wherein the first encryption node does not receive the first encrypted data, the first encryption node receives the second encrypted data, the first encryption node is any one of the multiple encryption nodes, the first encrypted data is encrypted by the first node public key corresponding to the first encryption node, the second encrypted data is encrypted by the second node public key corresponding to the second encryption node, and the second encryption node is any one of the multiple encryption nodes except the first encryption node.

[0063] In a possible implementation, after the processing module 202 interlacedly sends the encrypted data to each of the encryption nodes for storage, the method further includes: the processing module 202 responds to an access request for the target encrypted data sent by a user; sends the access request to the first encryption node; the acquisition module 201 acquires the second encrypted data sent by the first encryption node and stored in the first encryption node; the processing module 202 sends the second encrypted data to the second encryption node, so that the second encryption node decrypts the second encrypted data according to the private key corresponding to the public key of the second node to obtain the basic encrypted data; the acquisition module 201 acquires the basic encrypted data sent by the second encryption node; and uses the private key corresponding to the preset public key to decrypt the basic encrypted data to obtain the data to be encrypted.

[0064] In a possible implementation, before the acquisition module 201 acquires the node public key corresponding to each of the encryption nodes, the method further includes: the processing module 202 sends a key generation instruction to each of the encryption nodes, so that each of the encryption nodes generates a corresponding node public key and node private key using an asymmetric encryption algorithm according to the corresponding node IP.

[0065] In a possible implementation, after the acquisition module 201 acquires the node public key corresponding to each of the encryption nodes, the method further includes: the acquisition module 201 acquires the node ID of the encryption node; constructs a correspondence between the node ID and the node public key, and stores the correspondence in a preset database.

[0066] In a possible implementation, after the acquisition module 201 acquires the second encrypted data sent by the first encryption node and stored with the first encryption node, the method further includes: the processing module 202 parses the second encrypted data to obtain the second node public key corresponding to the second encrypted data; the processing module 202 searches the preset database for the node IP corresponding to the second node public key; the processing module 202 determines the second encryption node based on the node IP corresponding to the second node public key.

[0067] In a possible implementation, the processing module 202 determines an encryption node among multiple backup nodes for responding to an encryption request, specifically including: the acquisition module 201 acquires the CPU usage of the backup node; and determines that among the backup nodes, a backup node whose CPU usage is less than or equal to a preset threshold is the encryption node.

[0068] In a possible implementation, the processing module 202 uses the private key corresponding to the preset public key to decrypt the basic encrypted data to obtain the data to be encrypted. The method also includes: the processing module 202 performs hash calculation on the data to be encrypted to obtain a target hash value corresponding to the data to be encrypted; the processing module 202 determines whether the target hash value is consistent with the preset hash value; if the hash value is consistent with the preset hash value, it is determined that the data to be encrypted has not been tampered with.

[0069] It should be noted that: when the device provided in the above embodiment realizes its function, only the division of the above functional modules is used as an example. In actual application, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the device and method embodiments provided in the above embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0070] The present application also provides an electronic device. Figure 3 , Figure 3 The electronic device 300 may include: at least one processor 301 , at least one network interface 304 , a user interface 303 , a memory 305 , and at least one communication bus 302 .

[0071] The communication bus 302 is used to realize the connection and communication between these components.

[0072] The user interface 303 may include a display screen (Display) and a camera (Camera). Optionally, the user interface 303 may also include a standard wired interface and a wireless interface.

[0073] The network interface 304 may optionally include a standard wired interface or a wireless interface (such as a WI-FI interface).

[0074] Among them, the processor 301 may include one or more processing cores. The processor 301 uses various interfaces and lines to connect various parts in the entire server, and executes various functions of the server and processes data by running or executing instructions, programs, code sets or instruction sets stored in the memory 305, and calling data stored in the memory 305. Optionally, the processor 301 can be implemented in at least one hardware form of digital signal processing (Digital Signal Processing, DSP), field programmable gate array (Field-Programmable Gate Array, FPGA), and programmable logic array (Programmable Logic Array, PLA). The processor 301 can integrate one or a combination of a central processing unit (Central Processing Unit, CPU), a graphics processing unit (Graphics Processing Unit, GPU) and a modem. Among them, the CPU mainly processes the operating system, user interface and application programs; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 301, and it can be implemented separately through a chip.

[0075] Among them, the memory 305 may include a random access memory (Random Access Memory, RAM) and may also include a read-only memory (Read-Only Memory). Optionally, the memory 305 includes a non-transitory computer-readable storage medium. The memory 305 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 305 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc.; the data storage area may store data involved in the above-mentioned various method embodiments, etc. The memory 305 may optionally also be at least one storage device located away from the aforementioned processor 301. Refer to Figure 3 , the memory 305 as a computer storage medium may include an operating system, a network communication module, a user interface module and an application program of a data storage encryption method.

[0076] exist Figure 3In the electronic device 300 shown, the user interface 303 is mainly used to provide an input interface for the user and obtain the data input by the user; and the processor 301 can be used to call an application program storing a data storage encryption method in the memory 305, and when executed by one or more processors 301, the electronic device 300 executes one or more of the methods described in the above embodiments. It should be noted that for the aforementioned method embodiments, for the sake of simple description, they are all expressed as a series of action combinations, but those skilled in the art should know that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required for the present application.

[0077] The present application also provides a computer-readable storage medium, which stores instructions. When executed by one or more processors 301, the electronic device 300 executes one or more of the methods described in the above embodiments.

[0078] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0079] In the several embodiments provided in this application, it should be understood that the disclosed devices can be implemented in other ways. For example, the device embodiments described above are only schematic, such as the division of units, which is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some service interfaces, and the indirect coupling or communication connection of devices or units can be electrical or other forms.

[0080] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0081] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0082] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a memory and includes several instructions for a computer device (which can be a personal computer, server or network device, etc.) to execute all or part of the steps of the various embodiments of the present application. The aforementioned memory includes: various media that can store program codes, such as USB flash drives, mobile hard drives, magnetic disks or optical disks.

[0083] The above is only an exemplary embodiment of the present disclosure and cannot be used to limit the scope of the present disclosure. That is, any equivalent changes and modifications made according to the teachings of the present disclosure are still within the scope of the present disclosure. After considering the disclosure of the specification and the truth of practice, those skilled in the art will easily think of other embodiments of the present disclosure.

[0084] This application is intended to cover any variation, use or adaptation of the present disclosure, which follows the general principles of the present disclosure and includes common knowledge or customary technical means in the art not described in the present disclosure. The description and examples are to be regarded as exemplary only, and the scope and spirit of the present disclosure are defined by the claims.

Claims

1. A data storage encryption method, characterized in that: The method comprises: Responding to the user's encryption request and obtaining the data to be encrypted; Encrypting the data to be encrypted using a preset public key to obtain basic encrypted data; Determining an encryption node among a plurality of standby nodes for responding to the encryption request; Obtaining the node public key corresponding to each of the encryption nodes; The basic encrypted data is re-encrypted using the public key of each node to obtain multiple target encrypted data; sending the target encrypted data to each of the encryption nodes for storage in an interlaced manner, wherein a first encryption node does not receive the first encrypted data, the first encryption node receives the second encrypted data, the first encryption node is any one of the plurality of encryption nodes, the first encrypted data is encrypted by a first node public key corresponding to the first encryption node, the second encrypted data is encrypted by a second node public key corresponding to the second encryption node, and the second encryption node is any one of the plurality of encryption nodes except the first encryption node; After the encrypted data is sent interleaved to each of the encryption nodes for storage, the method further includes: Responding to an access request for the target encrypted data sent by a user; Sending the access request to the first encryption node; Acquire the second encrypted data sent by the first encryption node and stored in the first encryption node; Sending the second encrypted data to the second encryption node, so that the second encryption node decrypts the second encrypted data according to the private key corresponding to the second node public key to obtain the basic encrypted data; Obtaining the basic encrypted data sent by the second encryption node; The basic encrypted data is decrypted using the private key corresponding to the preset public key to obtain the data to be encrypted.

2. The method according to claim 1, characterized in that Before obtaining the node public key corresponding to each of the encryption nodes, the method further includes: Send a key generation instruction to each of the encryption nodes so that each of the encryption nodes generates a corresponding public key and private key using an asymmetric encryption algorithm according to the corresponding node IP.

3. The method according to claim 1, characterized in that: After obtaining the node public key corresponding to each of the encryption nodes, the method further includes: Obtaining the node ID of the encryption node; A correspondence between the node ID and the node public key is constructed, and the correspondence is stored in a preset database.

4. The method according to claim 3, characterized in that After acquiring the second encrypted data sent by the first encryption node and storing it with the first encryption node, the method further includes: Parsing the second encrypted data to obtain a second node public key corresponding to the second encrypted data; Searching the preset database for the node IP corresponding to the second node public key; The second encryption node is determined according to the node IP corresponding to the second node public key.

5. The method according to claim 1, characterized in that The step of determining an encryption node among the plurality of standby nodes for responding to the encryption request specifically includes: Obtaining the CPU usage of the standby node; It is determined that among the standby nodes, a standby node whose CPU usage is less than or equal to a preset threshold is the encryption node.

6. The method according to claim 1, characterized in that After decrypting the basic encrypted data using the private key corresponding to the preset public key to obtain the data to be encrypted, the method further includes: Performing hash calculation on the data to be encrypted to obtain a target hash value corresponding to the data to be encrypted; Determine whether the target hash value is consistent with a preset hash value; If the hash value is consistent with the preset hash value, it is determined that the data to be encrypted has not been tampered with.

7. A data storage encryption device, characterized in that: The device is used to execute the method according to any one of claims 1 to 6, and the device comprises: an acquisition module (201) and a processing module (202); The acquisition module (201) is used to respond to the encryption request of the user and acquire the data to be encrypted; The processing module (202) is used to encrypt the data to be encrypted using a preset public key to obtain basic encrypted data; The processing module (202) is further used to determine an encryption node among a plurality of standby nodes for responding to the encryption request; The acquisition module (201) is further used to acquire the node public key corresponding to each of the encryption nodes; The processing module (202) is further configured to perform secondary encryption on the basic encrypted data using the public keys of the nodes to obtain a plurality of target encrypted data; The processing module (202) is also used to interleave the target encrypted data to each of the encryption nodes for storage, wherein the first encryption node does not receive the first encrypted data, the first encryption node receives the second encrypted data, the first encryption node is any one of the multiple encryption nodes, the first encrypted data is encrypted by the first node public key corresponding to the first encryption node, the second encrypted data is encrypted by the second node public key corresponding to the second encryption node, and the second encryption node is any one of the multiple encryption nodes except the first encryption node.

8. An electronic device, characterized in that: The electronic device (300) comprises a processor (301), a memory (305), a user interface (303) and a network interface (304), wherein the memory (305) is used to store instructions, the user interface (303) and the network interface (304) are used to communicate with other devices, and the processor (301) is used to execute the instructions stored in the memory (305) so that the electronic device (300) executes the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed, the method according to any one of claims 1 to 6 is performed.

Images