Communication encryption method based on national cryptographic algorithm

Abstract

The embodiment of the invention discloses a communication encryption method based on a national secret algorithm, and the method comprises the steps: extracting original data from a communication data flow, carrying out the privacy protection processing of the original data, and obtaining first data; encrypting the first data according to the priority to obtain second data and a corresponding random key; processing the second data based on the first-class national cryptographic algorithm to obtain a hash value; encrypting a combination formed by the Hash value and the random key based on a second-class national cryptographic algorithm to obtain third data; and combining the third data with the second data to obtain a target encrypted data packet, and transmitting the target encrypted data packet to the target end. According to the method, multi-level encryption protection is realized through different national secret algorithms, data privacy protection and security are considered at the same time, the encryption effect can be ensured, and efficient data processing and transmission are realized while data security is ensured.

Description

Technical Field

[0001] The present disclosure relates to the field of network security technology, and in particular to a communication encryption method based on a national secret algorithm. Background Art

[0002] With the rapid development of information technology, data security and privacy protection have become the focus of social attention. Existing encryption technology can ensure data security to a certain extent, but it still has many shortcomings when facing complex network environments and diverse attack methods. Traditional encryption technology often finds it difficult to achieve efficient data processing and transmission while ensuring data security. Summary of the invention

[0003] In view of this, the embodiments of the present disclosure provide a communication encryption method based on a national secret algorithm, which can solve the problem of poor encryption effect in the prior art and the inability to achieve efficient data processing and transmission while ensuring data security.

[0004] In a first aspect, the present disclosure provides a communication encryption method based on a national secret algorithm, including:

[0005] Extracting original data from a communication data stream, performing privacy protection processing on the original data, and obtaining first data;

[0006] Encrypting the first data according to the priority to obtain second data and a corresponding random key;

[0007] Processing the second data based on the first type of national secret algorithm to obtain a hash value;

[0008] Encrypting the combination of the hash value and the random key based on the second type of national secret algorithm to obtain third data;

[0009] The third data is combined with the second data to obtain a target encrypted data packet, and the target encrypted data packet is transmitted to a target end.

[0010] Optionally, performing privacy protection processing on the original data to obtain first data includes:

[0011] Determining data sensitivity and a required privacy protection level based on the original data;

[0012] Determining a privacy budget of differential privacy based on the data sensitivity and the privacy protection level;

[0013] Determine random noise based on the original data and the privacy budget, and add the random noise to the original data to obtain the first data;

[0014] The privacy budget is ε, 0.1≤ε≤1.

[0015] Optionally, determining random noise based on the original data and the privacy budget, and adding the random noise to the original data to obtain the first data includes:

[0016] Determine a noise distribution mechanism; the noise distribution mechanism includes a Laplace distribution mechanism or a Gaussian distribution mechanism;

[0017] obtaining sensitivity of the original data;

[0018] Determine the random noise based on the sensitivity and the privacy budget;

[0019] The random noise is added to the original data based on the noise distribution mechanism to obtain the first data.

[0020] Optionally, encrypting the first data according to the priority to obtain the second data and the corresponding random key includes:

[0021] Obtaining a priority type of the first data, and determining a corresponding first preset national encryption algorithm based on the priority type;

[0022] Obtaining a random key based on the first preset national secret algorithm;

[0023] The first data is encrypted based on the random key and the first preset national encryption algorithm to obtain second data.

[0024] Optionally, obtaining the priority type of the first data includes: determining whether the first data contains a specific keyword, and if so, determining it as high priority data; if not, determining it as low priority data; or,

[0025] The obtaining the priority type of the first data includes: if the first data contains multiple priority types, sorting the data from high to low according to the priority, recording the first N sorted data as high priority data, and recording the last M sorted data as low priority data;

[0026] For high-priority data, the corresponding first preset national encryption algorithm is SM2 or SM3; for low-priority data, the corresponding first preset national encryption algorithm is SM4.

[0027] Optionally, encrypting a combination of a hash value and a random key based on a second type of national secret algorithm to obtain third data encrypting a combination of a hash value and a random key based on a second type of national secret algorithm to obtain third data includes:

[0028] Combining the Hash value with the random key to obtain combined data;

[0029] Obtain a public-private key pair corresponding to the second type of national encryption algorithm;

[0030] The combined data is encrypted using the public key in the public-private key pair to obtain the third data.

[0031] Optionally, combining the third data with the second data to obtain a target encrypted data packet includes: placing the third data at the beginning of the second data to obtain the target encrypted data packet.

[0032] Optionally, when the first preset national encryption algorithm is the SM4 algorithm, the method for obtaining the second data includes:

[0033] Dividing the first data into a plurality of 128-bit data blocks;

[0034] Encrypting each of the data blocks using the random key to obtain a ciphertext block;

[0035] If the size of the first data is not an integer multiple of 128 bits, padding the last data block to make it reach 128 bits;

[0036] The random key is a random 128-bit key.

[0037] Optionally, it also includes: randomly generating an initialization vector when encrypting each of the data blocks;

[0038] The encryption of the first data block includes: performing an XOR operation on the first data block and its corresponding initialization vector to obtain a first ciphertext block;

[0039] Starting from the second data block, each data block is XORed with the previous ciphertext block during encryption to obtain the corresponding ciphertext block.

[0040] Optionally, encrypting the first data according to the priority to obtain the second data and the corresponding random key includes:

[0041] Determine the federated learning model;

[0042] Using the historical privacy data on each local device to train the federated learning model, and uploading the trained model parameters of the federated learning model to the central server;

[0043] The central server uses an aggregation algorithm to aggregate several of the model parameters to obtain the global model YY+242199P

[0044] parameter;

[0045] The central server sends the global model parameters to each local device respectively;

[0046] In the local device corresponding to the communication data stream, the corresponding federated learning model is updated based on the global model parameters, and the first data is encrypted according to the priority based on the updated federated learning model and the preset strategy to obtain the second data and the corresponding random key.

[0047] In a second aspect, the embodiment of the present disclosure further provides a communication encryption system based on a national secret algorithm, including:

[0048] An extraction module, configured to extract original data from a communication data stream, and perform privacy protection processing on the original data based on a preset differential privacy protection strategy to obtain first data;

[0049] A first encryption module, used to encrypt the first data according to the priority based on a preset strategy to obtain second data and a corresponding random key;

[0050] A second encryption module, used to process the second data based on the first type of national secret algorithm to obtain a hash value;

[0051] A third encryption module is used to encrypt the combination of the hash value and the random key based on the second type of national secret algorithm to obtain third data;

[0052] A packaging module is used to combine the third data with the second data to obtain a target encrypted data packet, and transmit the target encrypted data packet to a target end.

[0053] In a third aspect, the embodiments of the present disclosure further provide a computer device, which adopts the following technical solution:

[0054] The computer device comprises:

[0055] at least one processor; and,

[0056] a memory communicatively connected to the at least one processor; wherein,

[0057] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute any of the above-mentioned communication encryption methods based on the national secret algorithm.

[0058] In a fourth aspect, an embodiment of the present disclosure further provides a computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable a computer to execute any of the above-mentioned communication encryption methods based on the national secret algorithm.

[0059] In a fifth aspect, an embodiment of the present disclosure further provides a computer program product, including a computer program / instruction, which implements the steps of any of the above methods when executed by a processor.

[0061] The communication encryption method based on the national secret algorithm disclosed in the present application realizes multi-level encryption protection through different national secret algorithms, while taking into account data privacy protection and security. Before data transmission, the original data is processed through the differential privacy protection strategy, which can effectively protect data privacy and prevent the leakage of sensitive information; the first data is encrypted according to the priority through the preset strategy, which can ensure the confidentiality of the data. Even if the data is intercepted during the transmission process, its content cannot be directly read; the encrypted data is hashed using the first type of national secret algorithm to generate a hash value, which can detect the integrity of the data. If any modification occurs to the data during the transmission process, the hash value will change, thereby providing integrity verification; finally, the combination of the hash value and the random key is encrypted through the second type of national secret algorithm to ensure the security of the key and data during the transmission process, and only the recipient with the corresponding private key can decrypt it; by using different encryption methods at different stages, that is, through data encryption, data integrity protection, key exchange security assurance, etc., the ability to resist various attacks can be effectively improved, that is, the method can not only meet the requirements of domestic security standards, but also significantly improve the security and reliability of data encryption, and ensure the confidentiality of communication data.

[0062] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the following preferred embodiments are specifically cited and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0064] Figure 1 A flowchart of a communication encryption method based on a national secret algorithm provided in an embodiment of the present disclosure.

[0065] Figure 2 A flowchart of a method for obtaining first data provided in an embodiment of the present disclosure.

[0066] Figure 3 A flowchart of a method for adding random noise provided in an embodiment of the present disclosure.

[0067] Figure 4 A flowchart of a method for encrypting first data according to priority based on a preset strategy provided in an embodiment of the present disclosure.

[0068] Figure 5 A flowchart of a method for obtaining third data provided in an embodiment of the present disclosure.

[0069] Figure 6 A flowchart of a method for obtaining second data when the first preset national encryption algorithm is the SM4 algorithm provided in an embodiment of the present disclosure.

[0070] Figure 7 A schematic diagram of a method flow chart of another embodiment of the present disclosure for encrypting first data according to priority based on a preset strategy.

[0071] Figure 8 A schematic diagram of the structure of a computer device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0072] The embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0073] It should be clear that the following embodiments of the present disclosure are described by specific specific examples, and those skilled in the art can easily understand other advantages and effects of the present disclosure from the contents disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all of the embodiments. The present disclosure can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present disclosure. It should be noted that the following embodiments and features in the embodiments can be combined with each other in the absence of conflict. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present disclosure.

[0074] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein may be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on the present disclosure, it should be understood by those skilled in the art that an aspect described herein may be implemented independently of any other aspect, and two or more of these aspects may be combined in various ways. For example, any number of aspects described herein may be used to implement the device and / or practice the method. In addition, other structures and / or functionalities other than one or more of the aspects described herein may be used to implement this device and / or practice this method.

[0075] It should also be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present disclosure. The drawings only show components related to the present disclosure rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed arbitrarily, and the component layout may also be more complicated.

[0076] Additionally, in the following description, specific details are provided to facilitate a thorough understanding of the examples. However, it will be understood by those skilled in the art that the aspects described may be practiced without these specific details.

[0077] Reference Figure 1 The present application discloses a communication encryption method based on a national secret algorithm, which specifically includes the following steps:

[0078] S100, extracting original data from a communication data stream, performing privacy protection processing on the original data based on a preset differential privacy protection strategy, and obtaining first data.

[0079] Specifically, assuming that the communication data stream contains personal information (such as name, address, etc.), first extract these raw data from the data stream; then, use a differential privacy-based strategy (such as adding Laplace noise or Gaussian noise) to process these data to obtain the first data; differential privacy ensures that even after the data is released, it is difficult to infer the specific information of a specific individual from it. Through differential privacy technology, even if the data is obtained by a third party, it is impossible to determine a specific personal information, thereby protecting user privacy, protecting the privacy of user data during storage and transmission, and reducing the risk of data leakage.

[0080] S200, encrypting the first data according to the priority based on the preset strategy to obtain the second data and the corresponding random key.

[0081] Specifically, the first data can be encrypted according to a set policy (for example, based on the sensitivity or importance of the data). For example, important personal information can be encrypted with a higher encryption intensity to generate the second data, and at the same time, a random key is generated for the encryption operation. After encryption, the data cannot be read or understood even if it is intercepted, protecting the confidentiality of the data; priority encryption based on the importance of the data can ensure a higher level of protection for sensitive data.

[0082] S300, processing the second data based on the first type of national encryption algorithm to obtain a hash value.

[0083] In this step, the hash value can be used to verify the integrity of the data and ensure that the data has not been tampered with during transmission; the hash value is calculated quickly and can effectively generate a unique representation of the data, and the hash value itself cannot be used to reversely deduce the original data.

[0084] S400, encrypting a combination of a hash value and a random key based on a second type of national encryption algorithm to obtain third data.

[0085] S500, combining the third data with the second data to obtain a target encrypted data packet, and transmitting the target encrypted data packet to a target end;

[0086] Among them, the first type of national secret algorithm is different from the second type of national secret algorithm, that is, they are different types of national secret algorithms.

[0087] In this embodiment, the third data is placed at the beginning of the second data to obtain a target encrypted data packet.

[0088] In this step, the encrypted data and key are combined to ensure that the data can maintain confidentiality and integrity during transmission.

[0089] The communication encryption method based on the national secret algorithm disclosed in the present application realizes multi-level encryption protection through different national secret algorithms, while taking into account data privacy protection and security. Before data transmission, the original data is processed through the differential privacy protection strategy, which can effectively protect data privacy and prevent the leakage of sensitive information; the first data is encrypted according to the priority through the preset strategy, which can ensure the confidentiality of the data. Even if the data is intercepted during the transmission process, its content cannot be directly read; the encrypted data is hashed using the first type of national secret algorithm to generate a hash value, which can detect the integrity of the data. If any modification occurs to the data during the transmission process, the hash value will change, thereby providing integrity verification; finally, the combination of the hash value and the random key is encrypted through the second type of national secret algorithm to ensure the security of the key and data during the transmission process, and only the recipient with the corresponding private key can decrypt it; by using different encryption methods at different stages, that is, through data encryption, data integrity protection, key exchange security assurance, etc., the ability to resist various attacks can be effectively improved, that is, the method can not only meet the requirements of domestic security standards, but also significantly improve the security and reliability of data encryption, and ensure the confidentiality of communication data.

[0090] Reference Figure 2 The method for obtaining the first data specifically includes the following steps:

[0091] A100,determines data sensitivity and the required privacy protection level based on the original data.

[0092] Specifically, suppose we have a set of user data, including name, email address, and health records; first, we need to perform a sensitivity assessment on this data: the name can be considered medium sensitivity because it can be used to identify an individual, but a single name usually does not expose sensitive information; the email address is of high sensitivity because it can be used for spam or identity theft; the health record is of very high sensitivity because it contains private health information. Based on these assessments, we can determine the required level of privacy protection; therefore, for emails and health records, the privacy protection level can be set to high, and for names, the privacy protection level can be set to medium.

[0093] By assessing data sensitivity, we can provide appropriate privacy protection levels for different types of data, invest more resources and energy in protecting sensitive data, and ensure the effectiveness of protection measures.

[0094] A200,determines the privacy budget of differential privacy based on data sensitivity and privacy protection level.

[0095] Privacy budget is a key concept in differential privacy, which quantifies the amount of private information that is allowed to be leaked. For highly sensitive health records, a smaller privacy budget is set to obtain stronger privacy protection; for moderately sensitive data, such as email addresses, a larger privacy budget is set to balance privacy protection with data practicality.

[0096] By adjusting the privacy budget, the intensity of privacy protection can be flexibly controlled and optimized according to different privacy needs and data usage scenarios, so that privacy protection measures can be adjusted according to specific business needs and data sensitivity, thereby improving the protection effect.

[0097] Differential privacy is a mathematical framework used to quantify the risk of personal privacy leakage when data is released and reduce this risk by adding random noise.

[0098] A300, determines random noise based on the original data and the privacy budget, and adds the random noise to the original data to obtain first data;

[0099] Among them, the privacy budget is ε, 0.1≤ε≤1.

[0100] The privacy budget controls the strength of differential privacy protection. A smaller ε value can provide stronger privacy protection but may cause more data distortion; a larger ε value provides weaker privacy protection but less data distortion.

[0101] In this step, adding random noise can effectively hide individual information so that the data will not be leaked to the specific individual level, while still retaining the overall statistical characteristics of the data. Even if the data is obtained by a third party, the noise mechanism of differential privacy can ensure that the inference of individual information will not be accurate, thereby protecting user privacy.

[0102] The first data acquisition method disclosed in this embodiment ensures the protection of individual privacy during data sharing and analysis and prevents user information from being leaked through differential privacy technology; through data sensitivity assessment and privacy budget adjustment, it can provide appropriate privacy protection according to the sensitivity of different types of data and achieve refined management; different noise levels are selected according to the privacy budget to achieve a balance between privacy protection and data availability to meet business needs and privacy requirements; the privacy budget can be adjusted according to actual conditions and regulatory requirements to make privacy protection measures more flexible and adaptable to different data protection scenarios; although the data has been processed for privacy protection, the statistical characteristics of the data can still be retained to support effective data analysis and mining; the use of differential privacy protection technology can help organizations comply with various privacy regulations, such as GDPR or CCPA, and reduce legal risks.

[0103] Through the above steps, the overall solution can ensure the practicality and integrity of data while protecting user privacy, achieving the dual goals of privacy protection and data analysis.

[0104] For example, for highly sensitive medical data, one might choose ε = 0.1; for less sensitive demographic data, one might choose ε = 0.5.

[0105] Reference Figure 3 , the methods of adding random noise specifically include:

[0106] A310, determining a noise distribution mechanism; the noise distribution mechanism includes a Laplace distribution mechanism or a Gaussian distribution mechanism.

[0107] Among them, the Laplace distribution mechanism is suitable for numerical data, such as age, sales, etc.; the Gaussian distribution mechanism is suitable for numerical data, and due to its wider tail, it provides additional protection for highly sensitive data.

[0108] In this step, the most suitable noise distribution mechanism is selected according to the type and sensitivity of the data to provide effective privacy protection.

[0109] A320, obtain the sensitivity of the original data.

[0110] Sensitivity refers to the maximum magnitude of change in function output caused by a single record change in the data; for raw data (such as personal income), it is necessary to assess the specific sensitivity of the data to a single record change; for example, if the estimated change in income will cause a serious violation of personal privacy, then the data is considered to be highly sensitive.

[0111] In this step, the determination of sensitivity helps quantify the degree of data privacy protection, provides precise guidance for the subsequent addition of noise, helps understand the characteristics of the data, and is instructive for the formulation and implementation of data protection measures.

[0112] A330,Determining random noise based on sensitivity,privacy budget.

[0113] According to the noise mechanism, calculate the amplitude of random noise. For Laplace distribution, the required noise size can be obtained according to the following calculation formula: where σ is the amount of noise added, Δf is the sensitivity of the data, and ε is the set privacy budget (e.g., if ε = 0.1 and the sensitivity is 1, then σ is 10.

[0114] By calculating the required amount of noise, we ensure that the protection effect of differential privacy matches the size of the noise. By controlling the size of the noise, we can balance the relationship between privacy protection and data availability.

[0115] A340, adding random noise to the original data based on a noise distribution mechanism to obtain first data.

[0116] In this step, random noise is generated using a determined noise distribution mechanism and added to the original data. For example, using a Laplace distribution mechanism, the original data will be added with the randomly generated YY+242199P

[0117] Laplace distributed noise.

[0118] By adding random noise to the original data, the privacy of the data is enhanced, and even if it is leaked in the form of data, specific individuals cannot be easily identified; even if the data is processed with privacy protection, it still retains its usefulness for certain statistical analyses.

[0119] The method disclosed in this embodiment ensures an appropriate level of privacy protection measures to prevent the leakage of specific personal information by quantifying the sensitivity of the data and setting a privacy budget; evaluates the sensitivity of the original data to ensure the pertinence and accuracy of the protection measures; selects an appropriate noise distribution mechanism to provide flexibility in protecting data privacy, and can impose sufficient privacy protection according to different data types and requirements; protects privacy by adding noise, and can also retain the basic statistical characteristics of the data, providing necessary data support for some important data analysis and statistics; and effectively implements differential privacy technology to ensure that data processing activities comply with relevant data protection laws and standards.

[0120] This series of steps ensures that data privacy is properly protected while also preserving the usefulness of the data and supporting processing operations that comply with data protection regulations.

[0121] Reference Figure 4 The method for encrypting the first data according to the priority based on the preset strategy specifically includes the following steps:

[0122] S210, obtaining a priority type of the first data, and determining a corresponding first preset national encryption algorithm based on the priority type.

[0123] Different encryption algorithms are used for data of different priorities to ensure stronger protection for important data while improving system efficiency. In addition, encryption strategies can be flexibly adjusted according to data priority to meet different security needs.

[0124] S220, obtaining a random key based on a first preset national encryption algorithm.

[0125] The generation of random keys ensures the uniqueness of each encryption operation and increases the strength of data protection; each encryption operation uses a different key to prevent potential security risks caused by key reuse.

[0126] S230, encrypt the first data based on the random key and the first preset national encryption algorithm to obtain second data.

[0127] Through encryption, we ensure that data cannot be read or modified by unauthorized third parties during storage and transmission. The use of national secret algorithms ensures that the encryption method complies with national security standards and enhances the compliance and credibility of the system.

[0128] Among them, the first preset national secret algorithm, the first type of national secret algorithm and the second type of national secret algorithm are all different, YY+242199P

[0129] That is, they are different types of national secret algorithms.

[0130] The method disclosed in this embodiment ensures the security of data at all levels and meets the protection requirements of different data types by selecting appropriate encryption algorithms for data of different priorities; dynamically selects encryption algorithms based on the priority of data, so that the system can flexibly adjust the protection strategy according to actual needs, thereby improving the adaptability of the system; uses the strongest symmetric encryption algorithm for high-priority data to provide the highest level of protection; uses appropriate algorithms for medium and low-priority data to balance security and performance and ensure data privacy; uses national secret algorithms to ensure that the encryption method complies with national security standards and improves the compliance and credibility of the system; generates a unique random key for each encryption operation, reducing the security risks that may be caused by key reuse; and achieves efficient privacy protection through a combination of different algorithms and strategies, ensuring the security of data during storage and transmission while ensuring the efficiency of data processing.

[0131] Through the above steps, data can be effectively encrypted with priority to ensure data confidentiality and security, while improving the flexibility and adaptability of the system.

[0132] Furthermore, for the priority type of obtaining the first data, the corresponding first preset national encryption algorithm is determined based on the priority type, assuming that we have obtained the privacy-protected first data from the communication data stream and determined its privacy protection level and priority.

[0133] For example, data is classified into three priority types: high, medium, and low. High priority is such as the user's health record; medium priority is such as an email address; low priority is such as the user's name. According to the priority type, the corresponding national encryption algorithm is selected; high priority can choose SM4 (symmetric encryption algorithm) for encryption to ensure the highest level of security; medium priority can choose SM2 (elliptic curve public key encryption algorithm) for encryption to balance security and performance; low priority can choose SM3 (hash algorithm) for processing to protect the integrity of the data.

[0134] For encrypting the first data based on the random key and the first preset national secret algorithm to obtain the second data, specifically, the first data is encrypted using the random key generated in step S220 and the selected national secret algorithm. For example: for high-priority data, the first data can be encrypted using the random key generated by SM4; for medium-priority data, the first data can be encrypted using the SM2 public key; for low-priority data, since SM3 is a hash algorithm, it is mainly used to generate a hash value of the data rather than encrypt it, and the data is hashed at this stage to obtain the hash value; the encrypted data is the second data, which can be processed or transmitted in subsequent steps.

[0135] In this embodiment, obtaining the priority type of the first data includes: determining whether the first data contains a specific keyword, if so, determining it as high priority data, if not, determining it as low priority data.

[0136] Alternatively, obtaining the priority type of the first data includes: if the first data contains multiple priority types, sorting them from high to low according to the priority, recording the first N sorted data as high priority data, and recording the last M sorted data as low priority data. Specifically, a) defining priority classification standards (for example: high, medium, low); b) analyzing the sensitivity and importance of the data; c) classifying the data according to predefined standards; d) storing the classified data in a corresponding data structure.

[0137] For high-priority data, the corresponding first preset national encryption algorithm is SM2 or SM3;

[0138] For low-priority data, the corresponding first preset national encryption algorithm is SM4.

[0139] For high-priority data, use the SM2 or SM3 algorithm. SM2 is a public key encryption algorithm based on elliptic curves that provides high security and is suitable for encrypting high-priority data. Specifically, a) generate an SM2 key pair (public key and private key); b) use the SM2 public key to encrypt high-priority data; c) securely store the SM2 private key for subsequent decryption.

[0140] The SM2 algorithm is based on elliptic curve cryptography and provides a high level of security. The generated key pair is used to protect the encryption and decryption of data. A different key pair can be generated for each encryption operation, which improves the flexibility and security of key management. Public key encryption ensures that only those who hold the corresponding private key can decrypt the data, thereby protecting the confidentiality of high-priority data. The SM2 algorithm has a high level of security, making it difficult for encrypted data to be cracked by unauthorized third parties.

[0141] The SM2 private key is securely stored in a protected environment, such as an encrypted keystore, hardware security module (HSM), or secure server. The private key is the key to decryption, so it must be protected from unauthorized access to ensure that only authorized users can decrypt data. Proper storage of the private key prevents its loss or leakage, ensuring the availability and integrity of data decryption.

[0142] High-priority data is encrypted using the SM2 algorithm to ensure its confidentiality and integrity during storage and transmission, preventing data leakage or tampering.

[0143] The SM2 algorithm is based on elliptic curve cryptography and provides high security. It offers stronger security protection than traditional algorithms at the same key length and is suitable for encryption of sensitive data. By generating and using SM2 key pairs, encryption and decryption operations are completed by public and private keys respectively, and the security and flexibility of key management are guaranteed. By securely storing private keys, unauthorized access is prevented, ensuring that only authorized users can decrypt data, thereby protecting data privacy. The application of the SM2 algorithm can flexibly respond to various data protection needs and is suitable for fields such as finance, medical care, and government that require high-security data protection.

[0144] SM3 is a message digest algorithm used to generate a hash value for data to verify the integrity of the data.

[0145] For low-priority data, the SM4 algorithm is used. SM4 is a block cipher algorithm with high computational efficiency and is suitable for encrypting large amounts of data. Therefore, it is used for low-priority data. The specific implementation steps include: a) generating SM4 keys; b) using the SM4 algorithm to encrypt low-priority data; c) securely storing SM4 keys for subsequent decryption.

[0146] The key length of the SM4 algorithm is fixed at 128 bits, which is suitable for encryption operations of large-scale data. It has high computational efficiency and a simple and fast key generation process, which can meet the scenarios where keys need to be generated frequently. The SM4 algorithm is designed to efficiently process large-scale data, with fast encryption speed, and is suitable for encryption of low-priority data. The SM4 algorithm is relatively simple to implement and can be directly operated using existing symmetric encryption libraries. Secure storage of keys ensures that only authorized personnel or systems can access the keys, thereby protecting the security of encrypted data. Effective key management prevents key loss or leakage, ensures that data can be correctly decrypted, and maintains data confidentiality.

[0147] By judging keywords or sorting methods, data can be classified according to their sensitivity and importance, so that high-priority data can be more strongly protected, while low-priority data can use simpler protection measures; if the data classification method changes, only the keywords or sorting rules need to be adjusted to meet different data protection needs; high-priority data uses asymmetric encryption algorithms to facilitate key management and data exchange, and low-priority data uses symmetric encryption algorithms to improve data processing efficiency; using national secret algorithms SM2, SM3, and SM4 can ensure that data encryption methods and key exchange technologies comply with local laws and regulations, thereby enhancing data protection and compliance.

[0148] In these embodiments, by selecting appropriate national encryption algorithms according to different strategies, the purpose of hierarchical protection of data can be achieved, while taking into account the needs of different data types and scenarios, making the overall privacy protection solution more flexible and effective.

[0149] Reference Figure 5 , the method for obtaining the third data specifically includes:

[0150] S610, combining the hash value with the random key to obtain combined data.

[0151] In this step, the combination method can be to directly connect the two data objects together, or to use a fixed separator between the two data objects, such as a specific character or byte, or to add the length information of each part in front of the data.

[0152] S620, obtaining a public-private key pair corresponding to the second type of national encryption algorithm.

[0153] Assuming that the second type of national secret algorithm is SM2 (used for public key encryption), you need to generate an SM2 public key and private key pair, and then save and manage the generated public key and private key, usually in PEM format, for use in the encryption and decryption process.

[0154] In this step, the public-private key pair can ensure the security of encryption operations. The public key is used for encryption and the private key is used for decryption, ensuring the confidentiality of data during transmission. Generating a key pair makes key management and distribution more standardized, ensuring the security of the system.

[0155] S630, using the public key in the public-private key pair to encrypt the combined data to obtain third data.

[0156] In this step, the combined data is encrypted using a public key to ensure that the data cannot be accessed by unauthorized persons during storage and transmission.

[0157] The third data acquisition method disclosed in this embodiment combines the hash value with the encrypted data, which helps to protect the integrity of the data and prevent the data from being tampered with during storage or transmission; the use of public key encryption ensures the confidentiality of the data and avoids unauthorized access; the hash value, as the fingerprint of the data, can verify the integrity of the data during encryption and transmission, making the detection of data tampering more reliable; after combining the hash value with the encrypted data, any tampering of the "combined data" will cause the hash value to not match, so that the integrity of the data can be verified after decryption. In this way, even if the data is tampered with, it will be discovered in subsequent verification.

[0158] In this embodiment, public key encryption is used to ensure that only the recipient with the private key can decrypt the data, which provides a secure way to exchange data and avoids the risk of data being stolen or leaked during transmission.

[0159] The use of national encryption algorithms (such as SM2) and hash algorithms (such as SM3) complies with national encryption standards and ensures the compliance of the solution. At the same time, national encryption algorithms generally have good performance and compatibility and are suitable for various application scenarios. Combining data encryption and integrity protection can protect users' privacy data to a greater extent and reduce the risk of data leakage. By combining hash values ​​and encrypted data, it is possible to support auditing and monitoring of data. This is particularly important for application scenarios that require regular verification of data integrity, such as financial transaction records, medical data, etc.

[0160] Through such a solution, data security protection can be achieved at different levels to ensure the confidentiality, integrity and availability of data throughout its life cycle. This multi-level protection mechanism not only improves data security, but also improves the overall reliability and compliance of the system.

[0161] Reference Figure 6 When the first preset national encryption algorithm is the SM4 algorithm, the method for obtaining the second data includes:

[0162] B100, dividing the first data into a plurality of 128-bit data blocks.

[0163] Assuming that the first data is a piece of text or binary data, its size may not be an integer multiple of 128 bits. For example, assuming that the first data size is 1024 bits (128 bytes), it can be divided into 8 data blocks of 128 bits (16 bytes).

[0164] In practice, segmentation can be achieved using data slicing functionality in programming languages; for larger data sets, similar logic can be applied to files or streaming data.

[0165] B200, encrypt each data block using a random key to obtain a ciphertext block;

[0166] If the size of the first data is not an integer multiple of 128 bits, pad the last data block to make it 128 bits;

[0167] The random key is a random 128-bit key.

[0168] In this step, each data block is encrypted independently, which improves data security. Even if a ciphertext block is cracked, the contents of other data blocks cannot be known; each data block is encrypted with the same key, ensuring the consistency and decryptability of the entire data set.

[0169] If the size of the first data is not an integer multiple of 128 bits, such as 1232 bits (154 bytes), the last data block needs to be padded to make it 128 bits. The most common padding method is PKCS7 padding. Padding ensures that the size of the data block meets the algorithm requirements so that the data can be correctly encrypted and decrypted; through padding, it ensures that even if the original data length does not meet the block size requirements, it can adapt to the working mode of the encryption algorithm.

[0170] The method disclosed in this embodiment ensures that data can be correctly encrypted and decrypted by dividing the data into blocks of fixed size; using a randomly generated 128-bit key for encryption provides a high degree of security; the use of a random key reduces the risk of key reuse and prediction, and improves the encryption strength.

[0171] The data is divided into multiple blocks for encryption. Even if one of the blocks is cracked, it will not affect the security of other blocks. The encryption of each data block is independent, which improves the security of the overall data. The padding process ensures that the size of the data block meets the requirements of the encryption algorithm, so that the encryption process is not limited by the data length and the integrity of the data is maintained.

[0172] Processing data into blocks and applying the same key for encryption simplifies the implementation of encryption operations and improves processing efficiency. This block encryption method is very suitable for processing large amounts of data. By dividing the data into blocks and encrypting them, large-scale data sets can be effectively managed and processed.

[0173] Overall, this approach ensures the security, integrity, and consistency of data during the encryption process, while meeting the requirements of the SM4 algorithm, making the data encryption and decryption process more reliable and efficient.

[0174] Furthermore, the communication encryption method based on the national secret algorithm disclosed in the present application also includes: randomly generating an initialization vector (IV) when encrypting each data block.

[0175] Encrypting the first data block includes: performing an XOR operation on the first data block and its corresponding initialization vector to obtain a first ciphertext block;

[0176] Starting from the second data block, each data block is XORed with the previous ciphertext block during encryption to obtain the corresponding ciphertext block.

[0177] In previous data block encryption, the encryption of each data block is performed independently; in this scheme, the encryption of each data block depends not only on the current data block, but also on the ciphertext of the previous encrypted block. This can eliminate the problem of the same plaintext block generating the same ciphertext block and improve the security of encryption.

[0178] The introduction of IV ensures that even the same plaintext data block will generate different ciphertext blocks in different encryption operations, which prevents the problem of pattern repetition in the encryption process; V is unique and random in each encryption operation, so the encryption result is more unpredictable, which improves the overall encryption security. That is, the randomness of the initialization vector increases the complexity of encryption, avoids the same data block from generating the same ciphertext in different encryption operations, and improves the encryption strength; the random initialization vector prevents pattern analysis attacks in the encryption mode, making the encryption result more random and unpredictable.

[0179] The first data block (assuming block1) and its initialization vector (assuming iv1) are XORed, and then the result is encrypted. By performing an XOR operation with the initialization vector, even if the original data block is the same, the ciphertext will be different due to the different initialization vectors, which increases the randomness of the ciphertext; even if the data block content is the same, different initialization vectors will produce different ciphertexts, thereby preventing replay attacks and pattern recognition attacks.

[0180] For the second and subsequent data blocks (assuming block2, block3, ...), an XOR operation is performed with the previous ciphertext block (assuming prev_ciphertext), and then the result is encrypted. The encryption result of each data block depends on the ciphertext of the previous data block, which forms a chain encryption mode. In this way, any tampering with the ciphertext will affect the decryption of subsequent ciphertext blocks, increasing the protection of data integrity; since each data block is XORed with the previous ciphertext block, attackers cannot independently crack each data block, enhancing the security of the overall data.

[0181] The method disclosed in this embodiment uses a random initialization vector and a strategy of XORing each data block with the previous ciphertext block, which increases the complexity of the encryption process, making the ciphertext more random and unpredictable, thereby improving the encryption strength; the initialization vector and chain encryption mode effectively prevent pattern analysis attacks. Since the encryption result of each data block depends on the previous ciphertext block, attackers cannot infer the pattern or structure of the data from the ciphertext.

[0182] Through chain encryption, the tampering of each data block will affect the subsequent ciphertext blocks, increasing data integrity protection. If the ciphertext is tampered with, it will cause decryption failure, which helps detect and prevent data tampering; using random initialization vectors and chain encryption mode prevents replay attacks. Even if the data content is the same, the generated ciphertext will be different through different initialization vectors and the dependency relationship of the previous ciphertext block, thus avoiding replay attacks.

[0183] This method can process data of different lengths, and at the same time provides a flexible and secure encryption mechanism through initialization vectors and chain encryption to meet the needs of various application scenarios.

[0184] In summary, the use of initialization vectors and chain encryption methods can significantly improve the security of encryption, prevent various attack methods, and ensure the confidentiality and integrity of data during transmission and storage.

[0185] Among them, IV is a randomly generated value of fixed length used in the encryption process. IV is used to increase the randomness and unpredictability of data during the encryption process.

[0186] Reference Figure 7 , encrypting the first data according to the priority based on the preset strategy to obtain the second data and the corresponding random key, specifically including:

[0187] S210, determine the federated learning model.

[0188] Specifically, select a suitable federated learning model and perform initialization settings according to application requirements. For example, select a model based on deep learning, such as convolutional neural network (CNN) for image recognition tasks, or recurrent neural network (RNN) for time series prediction tasks; determine the structure and parameter configuration of the model, for example, the CNN model can contain multiple convolutional layers, pooling layers, and fully connected layers.

[0189] In this step, choosing the right model structure can better adapt to specific tasks and data types, improve training effects and prediction accuracy; choosing the right model based on task requirements and data characteristics can better meet business needs and application scenarios.

[0190] S220, use the historical privacy data to train the federated learning model on each local device, and upload the model parameters of the trained federated learning models to the central server.

[0191] Each local device uses local historical privacy data (such as user transaction records, medical data, etc.) to train the selected federated learning model.

[0192] Among them, historical privacy data refers to encrypted data that has been processed through privacy protection.

[0193] After training is completed, each device uploads the trained model parameters (such as weights and biases) to the central server.

[0194] In this step, data is only processed and trained locally and will not be uploaded directly to ensure the security of user privacy data. The computing resources of each local device are used for model training to improve training efficiency and speed.

[0195] S230, the central server aggregates several model parameters using an aggregation algorithm to obtain global model parameters.

[0196] The central server uses aggregation algorithms such as FedAvg to aggregate the model parameters uploaded by each device to obtain the global model parameters.

[0197] In this step, by aggregating the parameters of each local model, the central server can obtain a globally optimized model that comprehensively considers the characteristics of all local data; ensuring that the model parameters used by all local devices remain consistent, facilitating subsequent model updates and applications.

[0198] S240, the central server sends the global model parameters to each local device respectively.

[0199] In this step, the global model parameters are transferred to each local device, enabling them to use the updated model for further data processing and task execution.

[0200] For example, the model parameters are packaged as files or serialized data and sent to each device through a secure communication channel (such as encrypted transmission).

[0201] All local devices use the same global model, ensuring model consistency; centralized management and distribution of model parameters improves transmission efficiency and security.

[0202] S250, in the local device corresponding to the communication data stream, the corresponding federated learning model is updated based on the global model parameters, and the first data is encrypted according to the priority based on the updated federated learning model and the preset strategy to obtain the second data and the corresponding random key.

[0203] In this step, after receiving the global model parameters, the local device updates the local model parameters, uses the updated model to process the new data, and encrypts the data according to the preset policy.

[0204] The updated model can better handle new data and improve the accuracy of data processing and encryption; prioritize data encryption according to preset policies to ensure that important data is protected first; ensure the security of data during transmission through encryption to prevent data leakage and tampering.

[0205] The method disclosed in this embodiment, federated learning ensures that private data does not leave the local device, protects user privacy, and model training and parameter updates are performed on a central server, reducing the risk of data leakage; distributed training utilizes the computing power of each local device to improve the efficiency and speed of model training, and the aggregation algorithm optimizes the global model so that it comprehensively considers all local data; the global model is optimized by the training data of each local device, which can better adapt to actual application scenarios and improve the accuracy and generalization ability of the model.

[0206] Data is encrypted with priority according to preset strategies, and the use of random keys increases the security of encryption, ensuring the confidentiality and integrity of data during transmission and storage; the central server distributes the updated model parameters to each local device, ensuring the consistency and global coordination of the model, and improving the availability and reliability of the system.

[0207] This solution can adapt to various data processing needs. By updating models and encryption strategies, it can realize flexible data processing and protection mechanisms to meet the needs of different application scenarios.

[0208] Overall, this communication scheme based on federated learning and encryption improves the security, privacy protection, and model performance of data processing, making the system more efficient and reliable when processing sensitive data.

[0209] Furthermore, some metadata, such as encryption timestamp, algorithm version used, etc., can be added after the third data is combined with the second data, and then the target encrypted data packet is formed. Adding metadata (such as encryption timestamp, algorithm version used, etc.) during the data encryption process, recording the encryption timestamp helps to track the encryption history of the data, understand the creation and encryption time of the data, and facilitate subsequent auditing and management; for example, it can help identify the latest encrypted version of the data and whether the data is encrypted within the expected time; recording the algorithm version used helps to ensure that the data can be correctly decrypted in the future. For example, if there are different versions of the algorithm, incompatibility may occur. The version information helps to use the correct decryption algorithm during decryption to avoid data decryption failure caused by mismatched algorithm versions. Recording encryption-related metadata can support audit work and ensure that encryption operations comply with company policies, regulatory requirements or industry standards; for example, in the financial or medical industries, recording encryption time and algorithm version can prove that data processing meets the specified compliance requirements. Metadata can help verify the integrity and security of data encryption and confirm the consistency and correctness of data during the encryption process. Metadata such as timestamp and algorithm version information make it easier to determine the encryption method and version used during the decryption process to ensure the correctness of decryption. For example, if decryption failures are discovered, the version information can help determine whether the algorithm needs to be updated or the decryption strategy needs to be adjusted.

[0210] In the event of data loss or damage, metadata can provide encryption history information to facilitate data recovery and re-encryption operations; recording encryption timestamps can help manage the life cycle of keys, such as references for periodic key replacement or updating encryption policies, and tracking key usage through timestamps to help decide when to update or discard keys; recording algorithm versions and timestamps can prevent forgery and tampering of encrypted data. Any modification will cause metadata mismatches and can be detected. The transparency of metadata improves the credibility of data protection, and users and auditors can clearly understand the process and method of data encryption.

[0211] The methods of adding metadata during the encryption process usually include: embedding a data structure containing metadata in the encrypted data, such as JSON format or a custom format; adding a metadata header at the beginning of the encrypted data. The header information can be parsed during decryption to obtain relevant metadata; the metadata and encrypted data are stored separately, the metadata file contains detailed information about the encryption operation, and the data file contains the actual encrypted content. Adding metadata (such as encryption timestamp, algorithm version used, etc.) during the encryption process can not only improve the efficiency of data management, auditing and decryption, but also enhance the effectiveness of data protection and key management. This practice helps to ensure the transparency, reliability and compliance of data encryption operations and improve the overall level of data protection.

[0212] After being transmitted to the target end, the target end decrypts the target encrypted data packet, specifically including: separating the second type of national secret algorithm encryption part (including the random key of the first preset national secret algorithm, the hash value processed by the first type of national secret algorithm) from the first preset national secret algorithm encryption part (the actual file content) in the target encrypted data packet; if there is metadata, extract the metadata, that is, obtain the timestamp, algorithm version and other information of the encryption process.

[0213] Use the second type of national encryption algorithm to decrypt the part containing the random key and hash value of the first preset national encryption algorithm. Specifically, use the recipient's second type of national encryption algorithm private key to decrypt, so as to obtain the random key of the first preset national encryption algorithm and the hash value processed by the first type of national encryption algorithm.

[0214] Then, the first preset national secret algorithm is used to decrypt the file content, that is, the random key corresponding to the first preset national secret algorithm obtained by decryption is used to decrypt the file content. Specifically, the encrypted file content is decrypted using the random key corresponding to the first preset national secret algorithm, and the same CBC mode and IV (initialization vector) as used for encryption are used to ensure correct decryption.

[0215] The next step is integrity verification, which aims to ensure that the data has not been tampered with during transmission. Specifically, the hash value is calculated, that is, the actual hash value is calculated for the decrypted file content; the hash value is compared, that is, the calculated hash value is compared with the previously decrypted hash value. If they are consistent, it means that the file has not been tampered with.

[0216] In addition, key management is also included. For secure storage of private keys, hardware security modules (HSM) and other means can be used to securely store the private keys of the second type of national secret algorithms. For key updates, the key pairs of the second type of national secret algorithms can be updated regularly to enhance long-term security.

[0217] Ensure that all random numbers (such as random keys, IVs) use cryptographically secure random number generators.

[0218] Furthermore, SM4 variants of different strengths (128 bits or 256 bits) can be selected according to data sensitivity.

[0219] The solution disclosed in this embodiment can improve the efficiency of SM4 encryption of large files through parallel processing; for very large files, block encryption and decryption are adopted to reduce memory usage; and the encryption and decryption speed is improved by using a hardware accelerator that supports the national encryption algorithm.

[0220] For example, it can be applied to enterprise data transmission, that is, it describes an application scenario in which a large enterprise transmits sensitive financial data between multiple branches, including encryption, transmission, decryption and integrity verification.

[0221] Furthermore, the present application also includes error handling and abnormal situations. For key loss, an emergency recovery mechanism can be set up, such as key backup.

[0222] When integrity verification fails, i.e. when the SM3 hash does not match, the administrator can be alerted to prevent data leakage. For decryption failures, an error message can be logged and an attempt can be made to use the backup key.

[0223] Furthermore, the present application also includes compliance and auditing, including logging (i.e. recording detailed information of all encryption and decryption operations), access control (i.e. strictly controlling the permissions for decryption operations), and audit tracking (i.e. regularly reviewing logs to detect anomalies).

[0224] The solution disclosed in this application has future scalability, can perform algorithm updates, reserve expansion space for possible future algorithm updates, can achieve cross-platform compatibility, ensure that the system can be used on different operating systems and devices, and can also achieve security measure integration, that is, integration with other security measures (such as intrusion detection systems).

[0225] This example provides a comprehensive encryption and decryption solution, covering details from data unpacking, encryption and decryption using different national secret algorithms, integrity verification, to security considerations, performance optimization, application scenarios, error handling, compliance, etc.; it shows how to combine technical implementation details with actual operations, management and future development to provide strong data protection capabilities while ensuring the flexibility and scalability of the system.

[0226] Furthermore, the communication encryption method based on the national secret algorithm disclosed in this application also includes verification of the results after privacy protection, specifically including: a) statistical analysis of the processed data; b) comparison of key indicators of the original data and the processed data; c) formal proof or empirical analysis of differential privacy; d) if necessary, adjustment of the privacy budget or noise mechanism.

[0227] Specifically, a number of original data are extracted from the communication data stream, and a privacy budget of differential privacy is determined based on the number of original data; random noise is determined based on the number of original data and the privacy budget, and the random noise is added to the number of original data to obtain a number of first data; a first average value of the number of original data and a second average value of the number of first data are respectively obtained; an actual error between the first average value and the second average value is obtained. If the actual error is smaller than the expected error, it means that the privacy protection meets expectations. If the actual error is not smaller than the expected error, the privacy budget or the noise distribution mechanism is adjusted.

[0228] The second aspect of the present application discloses a communication encryption system based on a national secret algorithm, comprising:

[0229] An extraction module, used to extract original data from the communication data stream, perform privacy protection processing on the original data based on a preset differential privacy protection strategy, and obtain first data;

[0230] A first encryption module, used to encrypt the first data according to the priority based on a preset strategy to obtain second data and a corresponding random key;

[0231] A second encryption module is used to process the second data based on the first type of national secret algorithm to obtain a hash value;

[0232] A third encryption module is used to encrypt a combination of a hash value and a random key based on a second type of national secret algorithm to obtain third data;

[0233] The packaging module is used to combine the third data with the second data to obtain a target encrypted data packet, and transmit the target encrypted data packet to a target end.

[0234] It should be noted that the solutions in the communication encryption method based on the national secret algorithm disclosed in the first aspect of this application are all applicable to the communication encryption system based on the national secret algorithm disclosed in the second aspect of this application, so they will not be described one by one here.

[0235] The computer device according to the embodiment of the present disclosure includes a memory and a processor. The memory is used to store non-temporary computer-readable instructions. Specifically, the memory may include one or more computer program products, and the computer program product may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may, for example, include a random access memory (RAM) and / or a cache memory (cache), etc. The non-volatile memory may, for example, include a read-only memory (ROM), a hard disk, a flash memory, etc.

[0236] The processor may be a central processing unit (CPU) or other forms of processing units with data processing capabilities and / or instruction execution capabilities, and may control other components in the computer device to perform desired functions. In one embodiment of the present disclosure, the processor is used to run the computer-readable instructions stored in the memory, so that the computer device executes all or part of the steps of the communication encryption method based on the national secret algorithm of each embodiment of the present disclosure.

[0237] Those skilled in the art should be able to understand that in order to solve the technical problem of how to obtain a good user experience, the present embodiment may also include well-known structures such as a communication bus and an interface, and these well-known structures should also be included in the protection scope of the present disclosure.

[0238] like Figure 8A schematic diagram of the structure of a computer device provided in an embodiment of the present disclosure is shown, which is a schematic diagram of the structure of a computer device suitable for implementing the embodiment of the present disclosure. Figure 8 The computer device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0239] like Figure 8 As shown, the computer device may include a processor (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) or a program loaded from a storage device into a random access memory (RAM). In the RAM, various programs and data required for the operation of the computer device are also stored. The processor, ROM, and RAM are connected to each other via a bus. An input / output (I / O) interface is also connected to the bus.

[0240] Typically, the following devices can be connected to the I / O interface: input devices such as sensors or visual information acquisition devices; output devices such as display screens; storage devices such as tapes, hard disks, etc.; and communication devices. The communication device can allow the computer device to communicate with other devices (such as edge computing devices) wirelessly or by wire to exchange data. Figure 8 A computer device having various devices is shown, but it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed instead.

[0241] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device, or installed from a ROM. When the computer program is executed by a processor, all or part of the steps of the communication encryption method based on the national secret algorithm of the embodiment of the present disclosure are executed.

[0242] For detailed description of this embodiment, reference may be made to the corresponding descriptions in the aforementioned embodiments, which will not be repeated here.

[0243] According to the computer-readable storage medium of the embodiment of the present disclosure, non-transitory computer-readable instructions are stored thereon. When the non-transitory computer-readable instructions are executed by the processor, all or part of the steps of the communication encryption method based on the national secret algorithm of each embodiment of the present disclosure are executed.

[0244] The above-mentioned computer-readable storage media include, but are not limited to: optical storage media (e.g., CD-ROM and DVD), magneto-optical storage media (e.g., MO), magnetic storage media (e.g., magnetic tape or mobile hard disk), media with built-in rewritable non-volatile memory (e.g., memory card) and media with built-in ROM (e.g., ROM box).

[0245] For detailed description of this embodiment, reference may be made to the corresponding descriptions in the aforementioned embodiments, which will not be repeated here.

[0246] The basic principles of the present disclosure are described above in conjunction with specific embodiments. However, it should be noted that the advantages, strengths, effects, etc. mentioned in the present disclosure are only examples and not limitations, and it cannot be considered that these advantages, strengths, effects, etc. are required by each embodiment of the present disclosure. In addition, the specific details disclosed above are only for the purpose of illustration and ease of understanding, and are not limitations. The above details do not limit the present disclosure to the necessity of adopting the above specific details to be implemented.

[0247] In the present disclosure, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. The block diagrams of the devices, apparatuses, equipment, and systems involved in the present disclosure are only illustrative examples and are not intended to require or imply that they must be connected, arranged, and configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, equipment, and systems can be connected, arranged, and configured in any manner. Words such as "including", "comprising", "having", etc. are open words, meaning "including but not limited to", and can be used interchangeably with them. The words "or" and "and" used here refer to the words "and / or" and can be used interchangeably with them unless the context clearly indicates otherwise. The word "such as" used here refers to the phrase "such as but not YY+242199P

[0248] Limited to” and can be used interchangeably with it.

[0249] Additionally, as used herein, "or" used in a list of items beginning with "at least one" indicates a separate list, so that, for example, a list of "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word "exemplary" does not mean that the example described is preferred or better than other examples.

[0250] It should also be noted that in the system and method of the present disclosure, each component or each step can be decomposed and / or recombined. Such decomposition and / or recombination should be regarded as equivalent solutions of the present disclosure.

[0251] Various changes, substitutions, and modifications of the techniques described herein may be made without departing from the teachings defined by the appended claims. Furthermore, the scope of the claims of the present disclosure is not limited to the specific aspects of the processes, machines, manufactures, compositions of events, means, methods, and actions described above. Currently existing or later to be developed processes, machines, manufactures, compositions of events, means, methods, or actions that perform substantially the same functions or achieve substantially the same results as the corresponding aspects described herein may be utilized. Thus, the appended claims include such processes, machines, manufactures, compositions of events, means, methods, or actions within their scope.

[0252] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of the present disclosure. Therefore, the present disclosure is not intended to be limited to the aspects shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

[0253] The above description has been given for the purpose of illustration and description. In addition, this description is not intended to limit the embodiments of the present disclosure to the forms disclosed herein. Although multiple example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, changes, additions and sub-combinations thereof.

Claims

1. A communication encryption method based on national secret algorithm, It is characterized in that include: Extracting original data from a communication data stream, performing privacy protection processing on the original data, and obtaining first data; Encrypting the first data according to the priority to obtain second data and a corresponding random key; Processing the second data based on the first type of national secret algorithm to obtain a hash value; Encrypting the combination of the hash value and the random key based on the second type of national secret algorithm to obtain third data; The third data is combined with the second data to obtain a target encrypted data packet, and the target encrypted data packet is transmitted to a target end.

2. According to the communication encryption method based on the national secret algorithm according to claim 1, It is characterized in that The performing privacy protection processing on the original data to obtain first data includes: Determining data sensitivity and a required privacy protection level based on the original data; Determining a privacy budget of differential privacy based on the data sensitivity and the privacy protection level; Determine random noise based on the original data and the privacy budget, and add the random noise to the original data to obtain the first data; The privacy budget is ε, 0.1≤ε≤1.

3. According to the communication encryption method based on the national secret algorithm according to claim 2, It is characterized in that The determining random noise based on the original data and the privacy budget, and adding the random noise to the original data to obtain the first data includes: Determine a noise distribution mechanism; the noise distribution mechanism includes a Laplace distribution mechanism or a Gaussian distribution mechanism; obtaining sensitivity of the original data; Determine the random noise based on the sensitivity and the privacy budget; The random noise is added to the original data based on the noise distribution mechanism to obtain the first data.

4. According to claim 1, the communication encryption method based on the national secret algorithm, It is characterized in that The encrypting the first data according to the priority to obtain the second data and the corresponding random key includes: Obtaining a priority type of the first data, and determining a corresponding first preset national encryption algorithm based on the priority type; Obtaining a random key based on the first preset national secret algorithm; The first data is encrypted based on the random key and the first preset national encryption algorithm to obtain second data.

5. According to claim 4, the communication encryption method based on the national secret algorithm, It is characterized in that The obtaining of the priority type of the first data includes: determining whether the first data contains a specific keyword, if so, determining it as high priority data, if not, determining it as low priority data; or, The obtaining the priority type of the first data includes: if the first data contains multiple priority types, sorting the data from high to low according to the priority, recording the first N sorted data as high priority data, and recording the last M sorted data as low priority data; For high-priority data, the corresponding first preset national encryption algorithm is SM2 or SM3; For low-priority data, the corresponding first preset national encryption algorithm is SM4.

6. According to claim 5, the communication encryption method based on the national secret algorithm, It is characterized in that The method of encrypting a combination of a hash value and a random key based on a second type of national secret algorithm to obtain third data is as follows: encrypting a combination of a hash value and a random key based on a second type of national secret algorithm to obtain third data includes: Combining the Hash value with the random key to obtain combined data; Obtain a public-private key pair corresponding to the second type of national encryption algorithm; The combined data is encrypted using the public key in the public-private key pair to obtain the third data.

7. According to claim 6, the communication encryption method based on the national secret algorithm, It is characterized in that The combining the third data with the second data to obtain a target encrypted data packet includes: placing the third data at the beginning of the second data to obtain the target encrypted data packet.

8. According to claim 5, the communication encryption method based on the national secret algorithm, It is characterized in that When the first preset national encryption algorithm is the SM4 algorithm, the method for obtaining the second data includes: Dividing the first data into a plurality of 128-bit data blocks; Encrypting each of the data blocks using the random key to obtain a ciphertext block; If the size of the first data is not an integer multiple of 128 bits, padding the last data block to make it reach 128 bits; The random key is a random 128-bit key.

9. The communication encryption method based on the national secret algorithm according to claim 8, It is characterized in that Also includes: When encrypting each of the data blocks, an initialization vector is randomly generated; The encryption of the first data block includes: performing an XOR operation on the first data block and its corresponding initialization vector to obtain a first ciphertext block; Starting from the second data block, each data block is XORed with the previous ciphertext block during encryption to obtain the corresponding ciphertext block.

10. The communication encryption method based on the national secret algorithm according to claim 1, It is characterized in that The encrypting the first data according to the priority to obtain the second data and the corresponding random key includes: Determine the federated learning model; Using the historical privacy data on each local device to train the federated learning model, and uploading the trained model parameters of the federated learning model to the central server; The central server aggregates the model parameters using an aggregation algorithm to obtain global model parameters; The central server sends the global model parameters to each local device respectively; In the local device corresponding to the communication data stream, the corresponding federated learning model is updated based on the global model parameters, and the first data is encrypted according to the priority based on the updated federated learning model and the preset strategy to obtain the second data and the corresponding random key.

Images