Encryption method, apparatus and device, and readable storage medium

Abstract

The invention discloses an encryption method, device and equipment and a readable storage medium in the technical field of security assurance, and the method comprises the steps: obtaining target data, and recognizing sensitive data in the target data; splitting the sensitive data to obtain first data and second data; encrypting the first data by using a format preserving encryption algorithm to obtain a first ciphertext; encrypting the second data by using a dictionary algorithm to obtain a second ciphertext; splicing the first ciphertext and the second ciphertext to obtain a sensitive data ciphertext; and replacing the sensitive data in the target data with the sensitive data ciphertext to obtain tokenized target data. According to the method, the FPE and the dictionary algorithm are combined for encryption processing, so that each data ciphertext still keeps the format of the original sensitive data, meanwhile, the one-to-one mapping relation between the plaintext and the ciphertext corresponding to the FPE is broken, and the sensitive data can be prevented from being decoded by analyzing the data before and after large-scale encryption. The method has the technical effect that the sensitive data can be effectively protected.

Description

Technical Field

[0001] The present application relates to the field of security assurance technology, and in particular to an encryption method, device, equipment and readable storage medium. Background Art

[0002] Format Preserving Encrypt (FPE) is an important means of data tokenization and is widely used in the field of data openness and sharing. Since FPE keeps the ciphertext and plaintext in the same format, it is particularly suitable for the field of data desensitization.

[0003] When using the format-preserving encryption algorithm FPE, it is necessary to first establish a mapping relationship between the message to be encrypted and the value domain. After basic encryption, the plaintext and ciphertext present a one-to-one relationship. When an attacker obtains a large amount of data or collects a large amount of relevant information, they can use statistical methods to establish a one-to-one correspondence between plaintext and ciphertext, and infer the corresponding plaintext from the ciphertext, thereby increasing the risk of certain specific personal information being inferred.

[0004] In summary, how to effectively protect sensitive information and other issues are technical problems that technical personnel in this field urgently need to solve. Summary of the invention

[0005] The purpose of this application is to provide an encryption method, device, equipment and readable storage medium that can effectively protect sensitive information.

[0006] In order to solve the above technical problems, this application provides the following technical solutions:

[0007] An encryption method, comprising:

[0008] Acquire target data, and identify sensitive data in the target data;

[0009] Splitting the sensitive data to obtain first data and second data;

[0010] Encrypting the first data using a format-preserving encryption algorithm to obtain a first ciphertext;

[0011] Encrypting the second data using a dictionary algorithm to obtain a second ciphertext;

[0012] Concatenate the first ciphertext and the second ciphertext to obtain a sensitive data ciphertext;

[0013] The sensitive data in the target data is replaced with the sensitive data ciphertext to obtain tokenized target data.

[0014] Preferably, encrypting the second data using a dictionary algorithm to obtain a second ciphertext includes:

[0015] Determine the number of dictionaries; wherein the number of dictionaries is greater than or equal to 1 and less than or equal to the total number of dictionaries;

[0016] The second ciphertext of the second data is generated by using the dictionary number through modulo operation and dictionary mapping.

[0017] Preferably, using the dictionary number to generate the second ciphertext of the second data through modulo operation and dictionary mapping includes:

[0018] Use Numdic=ipos%n to determine the selected dictionary number; where i pos Indicates the position of the element, Num dic Indicates the dictionary number after taking the remainder;

[0019] use generating the second ciphertext;

[0020] Among them, f(i ascii ,i pos ) represents the function expression of the ASCII value of the element and the element position, % represents the remainder operation, l dic Indicates the length of the dictionary, Represents the mapping function through the selected dictionary.

[0021] Preferably, splitting the sensitive data to obtain the first data and the second data includes:

[0022] Randomly determine the splitting position of the sensitive data;

[0023] The sensitive data is split at the splitting position to obtain the first data and the second data.

[0024] Preferably, identifying sensitive data in the target data includes:

[0025] The sensitive data is identified from the target data using a regular expression.

[0026] Preferably, identifying sensitive data in the target data includes:

[0027] The sensitive data is identified from the target data using a recognition algorithm.

[0028] Preferably, it also includes:

[0029] Decrypting the sensitive data ciphertext to obtain the sensitive data;

[0030] The sensitive data ciphertext in the tokenized target data is replaced with the sensitive data to obtain the decrypted and restored target data.

[0031] An encryption device, comprising:

[0032] A sensitive data identification module, used to obtain target data and identify sensitive data in the target data;

[0033] A data splitting module, used for splitting the sensitive data to obtain first data and second data;

[0034] A first encryption module, used to encrypt the first data using a format-preserving encryption algorithm to obtain a first ciphertext;

[0035] A second encryption module, used to encrypt the second data using a dictionary algorithm to obtain a second ciphertext;

[0036] A ciphertext combination module, used for concatenating the first ciphertext and the second ciphertext to obtain a sensitive data ciphertext;

[0037] The tokenization module is used to replace the sensitive data in the target data with the sensitive data ciphertext to obtain tokenized target data.

[0038] An electronic device, comprising:

[0039] Memory for storing computer programs;

[0040] A processor is used to implement the steps of the above encryption method when executing the computer program.

[0041] A readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above encryption method are implemented.

[0042] Apply the method provided in the embodiment of the present application to obtain target data and identify sensitive data in the target data; split the sensitive data to obtain first data and second data; use a format-preserving encryption algorithm to encrypt the first data to obtain a first ciphertext; use a dictionary algorithm to encrypt the second data to obtain a second ciphertext; concatenate the first ciphertext and the second ciphertext to obtain a sensitive data ciphertext; replace the sensitive data in the target data with the sensitive data ciphertext to obtain tokenized target data.

[0043] In order to effectively protect sensitive data, after it is identified, it can be split into first data and second data. For the first data, FPE is used for encryption to obtain a first ciphertext. For the second data, a dictionary algorithm is used for encryption to obtain a second ciphertext. By splicing the first ciphertext and the second ciphertext, the sensitive data ciphertext can be obtained, and the sensitive data in the target data can be replaced based on the sensitive data ciphertext to obtain the tokenized target data. Since the encryption process is combined with FPE and the dictionary algorithm, each data ciphertext can still retain the format of the original sensitive data. At the same time, the one-to-one mapping relationship between the plaintext and the ciphertext corresponding to FPE is broken, and the analysis of the data before and after large-scale encryption to decipher the sensitive data can be avoided. That is, the technical effect of the present application is: sensitive data can be effectively protected.

[0044] Correspondingly, the embodiments of the present application also provide encryption devices, equipment and readable storage media corresponding to the above-mentioned encryption method, which have the above-mentioned technical effects and are not repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0046] Figure 1 This is a flowchart of an encryption method in an embodiment of the present application;

[0047] Figure 2 This is a schematic diagram of a specific implementation of an encryption method in an embodiment of the present application;

[0048] Figure 3 This is a schematic diagram of the structure of an encryption device in an embodiment of the present application;

[0049] Figure 4 This is a schematic diagram of the structure of an electronic device in an embodiment of the present application;

[0050] Figure 5 This is a schematic diagram of the specific structure of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION

[0051] In order to enable those skilled in the art to better understand the present application, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application.

[0052] Please refer to Figure 1 and Figure 2 , Figure 1 This is a flowchart of an encryption method in an embodiment of the present application. Please refer to Figure 2 ,exist Figure 2 In the figure, the upper number is a bank card number, and the number on the right is the tokenized bank card number obtained after encryption by the encryption method provided in the embodiment of the present application.

[0053] The method comprises the following steps:

[0054] S101. Acquire target data and identify sensitive data in the target data.

[0055] In this embodiment, the target data can be loaded from a data source, obtained from a human-computer interaction page, downloaded from other devices, or read from a storage medium. There is no specific limitation on the specific form of how to obtain the target data.

[0056] The target data may be private information such as documents or tables that may contain sensitive data.

[0057] Among them, sensitive data includes but is not limited to bank card number, ID card number, mobile phone number and other private data.

[0058] Sensitive data in the target data can be identified through a trained recognition model, or through some detection algorithms.

[0059] For a piece of target data, the types of sensitive data therein may be one or more types, and for each type, there may be one or more data.

[0060] In one embodiment of the present application, identifying sensitive data in target data includes: using regular expressions to identify sensitive data from the target data.

[0061] Among them, regular expressions (regular expressions, often abbreviated as regex, regexp or RE in the code), also known as regular expressions, are usually used to retrieve and replace text that conforms to a certain pattern (rule).

[0062] Specifically, the characteristics of sensitive data can be studied, such as IP (Internet Protocol, a protocol for interconnecting networks) addresses. Taking IPv4 as an example, its IP address corresponds to a 32-bit binary number, which is usually divided into four 8-bit binary numbers (that is, 4 bytes). IP addresses are usually expressed in dotted decimal form in the form of (abcd), where a, b, c, and d are all decimal integers between 0 and 255. For example, the dotted decimal IP address (100.4.5.6) is actually a 32-bit binary number (01100100.00000100.00000101.00000110). In other words, to identify this type of IP address, the (abcd) form can be identified through a regular expression, and a, b, c, and d are all decimal integers between 0 and 255, thereby realizing IP address identification.

[0063] In one embodiment of the present application, identifying sensitive data in target data includes: using a recognition algorithm to identify sensitive data from the target data.

[0064] In this embodiment, based on the characteristics of sensitive data, a recognition algorithm capable of identifying the characteristics can be pre-compiled, or an existing related detection algorithm can be used to directly identify sensitive data from target data.

[0065] S102: Split sensitive data to obtain first data and second data.

[0066] When using the format-preserving encryption algorithm FPE, it is necessary to first establish a mapping relationship between the message to be encrypted and the value domain. After basic encryption, the plaintext and ciphertext present a one-to-one relationship. When an attacker obtains a large amount of data or collects a large amount of relevant information, they can use statistical methods to establish a one-to-one correspondence between plaintext and ciphertext, and infer the corresponding plaintext from the ciphertext, thereby increasing the risk of certain specific personal information being inferred. In addition, the use of the FPE algorithm may also cause the data encryption to appear the same before and after.

[0067] Specifically, the disadvantages of FPE include:

[0068] ①. In FPE, the plain text before and after encryption and the cipher text after encryption may be the same. For example, the output of 536 after FPE encryption is still 536;

[0069] ②. When the key is inconvenient, it is possible to decipher the ciphertext by collecting a large amount of test data. For example: the output of data A after encryption by FPE is B. When B is encountered again, it can be deduced that the content corresponding to B is actually A; the output of mobile phone data D after encryption by FPE is F. When F is encountered, it can be deduced that the content corresponding to F is actually D.

[0070] ③. Statistical rules are found in the obtained ciphertext, that is, the mapping relationship of FPE is parsed. For example:

[0071] The output result of the collected data A after FPE encryption is 55;

[0072] The output result of the collected data B after FPE encryption is 55;

[0073] The output result of the collected data C after FPE encryption is 70;

[0074] The output result of the collected data E after FPE encryption is 71;

[0075] The output result of the collected data F after encryption by FPE is 71;

[0076] The output result of the collected data K after FPE encryption is 71;

[0077] Based on the same output results, it can be inferred that A=B, E=F=K; that is, there are two groups of identical values ​​in the plaintext, one group includes 2 elements and the other group includes 3 elements.

[0078] In order to avoid using only FPE to encrypt sensitive data, which may lead to the leakage of sensitive data due to the characteristics of PFE, this application proposes to split the sensitive data, and in the subsequent encryption process, use a combination of FPE and dictionary algorithm to encrypt the sensitive data, thereby ensuring the security of sensitive data.

[0079] Specifically, when splitting sensitive data, the sensitive data can be directly split into two parts, one of which is directly determined as the first data, and the other is directly determined as the second data. Of course, the splitting can also be performed alternately and divided into the first data and the second data in sequence.

[0080] For example: for an 11-digit mobile phone number, it can be randomly divided into the first m digits and the last m+1 to 11th digits. The first m digits can be determined as the first data, and the last m digits can be determined as the second data, where the value range of m is greater than or equal to 1 and less than 11; or, for an 11-digit mobile phone number, digits 1 to a and digits b to 11 can be determined as the first data, and digits a+1 to b-1 can be determined as the second data, where 1<a<b<11.

[0081] It should be noted that the first and second in the first data and the second data are only used to distinguish the two parts of data, and have no limiting meaning such as order or priority.

[0082] In one embodiment of the present application, splitting sensitive data to obtain first data and second data includes:

[0083] Randomly determine the split location of sensitive data;

[0084] The sensitive data is split at the splitting position to obtain first data and second data.

[0085] Since there is a one-to-one correspondence between the plaintext and the ciphertext of FPE, in order to avoid splitting the same type of sensitive data at the same position each time, resulting in large-scale data analysis, and thus finding the mapping relationship of FPE, when splitting the sensitive data, the splitting position can be randomly determined to split, thereby obtaining the first data and the second data.

[0086] For example, if the sensitive data is a bank card number, during the splitting process, a splitting position different from the last time the bank card number was split can be selected based on a random function.

[0087] S103: Encrypt the first data using a format-preserving encryption algorithm to obtain a first ciphertext.

[0088] That is, the first data may be encrypted by using FPE, and the encrypted ciphertext is determined as the first ciphertext. The first ciphertext only indicates a corresponding relationship with the first data.

[0089] Since FPE keeps the ciphertext and plaintext in the same format, on the one hand, FPE is an encryption method that can encrypt the first data in sensitive data (such as part of the bank card number, ID card number, and mobile phone number, etc.), and on the other hand, since it can keep the encrypted data format unchanged, it has the advantages of not having to change the database paradigm and being transparent to the upper-level applications.

[0090] For example, data encrypted using FPE can be expressed as:

[0091] fFPE(sub(original_data)), where original_data represents sensitive data, sub(original_data) represents the first data in the sensitive data, and f FPE (sub(original_data)) indicates that FPE encryption processing is performed on the first data.

[0092] S104. Encrypt the second data using a dictionary algorithm to obtain a second ciphertext.

[0093] Since the dictionary algorithm can also achieve the unchanged format before and after encryption, in order to keep the encrypted data format unchanged, in this embodiment, the dictionary algorithm is used to encrypt the second data to obtain the second ciphertext.

[0094] As for how to use the dictionary algorithm to encrypt the second data, reference may be made to the relevant technical implementation of the dictionary algorithm, which will not be listed here one by one.

[0095] In one embodiment of the present application, encrypting the second data using a dictionary algorithm to obtain a second ciphertext includes:

[0096] Step 1, determine the number of dictionaries; wherein the number of dictionaries is greater than or equal to 1 and less than or equal to the total number of dictionaries;

[0097] Step 2: Generate a second ciphertext of the second data by using the dictionary number through modulo operation and dictionary mapping.

[0098] The method of generating the second ciphertext of the second data by using the dictionary number through modulo operation and dictionary mapping includes:

[0099] Use Numdic=ipos%n to determine the selected dictionary number; where i pos Indicates the position of the element, Num dic Indicates the dictionary number after taking the remainder;

[0100] use Generate a second ciphertext;

[0101] Among them, f(i ascii ,i pos ) represents the function expression of the ASCII value of the element and the element position, % represents the remainder operation, l dic Indicates the length of the dictionary, Represents the mapping function through the selected dictionary.

[0102] For ease of description, the above steps are combined for explanation below.

[0103] The number of dictionaries n to be selected can be obtained and input as a parameter for encryption, wherein n is less than or equal to the total number of dictionaries. Specifically, the user can be guided to input a specific number of dictionaries n through a human-computer interaction interface, or the number of dictionaries n can be determined randomly.

[0104] For the second data encryption, a dictionary algorithm is specifically used, and the second ciphertext is generated by modulo operation and dictionary mapping. Specifically, the dictionary number can be selected from the selected dictionary data number n based on the following formula:

[0105] Numdic = ipos%n;

[0106] Among them, i pos Indicates the position of the element (that is, the data in the second data), Num dic Represents the dictionary number after the remainder. The new element value (that is, the data in the second ciphertext) produced after the dictionary algorithm is expressed as:

[0107]

[0108] Among them, f(i ascii ,i pos ) represents the function expression of the ASCII value of the element and the element position, % represents the remainder operation, l dic Indicates the length of the dictionary, Represents the mapping function for the selected dictionary.

[0109] For example: Encrypt the original character a using the dictionary algorithm:

[0110] ①. The original dictionary (26 bits in length, represented by 26 lowercase letters) includes:

[0111] number1:{b,c,f,e...};

[0112] number2:{c, d, e, m...};

[0113] number3:{a, m, n, k...};

[0114] number4:{x, y, l, p...};

[0115] ②, n = 3, select 3 dictionaries, assuming that number1, number2 and number3 are selected;

[0116] ③. For character a, use the following formula:

[0117] Numdic=ipos%n=1%3=1, determine the corresponding number1 dictionary;

[0118] ④、Use the following formula to express the linear function:

[0119] f(iascii,ipos)=(97-97)+1=1;

[0120]

[0121] That is, a is obtained through dictionary operation to obtain c, a is one of the elements in the second data, and c is the value of the element in the second ciphertext.

[0122] In this embodiment, there is no limitation on the total number of dictionaries that can actually be selected and the specific types of dictionaries, and there is no specific limitation on the mapping function of each dictionary.

[0123] S105 . Concatenate the first ciphertext and the second ciphertext to obtain a sensitive data ciphertext.

[0124] Specifically, when splicing the first ciphertext and the second ciphertext, the first data and the second data may be spliced ​​correspondingly according to their positional relationship in the sensitive data, or they may be spliced ​​in alternating positions. After the splicing is completed, the sensitive data ciphertext may be obtained.

[0125] S106. Replace the sensitive data in the target data with the sensitive data ciphertext to obtain tokenized target data.

[0126] After obtaining the sensitive data ciphertext, the sensitive data in the target data can be replaced with the sensitive data ciphertext to obtain the tokenized target data. Compared with the original target data, the sensitive data in the tokenized target data has been desensitized, and the format of the sensitive data ciphertext remains consistent with the sensitive data. For the upper-layer application, it is equivalent to the original target data.

[0127] In one embodiment of the present application, it also includes:

[0128] Decrypt the sensitive data ciphertext to obtain the sensitive data;

[0129] The sensitive data ciphertext in the tokenized target data is replaced with the sensitive data to obtain the decrypted and restored target data.

[0130] That is, after tokenizing the target data, if necessary, the tokenized target data can be decrypted to restore the original target data. Since the sensitive data ciphertext is encrypted in combination with FPE and dictionary data, in the decryption process, the reverse operation can be performed based on the encryption process to obtain the sensitive data and replace it.

[0131] Specifically, the sensitive data ciphertext can be split according to the splicing order to obtain the first ciphertext and the second ciphertext, and then the first ciphertext can be decrypted using FPE to obtain the first data, and the second ciphertext can be decrypted using a dictionary algorithm to obtain the second data. According to the position of the split sensitive data, the sensitive data can be restored based on the splicing of the first data and the second data, and finally replaced based on the sensitive data.

[0132] Apply the method provided in the embodiment of the present application to obtain target data and identify sensitive data in the target data; split the sensitive data to obtain first data and second data; use a format-preserving encryption algorithm to encrypt the first data to obtain a first ciphertext; use a dictionary algorithm to encrypt the second data to obtain a second ciphertext; concatenate the first ciphertext and the second ciphertext to obtain a sensitive data ciphertext; replace the sensitive data in the target data with the sensitive data ciphertext to obtain tokenized target data.

[0133] In order to effectively protect sensitive data, after it is identified, it can be split into first data and second data. For the first data, FPE is used for encryption to obtain a first ciphertext. For the second data, a dictionary algorithm is used for encryption to obtain a second ciphertext. By splicing the first ciphertext and the second ciphertext, the sensitive data ciphertext can be obtained, and the sensitive data in the target data can be replaced based on the sensitive data ciphertext to obtain the tokenized target data. Since the encryption process is combined with FPE and the dictionary algorithm, each data ciphertext can still retain the format of the original sensitive data. At the same time, the one-to-one mapping relationship between the plaintext and the ciphertext corresponding to FPE is broken, and the analysis of the data before and after large-scale encryption to decipher the sensitive data can be avoided. That is, the technical effect of the present application is: sensitive data can be effectively protected.

[0134] Corresponding to the above method embodiment, the embodiment of the present application further provides an encryption device, and the encryption device described below and the encryption method described above can be referred to each other.

[0135] See also Figure 3 As shown, the device includes the following modules:

[0136] The sensitive data identification module 101 is used to obtain target data and identify sensitive data in the target data;

[0137] A data splitting module 102 is used to split the sensitive data to obtain first data and second data;

[0138] The first encryption module 103 is used to encrypt the first data using a format-preserving encryption algorithm to obtain a first ciphertext;

[0139] The second encryption module 104 is used to encrypt the second data using a dictionary algorithm to obtain a second ciphertext;

[0140] The ciphertext combining module 105 is used to combine the first ciphertext and the second ciphertext to obtain the sensitive data ciphertext;

[0141] The tokenization module 106 is used to replace the sensitive data in the target data with the sensitive data ciphertext to obtain the tokenized target data.

[0142] Apply the device provided in the embodiment of the present application to obtain target data and identify sensitive data in the target data; split the sensitive data to obtain first data and second data; use a format-preserving encryption algorithm to encrypt the first data to obtain a first ciphertext; use a dictionary algorithm to encrypt the second data to obtain a second ciphertext; concatenate the first ciphertext and the second ciphertext to obtain a sensitive data ciphertext; replace the sensitive data in the target data with the sensitive data ciphertext to obtain tokenized target data.

[0143] In order to effectively protect sensitive data, after it is identified, it can be split into first data and second data. For the first data, FPE is used for encryption to obtain a first ciphertext. For the second data, a dictionary algorithm is used for encryption to obtain a second ciphertext. By splicing the first ciphertext and the second ciphertext, the sensitive data ciphertext can be obtained, and the sensitive data in the target data can be replaced based on the sensitive data ciphertext to obtain the tokenized target data. Since the encryption process is combined with FPE and the dictionary algorithm, each data ciphertext can still retain the format of the original sensitive data. At the same time, the one-to-one mapping relationship between the plaintext and the ciphertext corresponding to FPE is broken, and the analysis of the data before and after large-scale encryption to decipher the sensitive data can be avoided. That is, the technical effect of the present application is: sensitive data can be effectively protected.

[0144] In a specific implementation of the present application, the second encryption module is specifically used to determine the number of dictionaries; wherein the number of dictionaries is greater than or equal to 1 and less than or equal to the total number of dictionaries;

[0145] The second ciphertext of the second data is generated by using the dictionary number through modulo operation and dictionary mapping.

[0146] In a specific implementation of the present application, the second encryption module is specifically used to determine the selected dictionary number using Numdic=ipos%n; wherein, i pos Indicates the position of the element, Num dic Indicates the dictionary number after taking the remainder;

[0147] use Generate a second ciphertext;

[0148] Among them, f(i ascii ,i pos ) represents the function expression of the ASCII value of the element and the element position, % represents the remainder operation, l dic Indicates the length of the dictionary, Represents the mapping function through the selected dictionary.

[0149] In a specific implementation of the present application, the data splitting module is specifically used to randomly determine the splitting position of the sensitive data;

[0150] The sensitive data is split at the splitting position to obtain first data and second data.

[0151] In a specific implementation of the present application, the sensitive data identification module is specifically used to identify sensitive data from target data using regular expressions.

[0152] In a specific implementation of the present application, the sensitive data identification module is specifically used to identify sensitive data from target data using an identification algorithm.

[0153] In a specific implementation of the present application, it also includes:

[0154] The decryption module is used to decrypt the sensitive data ciphertext to obtain the sensitive data; replace the sensitive data ciphertext in the tokenized target data with the sensitive data to obtain the decrypted and restored target data.

[0155] Corresponding to the above method embodiment, the embodiment of the present application further provides an electronic device. The electronic device described below and the encryption method described above can refer to each other.

[0156] See also Figure 4 As shown, the electronic device includes:

[0157] A memory 332, for storing computer programs;

[0158] The processor 322 is used to implement the steps of the encryption method of the above method embodiment when executing the computer program.

[0159] For details, please refer to Figure 5 , Figure 5 A specific structural diagram of an electronic device provided for this embodiment, the electronic device may have relatively large differences due to different configurations or performances, and may include one or more processors (central processing units, CPU) 322 (for example, one or more processors) and a memory 332, and the memory 332 stores one or more computer programs 342 or data 344. Among them, the memory 332 can be a temporary storage or a permanent storage. The program stored in the memory 332 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations in the data processing device. Furthermore, the processor 322 can be configured to communicate with the memory 332 to execute a series of instruction operations in the memory 332 on the electronic device 301.

[0160] The electronic device 301 may further include one or more power supplies 326 , one or more wired or wireless network interfaces 350 , one or more input and output interfaces 358 , and / or one or more operating systems 341 .

[0161] The steps in the encryption method described above can be implemented by the structure of an electronic device.

[0162] Corresponding to the above method embodiment, the embodiment of the present application further provides a readable storage medium. The readable storage medium described below and the encryption method described above can refer to each other.

[0163] A readable storage medium stores a computer program, which implements the steps of the encryption method of the above method embodiment when the computer program is executed by a processor.

[0164] The readable storage medium may specifically be a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, or other readable storage medium that can store program codes.

[0165] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0166] Those skilled in the art may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented with electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0167] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0168] Finally, it should be noted that, in this article, relationships such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms include, include or any other variations are intended to cover non-exclusive inclusion, so that a process, method, article or device that includes a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0169] Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method and core idea of ​​the present application. At the same time, for those skilled in the art, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. An encryption method, characterized in that: include: Acquire target data, and identify sensitive data in the target data; Splitting the sensitive data to obtain first data and second data; Encrypting the first data using a format-preserving encryption algorithm to obtain a first ciphertext; Encrypting the second data using a dictionary algorithm to obtain a second ciphertext; Concatenate the first ciphertext and the second ciphertext to obtain a sensitive data ciphertext; The sensitive data in the target data is replaced with the sensitive data ciphertext to obtain tokenized target data.

2. The method according to claim 1, characterized in that The second data is encrypted using a dictionary algorithm to obtain a second ciphertext, including: Determine the number of dictionaries; wherein the number of dictionaries is greater than or equal to 1 and less than or equal to the total number of dictionaries; The second ciphertext of the second data is generated by using the dictionary number through modulo operation and dictionary mapping.

3. The method according to claim 2, characterized in that Using the dictionary number, generating the second ciphertext of the second data through modulo operation and dictionary mapping, comprising: Use Numdic=ipos%n to determine the selected dictionary number; where i pos Indicates the position of the element, Num dic Indicates the dictionary number after taking the remainder; use generating the second ciphertext; Among them, f(i ascii ,i pos ) represents the function expression of the ASCII value of the element and the element position, % represents the remainder operation, l dic Indicates the length of the dictionary, Represents the mapping function through the selected dictionary.

4. The method according to claim 1, characterized in that Splitting the sensitive data to obtain first data and second data includes: Randomly determine the splitting position of the sensitive data; The sensitive data is split at the splitting position to obtain the first data and the second data.

5. The method according to claim 1, characterized in that Identify sensitive data in the target data, including: The sensitive data is identified from the target data using a regular expression.

6. The method according to claim 1, characterized in that Identify sensitive data in the target data, including: The sensitive data is identified from the target data using a recognition algorithm.

7. The method according to any one of claims 1 to 6, characterized in that: Also includes: Decrypting the sensitive data ciphertext to obtain the sensitive data; The sensitive data ciphertext in the tokenized target data is replaced with the sensitive data to obtain the decrypted and restored target data.

8. An encryption device, characterized in that: include: A sensitive data identification module, used to obtain target data and identify sensitive data in the target data; A data splitting module, used for splitting the sensitive data to obtain first data and second data; A first encryption module, used to encrypt the first data using a format-preserving encryption algorithm to obtain a first ciphertext; A second encryption module, used to encrypt the second data using a dictionary algorithm to obtain a second ciphertext; A ciphertext combination module, used for concatenating the first ciphertext and the second ciphertext to obtain a sensitive data ciphertext; The tokenization module is used to replace the sensitive data in the target data with the sensitive data ciphertext to obtain tokenized target data.

9. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the encryption method according to any one of claims 1 to 7 when executing the computer program.

10. A readable storage medium, characterized in that: The readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the encryption method according to any one of claims 1 to 7 are implemented.

Images