Data decryption method and device

Abstract

The present application provides a data decryption method and device, and a data encryption method and device, wherein the data decryption method includes: obtaining a data request submitted for encrypted data in a storage space; sending an identity identifier contained in the data request to a key management interface; determining a secondary key corresponding to the secondary ciphertext data based on the secondary ciphertext data returned by the key management interface; decrypting the primary ciphertext data corresponding to the secondary ciphertext data based on the secondary key to obtain a primary key; decrypting the encrypted data according to the primary key to obtain target data.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a data decryption method and device. Background Art

[0002] With the development of Internet technology, cloud storage has been accepted by more and more users. Cloud storage not only brings convenient services to users, but also ensures data security. It is a new trend for users to store data. In addition, most public cloud storage platforms will establish a key hosting mechanism to achieve the purpose of transparent encryption. However, although single-time encrypted data can improve data security, it still has the possibility of being cracked. In addition, in data sharing scenarios, there is also the problem of key ownership. If you want to share data, you need to copy the data. This process is not only complicated to operate, but the time to copy data will also increase with the increase in data volume. There is also a certain risk to data security. Therefore, an effective solution is urgently needed to solve this problem. Summary of the Invention

[0003] In view of this, embodiments of the present application provide a data decryption method. This application also relates to a data decryption device, a data encryption method, a data encryption device, a data processing system, two computing devices, and two computer-readable storage media to address technical deficiencies in the prior art.

[0004] According to a first aspect of an embodiment of the present application, a data decryption method is provided, comprising:

[0005] Get data requests submitted for encrypted data in storage space;

[0006] Sending the identity included in the data request to the key management interface;

[0007] Determining, based on the secondary ciphertext data returned by the key management interface, a secondary key corresponding to the secondary ciphertext data;

[0008] Decrypting the primary ciphertext data corresponding to the secondary ciphertext data based on the secondary key to obtain the primary key;

[0009] The encrypted data is decrypted according to the primary key to obtain target data.

[0010] Optionally, upon receiving the identity identifier, the key management interface will query the correspondence between the secondary ciphertext data and the identity identifier based on the identity identifier, determine the secondary ciphertext data corresponding to the identity identifier, and return the secondary ciphertext data.

[0011] Optionally, determining the secondary key corresponding to the secondary ciphertext data includes:

[0012] Parsing the secondary ciphertext data to obtain a secondary ciphertext identifier of the secondary ciphertext data;

[0013] Querying the metadata set of the storage space based on the secondary ciphertext identifier, and determining the secondary key identifier corresponding to the secondary ciphertext identifier according to the query result;

[0014] The secondary key is determined in the storage space according to the secondary key identifier; wherein the metadata set records the corresponding relationship between the secondary ciphertext identifier and the secondary key identifier of the storage space.

[0015] Optionally, decrypting the primary ciphertext data corresponding to the secondary ciphertext data based on the secondary key to obtain the primary key includes:

[0016] Reading a ciphertext table in a metadata set of the storage space based on the secondary ciphertext data;

[0017] Determine the first-level ciphertext data corresponding to the second-level ciphertext data according to the reading result;

[0018] The first-level ciphertext data is decrypted based on the second-level key to obtain the first-level key; wherein the ciphertext table is used to record the corresponding relationship between the second-level ciphertext data and the first-level ciphertext data in the storage space.

[0019] Optionally, before executing the step of obtaining a data request submitted for the encrypted data in the storage space, the method further includes:

[0020] Determine a sharing instruction sent by an original user to the storage space to a target user for the encrypted data; the sharing instruction includes a sharing link for the encrypted data;

[0021] When the target user triggers the sharing link, the step of obtaining a data request submitted for the encrypted data in the storage space is executed.

[0022] Optionally, after the step of decrypting the encrypted data according to the primary key to obtain target data is performed, the method further includes:

[0023] When receiving a sharing termination instruction for the storage space, reading the first-level ciphertext data, the second-level ciphertext data, and the second-level key according to the sharing termination instruction;

[0024] performing clearing processing on the first-level ciphertext data, the second-level ciphertext data, and the second-level key to obtain cleared data;

[0025] Based on the clear data, synchronous clear data is sent to the key management interface, and a processing result returned by the key management interface for the synchronous clear data is received; the synchronous clear data is used to trigger a clear mechanism of the key management interface.

[0026] Optionally, after the step of decrypting the encrypted data according to the primary key to obtain target data is performed, the method further includes:

[0027] When receiving an operation request submitted by a target user for the target data, performing operation processing on the target data according to the operation request to obtain operation data;

[0028] generating first operation information for the target user and second operation information for the original user to whom the storage space belongs according to the operation data;

[0029] Sending the first operation information to the target user, and sending the second operation information to the original user;

[0030] When receiving a copy instruction returned by the original user in response to the second operation information, the target data is copied.

[0031] Optionally, before executing the step of obtaining a data request submitted for the encrypted data in the storage space, the method further includes:

[0032] Obtaining a write request submitted by an original user for the target data, and determining the storage space corresponding to the original user according to the write request;

[0033] encrypting the target data using the primary key generated by the space identifier of the storage space, and writing the obtained encrypted data into the storage space;

[0034] Encrypting the primary key based on the original secondary key generated by the written identity identifier to obtain the original primary ciphertext data corresponding to the original user;

[0035] Creating a ciphertext table for the storage space according to the original first-level ciphertext data and the original second-level ciphertext data corresponding to the original second-level key;

[0036] The original secondary ciphertext data and the write identity are synchronized to the key management interface, and the ciphertext table is added to the metadata set of the storage space.

[0037] Optionally, before executing the step of obtaining a data request submitted for the encrypted data in the storage space, the method further includes:

[0038] Obtaining a sharing application from an original user to share the encrypted data with a target user;

[0039] Determining the primary key according to the write identity included in the sharing application;

[0040] Encrypting the primary key according to the secondary key generated by the identity identifier included in the sharing application to obtain the primary ciphertext data;

[0041] The ciphertext table is updated based on the first-level ciphertext data and the second-level ciphertext data corresponding to the second-level key, and the second-level ciphertext data and the identity identifier are synchronized to the key management interface.

[0042] According to a second aspect of an embodiment of the present application, a data decryption device is provided, including:

[0043] an acquisition request module configured to acquire a data request submitted for encrypted data in the storage space;

[0044] a sending identification module, configured to send the identity identification included in the data request to the key management interface;

[0045] a key determination module configured to determine, based on the secondary ciphertext data returned by the key management interface, a secondary key corresponding to the secondary ciphertext data;

[0046] A first decryption module is configured to decrypt the primary ciphertext data corresponding to the secondary ciphertext data based on the secondary key to obtain the primary key;

[0047] The second decryption module is configured to decrypt the encrypted data according to the primary key to obtain target data.

[0048] According to a third aspect of an embodiment of the present application, a data encryption method is provided, including:

[0049] Obtaining a sharing request from the original user for encrypted data in the shared storage space of the target user;

[0050] Determining the primary key of the encrypted data according to the first identity identifier of the original user included in the sharing application;

[0051] Encrypting the primary key according to the secondary key generated by the second identity identifier of the target user included in the sharing application to obtain primary ciphertext data;

[0052] Record the correspondence between the first-level ciphertext data and the second-level ciphertext data corresponding to the second-level key, and synchronize the second-level ciphertext data and the second identity identifier to the key management interface.

[0053] Optionally, determining the primary key for the encrypted data according to the first identity identifier of the original user included in the sharing application includes:

[0054] Sending the first identity included in the sharing application to the key management interface;

[0055] Reading the ciphertext table of the storage space according to the original secondary ciphertext data returned by the key management interface;

[0056] Determine the original first-level ciphertext data corresponding to the original second-level ciphertext data according to the reading result;

[0057] The original first-level ciphertext data is decrypted based on the original second-level key determined by the original second-level ciphertext data to obtain the first-level key.

[0058] Optionally, when the key management interface receives the first identity identifier, it will query the correspondence between the secondary ciphertext data and the identity identifier based on the first identity identifier, determine the original secondary ciphertext data corresponding to the first identity identifier, and return the original secondary ciphertext data.

[0059] Optionally, encrypting the primary key according to the secondary key generated according to the second identity of the target user included in the sharing application to obtain the primary ciphertext data includes:

[0060] Parsing the sharing application to obtain the second identity identifier;

[0061] Generate a secondary key corresponding to the target user according to the second identity identifier and a preset encryption algorithm;

[0062] The first-level key is encrypted based on the second-level key to obtain the first-level ciphertext data.

[0063] Optionally, the recording of the correspondence between the first-level ciphertext data and the second-level ciphertext data corresponding to the second-level key includes:

[0064] Determining the secondary ciphertext data corresponding to the secondary key;

[0065] A correspondence between the first-level ciphertext data and the second-level ciphertext data is established according to the second identity identifier, and is recorded in the ciphertext table of the storage space.

[0066] Optionally, before the step of obtaining the sharing application from the original user to share the encrypted data in the storage space with the target user is executed, the method further includes:

[0067] Determining a sharing instruction sent by the original user to the target user for the encrypted data; the sharing instruction includes a sharing link for the encrypted data;

[0068] When the target user triggers the sharing link, a reminder message is sent to the original user indicating that the target user agrees to share the encrypted data.

[0069] Optionally, before the step of obtaining the sharing application from the original user to share the encrypted data in the storage space with the target user is performed, the method further includes:

[0070] Obtaining a write request submitted by the original user for the target data, and determining the storage space corresponding to the original user according to the write request;

[0071] encrypting the target data using the primary key generated by the space identifier of the storage space, and writing the obtained encrypted data into the storage space;

[0072] Encrypting the primary key based on the original secondary key generated by the first identity identifier to obtain the original primary ciphertext data corresponding to the original user;

[0073] Creating a ciphertext table for the storage space according to the original first-level ciphertext data and the original second-level ciphertext data corresponding to the original second-level key;

[0074] The original secondary ciphertext data and the first identity identifier are synchronized to the key management interface; wherein the ciphertext table is used to record the correspondence between the secondary ciphertext data and the primary ciphertext data in the storage space.

[0075] Optionally, after the step of recording the correspondence between the first-level ciphertext data and the second-level ciphertext data corresponding to the second-level key, and synchronizing the second-level ciphertext data and the second identity identifier to the key management interface is performed, the step further includes:

[0076] Obtaining a data request submitted by the target user for the encrypted data in the storage space;

[0077] Sending the second identity included in the data request to the key management interface;

[0078] Determining, according to the secondary ciphertext data returned by the key management interface, the secondary key corresponding to the secondary ciphertext data;

[0079] Decrypting the primary ciphertext data based on the secondary key to obtain the primary key;

[0080] The encrypted data is decrypted according to the primary key to obtain the target data.

[0081] According to a fourth aspect of an embodiment of the present application, there is provided a data encryption device, comprising:

[0082] An application acquisition module is configured to acquire an application from an original user to share encrypted data in a storage space with a target user;

[0083] a key determination module configured to determine the primary key of the encrypted data according to the first identity identifier of the original user included in the sharing application;

[0084] an encryption processing module configured to encrypt the primary key according to the secondary key generated by the second identity identifier of the target user included in the sharing application to obtain primary ciphertext data;

[0085] The record synchronization module is configured to record the correspondence between the first-level ciphertext data and the second-level ciphertext data corresponding to the second-level key, and synchronize the second-level ciphertext data and the second identity to the key management interface.

[0086] According to a fifth aspect of an embodiment of the present application, there is provided a data processing system, including:

[0087] Compute nodes, encryption nodes, and key management interfaces;

[0088] The computing node is configured to receive a decryption request submitted by a target user for encrypted data; and send a data request carrying an identity identifier of the target user to the encryption node according to the decryption request;

[0089] The encryption node is configured to send the identity included in the data request to the key management interface;

[0090] The key management interface is configured to query the corresponding relationship between the secondary ciphertext data and the identity identifier according to the identity identifier, determine the secondary ciphertext data corresponding to the identity identifier; and send the secondary ciphertext data to the encryption node;

[0091] The encryption node is further configured to determine a secondary key corresponding to the secondary ciphertext data; decrypt the primary ciphertext data corresponding to the secondary ciphertext data based on the secondary key to obtain the primary key; and decrypt the encrypted data according to the primary key to obtain the target data.

[0092] Optionally, the computing node is further configured to: obtain a sharing application from an original user of the target data to share the encrypted data with the target user; and send the sharing application to the encryption node;

[0093] Correspondingly, the encryption node is further configured to: determine the first-level key based on the write identity included in the sharing application; encrypt the first-level key based on the second-level key generated by the identity included in the sharing application to obtain the first-level ciphertext data; update the ciphertext table based on the first-level ciphertext data and the second-level ciphertext data corresponding to the second-level key, and synchronize the second-level ciphertext data and the identity to the key management interface.

[0094] Optionally, the encryption node is further configured to: parse the secondary ciphertext data to obtain a secondary ciphertext identifier of the secondary ciphertext data; query the metadata set of the storage space based on the secondary ciphertext identifier, and determine a secondary key identifier corresponding to the secondary ciphertext identifier according to the query result; and determine the secondary key in the storage space according to the secondary key identifier;

[0095] The metadata set records the corresponding relationship between the secondary ciphertext identifier and the secondary key identifier of the storage space.

[0096] Optionally, the encryption node is further configured to: read a ciphertext table in a metadata set of the storage space based on the secondary ciphertext data; determine the primary ciphertext data corresponding to the secondary ciphertext data according to the reading result; and decrypt the primary ciphertext data based on the secondary key to obtain the primary key;

[0097] The ciphertext table is used to record the corresponding relationship between the secondary ciphertext data and the primary ciphertext data in the storage space.

[0098] According to a sixth aspect of an embodiment of the present application, there is provided a first computing device, including:

[0099] memory and processor;

[0100] The memory is configured to store computer-executable instructions, and the processor is configured to execute the computer-executable instructions:

[0101] Get data requests submitted for encrypted data in storage space;

[0102] Sending the identity included in the data request to the key management interface;

[0103] Determining, based on the secondary ciphertext data returned by the key management interface, a secondary key corresponding to the secondary ciphertext data;

[0104] Decrypting the primary ciphertext data corresponding to the secondary ciphertext data based on the secondary key to obtain the primary key;

[0105] The encrypted data is decrypted according to the primary key to obtain target data.

[0106] According to a seventh aspect of an embodiment of the present application, a second computing device is provided, including:

[0107] memory and processor;

[0108] The memory is configured to store computer-executable instructions, and the processor is configured to execute the computer-executable instructions:

[0109] Obtaining a sharing request from the original user for encrypted data in the shared storage space of the target user;

[0110] Determining the primary key of the encrypted data according to the first identity identifier of the original user included in the sharing application;

[0111] Encrypting the primary key according to the secondary key generated by the second identity identifier of the target user included in the sharing application to obtain primary ciphertext data;

[0112] Record the correspondence between the first-level ciphertext data and the second-level ciphertext data corresponding to the second-level key, and synchronize the second-level ciphertext data and the second identity identifier to the key management interface.

[0113] According to an eighth aspect of an embodiment of the present application, a computer-readable storage medium is provided, which stores computer-executable instructions, and when the instructions are executed by a processor, the steps of the data decryption method are implemented.

[0114] According to a ninth aspect of an embodiment of the present application, a computer-readable storage medium is provided, which stores computer-executable instructions, and when the instructions are executed by a processor, the steps of the data encryption method are implemented.

[0115] The data decryption method provided by the present application, after obtaining a data request submitted for encrypted data in a storage space, sends the identity identifier contained in the data request to the key management interface, and determines the secondary key corresponding to the secondary ciphertext data based on the secondary ciphertext data returned by the key management interface, and then decrypts the primary ciphertext data corresponding to the secondary ciphertext data based on the secondary key to obtain the primary key, and finally decrypts the encrypted data based on the primary key to obtain the target data, thereby improving the security of the target data through secondary encryption, and realizing data sharing through data decryption, so that users can share the target data without copying the data, effectively reducing the consumption of computing resources and the time it takes for users to obtain target data, and further improving the user experience.

[0116] The data encryption method provided by the present application, when obtaining a sharing application of the original user to encrypt data in the shared storage space of the target user, determines the first-level key of the encrypted data according to the first identity identifier contained in the sharing application, and encrypts the first-level key according to the second-level key generated according to the second identity identifier contained in the sharing application to obtain the first-level ciphertext data, and finally records the correspondence between the first-level ciphertext data and the second-level ciphertext data corresponding to the second-level key, and synchronizes the second-level ciphertext data and the second identity identifier to the key management interface, thereby improving the security of the data through secondary encryption, and in the data sharing scenario, the data sharing operation can be completed without copying the data, thereby further improving the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0117] Figure 1 This is a flow chart of a data decryption method provided by an embodiment of the present application;

[0118] Figure 2 This is a schematic diagram of a data decryption method provided by an embodiment of the present application;

[0119] Figure 3 This is a schematic diagram of a data sharing process in a data decryption method provided in one embodiment of the present application;

[0120] Figure 4 This is a flow chart of a data encryption method provided by an embodiment of the present application;

[0121] Figure 5 This is a schematic diagram of a data encryption method provided by an embodiment of the present application;

[0122] Figure 6 This is a processing flow chart of a data decryption method applied in a data sharing scenario provided by an embodiment of the present application;

[0123] Figure 7 This is a structural diagram of a data decryption device provided in one embodiment of the present application;

[0124] Figure 8 This is a structural diagram of a data encryption device provided in one embodiment of the present application;

[0125] Figure 9 This is a structural diagram of a data processing system provided by an embodiment of the present application;

[0126] Figure 10 This is a structural block diagram of a first computing device provided by an embodiment of the present application;

[0127] Figure 11 This is a structural block diagram of the second computing device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0128] The following description sets forth many specific details to facilitate a thorough understanding of the present application. However, the present application can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the scope of the present application. Therefore, the present application is not limited to the specific implementations disclosed below.

[0129] The terms used in one or more embodiments of the present application are for the purpose of describing specific embodiments only and are not intended to limit one or more embodiments of the present application. The singular forms "a", "the" and "the" used in one or more embodiments of the present application and the appended claims are also intended to include plural forms, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used in one or more embodiments of the present application refers to and includes any or all possible combinations of one or more associated listed items.

[0130] It should be understood that although the terms first, second, etc. may be used to describe various information in one or more embodiments of the present application, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from each other. For example, without departing from the scope of one or more embodiments of the present application, the first may also be referred to as the second, and similarly, the second may also be referred to as the first. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0131] First, the terms involved in one or more embodiments of the present application are explained.

[0132] Cloud server: A server provided by a cloud hosting provider, based on cloud computing technology, that users can operate and manage remotely. It operates in the same way as a regular remote physical server.

[0133] Cloud disk: A disk instance built on a distributed storage system. It can be read and written in a cloud server just like a computer disk.

[0134] Encrypted disk: A cloud disk that stores encrypted data. When users read and write to the disk in the system, the storage system encrypts and decrypts the IO request. The encrypted data is actually stored on the physical disk, while the decrypted plaintext data is read by the user.

[0135] In this application, a data decryption method is provided. This application also involves a data decryption device, a data encryption method, a data encryption device, a data processing system, two computing devices, and two computer-readable storage media, which are described in detail one by one in the following embodiments.

[0136] Figure 1 A flowchart of a data decryption method according to an embodiment of the present application is shown, which specifically includes the following steps:

[0137] Step S102: obtaining a data request submitted for the encrypted data in the storage space.

[0138] In actual applications, cloud storage is being used by more and more users, and the security of cloud storage is also a major topic of concern for users. Usually, public cloud storage disks provided by cloud storage platforms use a one-time encryption method to encrypt data, and in data sharing scenarios, data needs to be copied before it can be shared with other users. This is not only time-consuming and labor-intensive, but also reduces the user experience.

[0139] The data decryption method provided by the present application is to improve the security of data and realize data sharing without copying in data sharing scenarios. After obtaining a data request submitted for encrypted data in a storage space, the identity identifier contained in the data request is sent to the key management interface, and based on the secondary ciphertext data returned by the key management interface, the secondary key corresponding to the secondary ciphertext data is determined, and then the primary ciphertext data corresponding to the secondary ciphertext data is decrypted based on the secondary key to obtain the primary key, and finally the encrypted data is decrypted according to the primary key to obtain the target data, thereby improving the security of the target data through secondary encryption and realizing data sharing through data decryption, so that users can share the target data without copying the data, effectively reducing the consumption of computing resources and the time it takes for users to obtain target data, and further improving the user experience.

[0140] This embodiment will take data sharing as an example to illustrate the data decryption method. It should be noted that the data decryption method can also be applied to scenarios that improve data security or data transfer scenarios. Please refer to the corresponding description content in this embodiment and will not be elaborated here.

[0141] Based on this, in the data sharing scenario, due to the characteristics of cloud storage, each user's data is encrypted and stored in an encrypted disk. Therefore, in the process of sharing data, the data needs to be decrypted and copied to the encrypted disk belonging to the target user in order to complete the data sharing. However, the process of copying data is time-consuming and there are also security issues with the data. In view of this, the data decryption method provided in this application can realize the data sharing operation without copying the data during the data sharing process, and the data security issue can also be solved.

[0142] In actual applications, the party submitting the data request is the user whose data is shared. This embodiment will describe the data decryption method with this user as the target user. Correspondingly, the storage space is the encrypted disk that stores encrypted data, wherein the encrypted disk refers to the encrypted disk in the cloud server, and the data request is the target user's request to share data; it should be noted that the target user can be one or more.

[0143] Furthermore, before decrypting the encrypted data, data needs to be stored in the storage space, and the data in the storage space is written by the original user. The original user refers to the owner of the storage space and can be understood as the user who shares data with the target user. In this embodiment, the specific process of writing data is as follows:

[0144] Obtaining a write request submitted by an original user for the target data, and determining the storage space corresponding to the original user according to the write request;

[0145] encrypting the target data using the primary key generated by the space identifier of the storage space, and writing the obtained encrypted data into the storage space;

[0146] Encrypting the primary key based on the original secondary key generated by the written identity identifier to obtain the original primary ciphertext data corresponding to the original user;

[0147] Creating a ciphertext table for the storage space according to the original first-level ciphertext data and the original second-level ciphertext data corresponding to the original second-level key;

[0148] The original secondary ciphertext data and the write identity are synchronized to the key management interface, and the ciphertext table is added to the metadata set of the storage space.

[0149] Specifically, when a write request submitted by the original user is obtained, the storage space of the original user is determined according to the write request, and then the key is generated by the space identifier of the storage space, and the target data is encrypted using the primary key. After obtaining the encrypted data, the encrypted data is written into the storage space. At this time, in order to improve the security of the data and facilitate the subsequent sharing of the data with other users, the primary key is encrypted;

[0150] The specific process refers to generating the original secondary key based on the written identity of the original user, encrypting the first-level key based on the original second-level key to obtain the original first-level ciphertext data, and then creating the ciphertext table of the storage space based on the original first-level ciphertext data and the original second-level ciphertext data of the original second-level key, and finally synchronizing the original second-level ciphertext data and the written identity to the key management interface, and adding the ciphertext table to the metadata set of the storage space.

[0151] See also Figure 2 As shown, the storage space refers to the physical disk deployed in the storage node, specifically the encrypted disk purchased or established by the original user from the service provider to which the cloud server belongs. After the storage space is established, if the original user writes data, the data is first written through the user-oriented terminal software in the computing node, and then processed by the operating system and virtualization platform software in the virtual machine in the computing node. Encryption processing is performed again based on the first block storage in the computing node (front end, where the first block storage is not controlled by the second block storage, and the upper layer module is above the first block storage, and the lower layer is the block storage system) combined with the second block storage in the storage node (back end), and finally the encrypted data is written to the storage space;

[0152] It should be noted that after the encrypted disk is created, a storage path will be generated with the original user identity as the starting node and the encrypted disk as the ending node. When data is stored, the path can be followed, and the data encryption node will also be included in the path.

[0153] The data encryption node will generate a first-level key for encrypting the encrypted data based on the space identifier, and generate the original second-level key based on the original user's written identity identifier, which is used to encrypt the first-level key. The original second-level key specifically refers to the key of the original user to whom the storage space belongs. In the data sharing scenario, different users will have different second-level keys, which can achieve access to data in the storage space for sharing without copying the data, and can also ensure the security of the data.

[0154] Among them, the key management interface refers to an interface used to host secondary key-related data, so that when a user accesses data in the storage space, the key management interface is required to perform preliminary identity verification first, further improving the security of the data. When the key management interface receives the identity identifier of the target user, it will query the correspondence between the secondary ciphertext data and the identity identifier based on the identity identifier, determine the secondary ciphertext data corresponding to the identity identifier, and return the secondary ciphertext data.

[0155] Furthermore, after the data is written, if the target user needs to share the encrypted data, the target user's secondary key needs to be added to the storage space. In this way, one storage space can have multiple secondary keys, that is, one storage space can have multiple target users who can share data, so that the target data can be obtained without copying the data. In this embodiment, the process of adding the target user's secondary key is as follows:

[0156] Obtaining a sharing application from an original user to share the encrypted data with a target user;

[0157] Determining the primary key according to the write identity included in the sharing application;

[0158] encrypting the primary key according to the secondary key generated by the identity identifier included in the sharing application to obtain the primary ciphertext data;

[0159] The ciphertext table is updated based on the first-level ciphertext data and the second-level ciphertext data corresponding to the second-level key, and the second-level ciphertext data and the identity identifier are synchronized to the key management interface.

[0160] Specifically, when a sharing application is obtained from the original user to share encrypted data with the target user, which indicates that the original user agrees to share the data in the storage space with the target user, the first-level key is determined based on the write identity included in the sharing application, and then the second-level key is generated based on the identity included in the sharing application. The second-level key is a unique key of the target user relative to the storage space. At this time, the first-level key is encrypted based on the second-level key to obtain the first-level ciphertext data;

[0161] Afterwards, the ciphertext table is updated based on the first-level ciphertext data and the second-level ciphertext data corresponding to the second-level key, and the second-level ciphertext data and the identity identifier are synchronized to the key management interface, so that the target user can be assigned the right to share the encrypted data in the storage space, and the target user can use the target data without copying the data, which not only reduces the time consumed in the data sharing process, but also improves the experience of the target user.

[0162] For example, user A purchased an encrypted disk F from a cloud storage provider. When user A writes data to the encrypted disk F, the cloud storage provider will determine the encrypted disk F based on user A's write request, and then generate a first-level key K1 based on the disk identifier of the encrypted disk. After encrypting the data, it will write it to the encrypted disk F. At this time, the second-level key KA will be generated in combination with user A's write identity A, and the first-level key K1 will be encrypted to obtain the first-level encrypted data M1A. Then, a ciphertext table of the encrypted disk F is created based on the first-level encrypted data M1A and the second-level ciphertext data M2A of the second-level key KA, which is used to store the ciphertext identifiers of the first-level encrypted data M1A and the second-level ciphertext data M2A. At the same time, the second-level ciphertext data M2A and the write identity A of user A are synchronized to the key management interface, so that user A can verify his identity without any perception when accessing the encrypted disk F, effectively improving the security of the data.

[0163] Furthermore, when user A shares the data in the encrypted disk F with user B, in order to improve the sharing efficiency and without copying the data in the encrypted disk F to the encrypted disk of user B, the first-level key K1 can be determined based on the write identity A contained in the sharing application of user A, and then the second-level key KB is generated based on the identity B of user B contained in the sharing application. The first-level key K1 is encrypted based on the second-level key KB to obtain the first-level ciphertext data M1B, and then the ciphertext table of the encrypted disk F is updated based on the first-level ciphertext data M1B and the second-level ciphertext data M2B of the second-level key KB. At the same time, the second-level ciphertext data M2B and the identity B are synchronized to the key management interface, so that when user B accesses the encrypted disk F, the identity can be verified without perception, and user B can obtain the data shared by user A without copying the data, thereby further improving the user experience.

[0164] In addition, in the data sharing scenario, when the original user shares data with the target user, the data sharing needs to be completed through the front-end interactive interface. In the embodiment, the specific implementation method is as follows:

[0165] Determine a sharing instruction sent by an original user to the storage space to a target user for the encrypted data; the sharing instruction includes a sharing link for the encrypted data;

[0166] In the case where the target user triggers the sharing link, the step of obtaining the data request submitted by the target user for the encrypted data in the storage space is performed.

[0167] Specifically, in a data sharing scenario, the original user will share a sharing link of encrypted data with the target user through the front-end interactive interface. At this time, the sharing instruction sent by the original user to the target user for the encrypted data will be determined. After that, when the target user triggers the sharing link contained in the sharing instruction, it means that the target user has accepted the sharing of the original user. Based on the starting action of the target user, subsequent data decryption processing can complete the data sharing.

[0168] Among them, the sharing link specifically refers to the sharing path for sharing the encrypted data in the storage space. When the target user clicks the sharing link through the front-end interactive interface, the data sharing operation will be performed according to the storage space pointed to by the sharing link. It should be noted that the target user has completed adding the corresponding secondary key to the storage space.

[0169] In summary, in the data sharing scenario, in order to improve the security of the data, a secondary encryption method is adopted. In order to enable the target user to obtain the target data without copying the data, the target user's secondary key is added to the storage space to give him / her access rights to the data, thereby solving the problem of taking too much time to copy data.

[0170] Step S104: Send the identity included in the data request to the key management interface.

[0171] Specifically, based on the data request submitted by the target user, the data request is further parsed to obtain the identity of the target user, and the identity is sent to the key management interface.

[0172] Among them, the key management interface stores the correspondence between the identity of each user and its corresponding secondary ciphertext data. When the identity received by the key management interface does not exist, it means that the user does not have the authority to access any storage space, and no processing is performed. When the identity received by the key management interface exists, it means that the user has the authority to access the storage space to which the encrypted data belongs, and the subsequent step S106 is executed.

[0173] Continuing with the above example, when user B has access rights to the encrypted disk F, if user B needs to extract the encrypted data from the encrypted disk F, the identity identifier B contained in the data request of user B needs to be sent to the key management interface. The key management interface will query the stored correspondence based on the identity identifier B and determine that the identity identifier B corresponds to the secondary ciphertext data M2B of the secondary key KB generated based on the encrypted disk F. At this time, the key management interface will return the secondary ciphertext data M2B for the identity identifier B for subsequent data decryption operations.

[0174] Step S106: Determine, based on the secondary ciphertext data returned by the key management interface, a secondary key corresponding to the secondary ciphertext data.

[0175] Specifically, based on the above-mentioned sending of the target user's identity identifier to the key management interface, when the secondary ciphertext data returned by the key management interface is received, it means that the target user can access the storage space at this time, and the secondary key corresponding to the secondary ciphertext data will be determined at this time.

[0176] The secondary key specifically refers to a key pre-generated by the target user for the storage space. The secondary key can be used to access encrypted data in the storage space and improve data security.

[0177] Furthermore, in the process of determining the secondary key, in order to quickly determine the secondary key, the identifiers corresponding to the secondary key and the secondary ciphertext data are recorded in the form of a metadata set, so as to speed up the decryption process. In this embodiment, the specific implementation is as follows:

[0178] Parsing the secondary ciphertext data to obtain a secondary ciphertext identifier of the secondary ciphertext data;

[0179] Querying the metadata set of the storage space based on the secondary ciphertext identifier, and determining the secondary key identifier corresponding to the secondary ciphertext identifier according to the query result;

[0180] The secondary key is determined in the storage space according to the secondary key identifier; wherein the metadata set records the corresponding relationship between the secondary ciphertext identifier and the secondary key identifier of the storage space.

[0181] Specifically, first, the secondary ciphertext data returned by the key management interface is parsed to obtain a secondary ciphertext identifier of the secondary ciphertext data; second, the metadata set of the storage space is queried based on the secondary ciphertext identifier; a secondary key identifier corresponding to the secondary ciphertext identifier is determined according to the query result; and finally, the secondary key is determined in the storage space according to the secondary key identifier;

[0182] Among them, the metadata set records the correspondence between the secondary ciphertext identifier and the secondary key identifier of the storage space, the secondary ciphertext identifier refers to the unique identifier of the secondary ciphertext data, and the secondary key identifier specifically refers to the unique identifier of the secondary key. The correspondence between the two is established and stored in the metadata set, which facilitates the efficiency of the target user obtaining the target data during the data decryption process.

[0183] Continuing with the above example, after obtaining the secondary ciphertext data M2B returned by the key management interface, the secondary ciphertext data M2B is parsed to obtain the secondary ciphertext identifier B_M2B corresponding to the secondary ciphertext data M2B, and the metadata set of the encrypted disk F is queried based on the secondary ciphertext identifier B_M2B. Based on the query result, the secondary key identifier B_KB corresponding to the secondary ciphertext identifier B_M2B is determined, and the secondary key KB is determined in the encrypted disk F based on the secondary key identifier B_KB, so as to subsequently extract encrypted data for user B.

[0184] By recording the correspondence between the secondary key identifier and the secondary ciphertext identifier in the metadata of the storage space, it is convenient to improve the data decryption efficiency during the data decryption process, reduce the time it takes for the target user to obtain the target data, and further improve the user experience.

[0185] Step S108: decrypting the primary ciphertext data corresponding to the secondary ciphertext data based on the secondary key to obtain the primary key.

[0186] Specifically, based on the above-mentioned determination of the secondary key corresponding to the secondary ciphertext data, the primary ciphertext data corresponding to the secondary ciphertext data is further decrypted based on the secondary key to obtain the primary key.

[0187] Among them, the first-level ciphertext data specifically refers to the data after the first-level key is encrypted with the second-level key. During the data decryption process, the first-level ciphertext data will be decrypted with the second-level key through a reverse operation to obtain the first-level key, which will be used to decrypt the encrypted data to obtain the target data required by the target user.

[0188] Furthermore, in the process of decrypting the first-level ciphertext data, it is necessary to find the first-level ciphertext data corresponding to the second-level key in the storage space before the decryption operation can be performed. In this embodiment, the specific implementation method is as follows:

[0189] Reading a ciphertext table in a metadata set of the storage space based on the secondary ciphertext data;

[0190] Determine the first-level ciphertext data corresponding to the second-level ciphertext data according to the reading result;

[0191] The first-level ciphertext data is decrypted based on the second-level key to obtain the first-level key; wherein the ciphertext table is used to record the corresponding relationship between the second-level ciphertext data and the first-level ciphertext data in the storage space.

[0192] Specifically, the ciphertext table in the metadata set of the storage space is read based on the secondary ciphertext data, the primary ciphertext data corresponding to the secondary ciphertext data is determined according to the reading result, and then the primary ciphertext data is decrypted based on the secondary key to obtain the primary key, wherein the ciphertext table is used to record the correspondence between the secondary ciphertext data and the primary ciphertext data in the storage space.

[0193] It should be noted that the secondary ciphertext data and the primary ciphertext data having a corresponding relationship in the ciphertext table belong to the same user.

[0194] See also Figure 3 As shown, after the key management interface returns the secondary ciphertext data M2B, the secondary key KB is determined based on the secondary ciphertext data M2B, and the metadata centralized ciphertext table of the encrypted disk F is queried to determine the primary ciphertext data M1B corresponding to the secondary ciphertext data M2B. Then, the secondary key KB is used to decrypt the primary ciphertext data M1B to obtain the primary key K1 of the encrypted data in the encrypted disk F for the user's subsequent decryption processing.

[0195] By recording the secondary ciphertext data and the primary ciphertext data in the ciphertext table, the management of the ciphertext data is more convenient, and when performing a decryption operation, the ciphertext data to be decrypted can be obtained quickly and accurately for decryption processing, thereby improving the decryption efficiency.

[0196] Step S110: decrypt the encrypted data according to the primary key to obtain target data.

[0197] Specifically, based on the above-mentioned decryption of the first-level ciphertext data using the second-level key to obtain the first-level key, the encrypted data is further decrypted according to the first-level key to obtain the target data required by the target user.

[0198] In practical applications, after the primary key and the secondary key are generated, no matter what kind of transformation occurs to the encrypted data in the storage space, the key will not change, which can facilitate key management.

[0199] See also Figure 3 As shown, by decrypting the encrypted data in the encrypted disk F using the primary key K1, the relevant data of user A in the encrypted disk F can be obtained. At this time, user B can check the data in the encrypted disk F and complete data sharing.

[0200] Furthermore, when the target user ends sharing the encrypted data in the storage space, for example, the original user actively cancels sharing with the target user, or the target user actively cancels sharing, the data related to the target user will be cleared according to the end sharing instruction, so that the target user will no longer have the right to access the data in the storage space. In this embodiment, the specific implementation method is as follows:

[0201] When receiving a sharing termination instruction for the storage space, reading the first-level ciphertext data, the second-level ciphertext data, and the second-level key according to the sharing termination instruction;

[0202] performing clearing processing on the first-level ciphertext data, the second-level ciphertext data, and the second-level key to obtain cleared data;

[0203] Based on the clear data, synchronous clear data is sent to the key management interface, and a processing result returned by the key management interface for the synchronous clear data is received; the synchronous clear data is used to trigger a clear mechanism of the key management interface.

[0204] Specifically, upon receiving a sharing termination instruction for the storage space, reading the first-level ciphertext data, the second-level ciphertext data, and the second-level key according to the sharing termination instruction; then clearing the first-level ciphertext data, the second-level ciphertext data, and the second-level key to obtain cleared data;

[0205] At this point, it is also necessary to trigger the clearing mechanism of the key management interface to fully clear the data related to the target user. Based on the clearing data, synchronous clearing data is sent to the key management interface. After receiving the processing result returned by the key management interface for the synchronous clearing data, it is indicated that the key management interface has completed the clearing of the secondary ciphertext data and identity identifier related to the target user. It should be noted that the cleared secondary ciphertext data and identity identifier are relative to the storage space, and the secondary ciphertext data and identity identifier related to the storage space to which the target user belongs will not change.

[0206] For example, when user A actively terminates the cooperative relationship with user B, user B's access to the encrypted disk F needs to be revoked. Then, according to user A's end sharing instruction, the first-level ciphertext data M1B, the second-level ciphertext data M2B and the second-level key KB of user B in the encrypted disk F are read, and the first-level ciphertext data M1B, the second-level ciphertext data M2B and the second-level key KB are cleared to obtain clear data. Synchronous clear data is generated based on the clear data and sent to the key management interface to trigger the clearing mechanism of the key management interface, clear the second-level ciphertext data M2B and user B's identity B recorded in the key management interface, and realize the revocation of user B's access rights, thereby further ensuring the security of the data.

[0207] By clearing the data related to the target user upon receiving the end sharing instruction, the security of the data is further guaranteed, and at the same time, the clearing mechanism of the key management interface is triggered to revoke the target user's access to the storage space, thereby avoiding the situation where the target user can still obtain data in the storage space without access rights.

[0208] In addition, after the target user obtains the target data, the target user can operate and process the target data. At this time, considering the needs of the original user, the data will be copied according to the instructions of the original user. In this embodiment, the specific implementation method is as follows:

[0209] When receiving an operation request submitted by a target user for the target data, performing operation processing on the target data according to the operation request to obtain operation data;

[0210] generating first operation information for the target user and second operation information for the original user to whom the storage space belongs according to the operation data;

[0211] Sending the first operation information to the target user, and sending the second operation information to the original user;

[0212] When receiving a copy instruction returned by the original user in response to the second operation information, the target data is copied.

[0213] Specifically, when the target user submits an operation request for the target data, the target data is processed according to the operation request to obtain operation data; then, first operation information for the target user and second operation information for the original user to whom the storage space belongs are generated according to the operation data; the first operation information is sent to the target user, and the second operation information is sent to the original user; when the original user returns a copy instruction for the second operation information, the target data is copied.

[0214] In actual applications, the first operation information specifically refers to reminding the target user that the operation of the target data has been completed, and the second operation information specifically refers to reminding the original user that the target data has changed, and whether it is necessary to copy the target data before the operation in the storage space. When the original user returns a copy instruction in response to the second operation information, it means that the original user needs to copy the target data at this time, and the target data can be copied.

[0215] After the operation on the target data is completed, a reminder message is sent to the target user and the original user, so that the target user and the original user can timely grasp the changes in the target data, and can also copy the target data that has not been operated, making it more convenient for the original user to supervise the data.

[0216] The data decryption method provided by the present application, after obtaining a data request submitted for encrypted data in a storage space, sends the identity identifier contained in the data request to the key management interface, and determines the secondary key corresponding to the secondary ciphertext data based on the secondary ciphertext data returned by the key management interface, and then decrypts the primary ciphertext data corresponding to the secondary ciphertext data based on the secondary key to obtain the primary key, and finally decrypts the encrypted data based on the primary key to obtain the target data, thereby improving the security of the target data through secondary encryption, and realizing data sharing through data decryption, so that users can share the target data without copying the data, effectively reducing the consumption of computing resources and the time it takes for users to obtain target data, and further improving the user experience.

[0217] Figure 4 A flowchart of a data encryption method according to an embodiment of the present application is shown, which specifically includes the following steps:

[0218] Step S402: obtaining a sharing application from the original user to the target user for sharing encrypted data in the storage space.

[0219] In actual applications, cloud storage is being used by more and more users, and the security of cloud storage is also a major topic of concern for users. Usually, public cloud storage disks provided by cloud storage platforms use a one-time encryption method to encrypt data, and in data sharing scenarios, data needs to be copied before it can be shared with other users. This is not only time-consuming and labor-intensive, but also reduces the user experience.

[0220] The data encryption method provided by the present application is to improve the security of data and realize data sharing without copying in data sharing scenarios. When obtaining a sharing application for encrypted data in a shared storage space from an original user to a target user, the first-level key of the encrypted data is determined according to the first identity identifier contained in the sharing application, and the first-level key is encrypted according to the second-level key generated according to the second identity identifier contained in the sharing application to obtain the first-level ciphertext data. Finally, the correspondence between the first-level ciphertext data and the second-level ciphertext data corresponding to the second-level key is recorded, and the second-level ciphertext data and the second-level identity identifier are synchronized to the key management interface, thereby improving the security of data through secondary encryption. In the data sharing scenario, the data sharing operation can be completed without copying the data, further improving the user experience.

[0221] This embodiment will take data sharing as an example to illustrate the data encryption method. During the data sharing process, due to the characteristics of cloud storage, each user's data is encrypted and stored in an encrypted disk. Therefore, during the data sharing process, the data needs to be decrypted and copied to the encrypted disk belonging to the target user before the data sharing can be completed. However, the process of copying data is time-consuming and there are also security issues with the data. In view of this, the present application provides a data encryption method, which can realize the data sharing operation without copying the data during the data sharing process, and the data security issue can also be solved.

[0222] In actual applications, the sharing application specifically refers to the application submitted by the original user after agreeing to share the encrypted data in the storage space with the target user. At this time, it will be necessary to establish an access relationship between the target user and the storage space, that is, the data encryption process, so that data sharing can be completed without copying the data. It should be noted that the contents involved in this embodiment that are the same as those in the above embodiments can be found in the description of the above embodiments, and this embodiment will not be elaborated in detail here.

[0223] Furthermore, in the data sharing scenario, when the original user shares data with the target user, the data sharing needs to be completed through the front-end interactive interface. In the embodiment, the specific implementation method is as follows:

[0224] Determining a sharing instruction sent by the original user to the target user for the encrypted data; the sharing instruction includes a sharing link of the encrypted data;

[0225] When the target user triggers the sharing link, a reminder message is sent to the original user indicating that the target user agrees to share the encrypted data.

[0226] In actual applications, the sharing process provided by this embodiment is similar to the corresponding description content of the above embodiment. Please refer to the corresponding description content in the above embodiment, and this embodiment will not be described in detail here.

[0227] It should be noted that, when the target user triggers the sharing link, it means that the data encryption process can continue, and a reminder message is sent to the original user that the target user agrees to share the encrypted data.

[0228] In addition, before data encryption, the storage space needs to store data, and the data in the storage space is written by the original user. The original user refers to the owner of the storage space, which can be understood as the user who shares data with the target user. In this embodiment, the specific process of writing data is as follows:

[0229] Obtaining a write request submitted by the original user for the target data, and determining the storage space corresponding to the original user according to the write request;

[0230] encrypting the target data using the primary key generated by the space identifier of the storage space, and writing the obtained encrypted data into the storage space;

[0231] Encrypting the primary key based on the original secondary key generated by the first identity identifier to obtain the original primary ciphertext data corresponding to the original user;

[0232] Creating a ciphertext table for the storage space according to the original first-level ciphertext data and the original second-level ciphertext data corresponding to the original second-level key;

[0233] The original secondary ciphertext data and the first identity identifier are synchronized to the key management interface; wherein the ciphertext table is used to record the correspondence between the secondary ciphertext data and the primary ciphertext data in the storage space.

[0234] In actual applications, the data writing process in this embodiment can refer to the corresponding description content in the above embodiments, and this embodiment will not be described in detail here.

[0235] Step S404: Determine the primary key of the encrypted data according to the first identity identifier of the original user included in the sharing application.

[0236] Specifically, based on the acquisition of the sharing application, the primary key of the encrypted data is further determined based on the first identity identifier of the original user included in the sharing application, wherein the first identity identifier specifically refers to the identity identifier corresponding to the original user.

[0237] Furthermore, in the process of determining the primary key, since the primary key is the final security measure for the encrypted data, the primary key needs to be authenticated before it can be obtained. In this embodiment, the specific implementation process is as follows:

[0238] Sending the first identity included in the sharing application to the key management interface;

[0239] Reading the ciphertext table of the storage space according to the original secondary ciphertext data returned by the key management interface;

[0240] Determine the original first-level ciphertext data corresponding to the original second-level ciphertext data according to the reading result;

[0241] The original first-level ciphertext data is decrypted based on the original second-level key determined by the original second-level ciphertext data to obtain the first-level key.

[0242] Specifically, first, the first identity identifier contained in the sharing application is sent to the key management interface, and secondly, the ciphertext table of the storage space is read according to the original second-level ciphertext data returned by the key management interface, and the original first-level ciphertext data corresponding to the original second-level ciphertext data is determined according to the reading result, and finally, the original first-level ciphertext data is decrypted based on the original second-level key determined by the original second-level ciphertext data to obtain the first-level key.

[0243] Among them, when the key management interface receives the first identity identifier, it will query the correspondence between the secondary ciphertext data and the identity identifier based on the first identity identifier, determine the original secondary ciphertext data corresponding to the first identity identifier, and return the original secondary ciphertext data.

[0244] See also Figure 5 As shown, when user A agrees to share the access rights of encrypted disk F with user B, data encryption will be performed on user B, and the secondary key KB of user B relative to encrypted disk F will be recorded, so that user B can access encrypted disk F.

[0245] Based on this, it is necessary to send the first identity A of user A to the key management interface, and read the ciphertext table of the encrypted disk F according to the secondary ciphertext data M2A returned by the key management interface to determine the secondary key KA (such as Figure 5In step 1), the first-level ciphertext data M1A corresponding to the second-level ciphertext data M2A is decrypted based on the second-level key KA to obtain the first-level key K1 (such as Figure 5 Step 2) in the above step to perform subsequent encryption operations.

[0246] Step S406: encrypt the primary key according to the secondary key generated by the second identity of the target user included in the sharing application to obtain primary ciphertext data.

[0247] Specifically, based on the above-mentioned determination of the first-level key, a second-level key is further generated according to the second identity identifier of the target user included in the sharing application, and the first-level key is encrypted based on the second-level key to obtain the first-level ciphertext data.

[0248] The second identity identifier specifically refers to the identity identifier of the target user. The secondary key is generated based on the second identity identifier and therefore has a unique corresponding relationship with the target user.

[0249] Furthermore, in order to ensure the security of the data during the process of obtaining the first-level ciphertext data, it is necessary to generate the second-level key based on the second identity identifier of the target user, and then encrypt the first-level key, so that in the subsequent data access process, only the target user with the second-level key can complete the access operation. In this embodiment, the specific implementation method is as follows:

[0250] Parsing the sharing application to obtain the second identity identifier;

[0251] Generate a secondary key corresponding to the target user according to the second identity identifier and a preset encryption algorithm;

[0252] The first-level key is encrypted based on the second-level key to obtain the first-level ciphertext data.

[0253] In practical applications, the preset encryption algorithm specifically refers to a method that can generate a secondary key in combination with an identity identifier, so that the generated secondary key only corresponds to the target user to whom the identity identifier belongs, which can further improve data security.

[0254] Continuing with the above example, the second identity identifier B of user B is obtained at this time, and the secondary key KB of user B is generated by combining the preset encryption algorithm, and the primary key K1 is encrypted using the secondary key KB (e.g. Figure 5 In step 3), the first-level ciphertext data M1B is obtained for subsequent encryption operations.

[0255] In summary, by encrypting the primary key using a secondary encryption method, data security can be effectively improved.

[0256] Step S408: Record the correspondence between the first-level ciphertext data and the second-level ciphertext data corresponding to the second-level key, and synchronize the second-level ciphertext data and the second identity identifier to the key management interface.

[0257] Specifically, when the first-level ciphertext data is obtained as mentioned above, it means that the sharing operation has been completed for the target user, and the target user can access the data in the storage space. In order to improve the security of the data, the correspondence between the first-level ciphertext data and the second-level ciphertext data corresponding to the second-level key will be recorded, and the second-level ciphertext data and the second identity identifier will be synchronized to the key management interface. Through the key management interface, the user's identity can be initially verified during the data decryption process, thereby further improving the security of the data.

[0258] Furthermore, recording the correspondence between the first-level ciphertext data and the second-level ciphertext data corresponding to the second-level key specifically refers to: determining the second-level ciphertext data corresponding to the second-level key; establishing the correspondence between the first-level ciphertext data and the second-level ciphertext data based on the second identity identifier, and recording it in the ciphertext table of the storage space.

[0259] Following the above example, after obtaining the first-level ciphertext data M1B, the second-level ciphertext data M2B of the second-level key KB is determined, the corresponding relationship between the first-level ciphertext data M1B and the second-level ciphertext data M2B is established, and recorded in the ciphertext table of the encryption disk F (such as Figure 5 Step 4), that is, modify the metadata set of the encrypted disk F, and then synchronize the corresponding relationship between the second identity B and the secondary ciphertext data M2B to the key management interface (such as Figure 5 Finally, user B is informed that he can access the data in the encrypted disk F (e.g. Figure 5 Step 6).

[0260] In addition, after the data is encrypted, if the target user needs to share the encrypted data in the storage space, the data needs to be decrypted. In this embodiment, the specific implementation method is as follows:

[0261] Obtaining a data request submitted by the target user for the encrypted data in the storage space;

[0262] Sending the second identity included in the data request to the key management interface;

[0263] Determining, according to the secondary ciphertext data returned by the key management interface, the secondary key corresponding to the secondary ciphertext data;

[0264] Decrypting the primary ciphertext data based on the secondary key to obtain the primary key;

[0265] The encrypted data is decrypted according to the primary key to obtain the target data.

[0266] In actual applications, the data decryption process can refer to the corresponding description content in the above embodiment, and this embodiment will not be described in detail here.

[0267] The data encryption method provided by the present application, when obtaining a sharing application of the original user to encrypt data in the shared storage space of the target user, determines the first-level key of the encrypted data according to the first identity identifier contained in the sharing application, and encrypts the first-level key according to the second-level key generated according to the second identity identifier contained in the sharing application to obtain the first-level ciphertext data, and finally records the correspondence between the first-level ciphertext data and the second-level ciphertext data corresponding to the second-level key, and synchronizes the second-level ciphertext data and the second identity identifier to the key management interface, thereby improving the security of the data through secondary encryption, and in the data sharing scenario, the data sharing operation can be completed without copying the data, thereby further improving the user experience.

[0268] The following combined Figure 6 , taking the application of the data decryption method provided by this application in a data sharing scenario as an example, the data decryption method is further explained. Figure 6 A processing flow chart of a data decryption method applied to a data sharing scenario provided by an embodiment of the present application is shown, which specifically includes the following steps:

[0269] Step S602: obtaining a sharing application from a first user to share encrypted data in an encrypted disk with a second user.

[0270] Specifically, in a data sharing scenario, the first user needs to share the data in the encrypted disk with the second user. At this time, in order to improve the efficiency of data sharing, the data sharing can be completed without the second user copying the data, and it will be completed by establishing a secondary key for the second user.

[0271] Step S604: Determine the primary key for encrypting the data according to the first identity identifier of the first user included in the sharing application.

[0272] Step S606: encrypt the primary key according to the secondary key generated by the second identity of the second user included in the sharing application to obtain primary ciphertext data.

[0273] Step S608: Record the correspondence between the first-level ciphertext data and the second-level ciphertext data corresponding to the second-level key, and synchronize the second-level ciphertext data and the second identity to the key management interface.

[0274] Step S610: When a data request submitted by a second user for encrypted data in an encrypted disk is obtained, the second identity included in the data request is sent to the key management interface.

[0275] Step S612: Determine a secondary key corresponding to the secondary ciphertext data according to the secondary ciphertext data returned by the key management interface.

[0276] Step S614: Read the ciphertext table of the encrypted disk based on the secondary ciphertext data.

[0277] Step S616: Determine the primary ciphertext data corresponding to the secondary ciphertext data according to the reading result.

[0278] Step S618: decrypt the primary ciphertext data based on the secondary key to obtain the primary key.

[0279] Step S620: decrypt the encrypted data according to the primary key to obtain the target data.

[0280] Specifically, the detailed description of steps S602 to S620 of this embodiment can refer to the description of the embodiments of the above-mentioned data decryption method and data encryption method, and this embodiment will not be described in detail here.

[0281] To sum up, the security of the target data is improved through secondary encryption, and data sharing is achieved through data decryption, so that the target user can share the target data without copying the data, effectively reducing the consumption of computing resources and the time it takes for the target user to obtain the target data, further improving the user experience.

[0282] Corresponding to the above method embodiment, the present application also provides a data decryption device embodiment, Figure 7 FIG. 1 shows a schematic diagram of the structure of a data decryption device provided by an embodiment of the present application. Figure 7 As shown, the device includes:

[0283] The request acquisition module 702 is configured to acquire a data request submitted by a target user for encrypted data in the storage space;

[0284] The identification sending module 704 is configured to send the identity included in the data request to the key management interface;

[0285] A key determination module 706 is configured to determine, based on the secondary ciphertext data returned by the key management interface, a secondary key corresponding to the secondary ciphertext data;

[0286] A first decryption module 708 is configured to decrypt the primary ciphertext data corresponding to the secondary ciphertext data based on the secondary key to obtain the primary key;

[0287] The second decryption module 710 is configured to decrypt the encrypted data according to the primary key to obtain target data.

[0288] In an optional embodiment, upon receiving the identity identifier of the target user, the key management interface will query the correspondence between the secondary ciphertext data and the identity identifier based on the identity identifier, determine the secondary ciphertext data corresponding to the identity identifier, and return the secondary ciphertext data.

[0289] In an optional embodiment, the key determination module 706 includes:

[0290] a data parsing unit configured to parse the secondary ciphertext data to obtain a secondary ciphertext identifier of the secondary ciphertext data;

[0291] a query determination unit configured to query the metadata set of the storage space based on the secondary ciphertext identifier, and determine the secondary key identifier corresponding to the secondary ciphertext identifier according to the query result;

[0292] The key determination unit is configured to determine the secondary key in the storage space according to the secondary key identifier; wherein the metadata set records the corresponding relationship between the secondary ciphertext identifier and the secondary key identifier of the storage space.

[0293] In an optional embodiment, the first decryption module 708 includes:

[0294] a ciphertext table reading unit, configured to read a ciphertext table in a metadata set of the storage space based on the secondary ciphertext data;

[0295] a first-level ciphertext data determination unit configured to determine the first-level ciphertext data corresponding to the second-level ciphertext data according to the reading result;

[0296] The decryption processing unit is configured to decrypt the first-level ciphertext data based on the second-level key to obtain the first-level key; wherein the ciphertext table is used to record the correspondence between the second-level ciphertext data and the first-level ciphertext data in the storage space.

[0297] In an optional embodiment, the data decryption device further includes:

[0298] a sharing instruction determination module configured to determine a sharing instruction sent by an original user of the storage space to the target user for the encrypted data; the sharing instruction includes a sharing link for the encrypted data;

[0299] When the target user triggers the sharing link, the acquisition request module 702 is executed.

[0300] In an optional embodiment, the data decryption device further includes:

[0301] a data reading module configured to, upon receiving a sharing termination instruction for the storage space, read the first-level ciphertext data, the second-level ciphertext data, and the second-level key according to the sharing termination instruction;

[0302] a clearing processing module configured to perform clearing processing on the first-level ciphertext data, the second-level ciphertext data, and the second-level key to obtain cleared data;

[0303] The sending and receiving module is configured to send synchronous clearing data to the key management interface based on the clearing data, and receive the processing result returned by the key management interface for the synchronous clearing data; the synchronous clearing data is used to trigger the clearing mechanism of the key management interface.

[0304] In an optional embodiment, the data decryption device further includes:

[0305] an operation processing module configured to, upon receiving an operation request submitted by the target user for the target data, perform an operation on the target data according to the operation request to obtain operation data;

[0306] an operation information generating module configured to generate first operation information for the target user and second operation information for the original user to whom the storage space belongs according to the operation data;

[0307] an operation information sending module, configured to send the first operation information to the target user, and send the second operation information to the original user;

[0308] The copy processing module is configured to copy the target data when receiving a copy instruction returned by the original user in response to the second operation information.

[0309] In an optional embodiment, the data decryption device further includes:

[0310] a write request obtaining module configured to obtain a write request submitted by an original user for the target data, and determine the storage space corresponding to the original user according to the write request;

[0311] a first encryption processing module configured to encrypt the target data using the primary key generated by the space identifier of the storage space, and write the obtained encrypted data into the storage space;

[0312] A second encryption processing module is configured to encrypt the primary key based on the original secondary key generated by the written identity identifier to obtain the original primary ciphertext data corresponding to the original user;

[0313] a ciphertext table creation module configured to create a ciphertext table for the storage space based on the original first-level ciphertext data and the original second-level ciphertext data corresponding to the original second-level key;

[0314] The synchronization adding module is configured to synchronize the original secondary ciphertext data and the write identity to the key management interface, and add the ciphertext table to the metadata set of the storage space.

[0315] In an optional embodiment, the data decryption device further includes:

[0316] A sharing application acquisition module is configured to acquire a sharing application from the original user to share the encrypted data with the target user;

[0317] a first-level key determination module configured to determine the first-level key according to the write identity included in the sharing application;

[0318] a secondary key generation module configured to generate the secondary key according to the identity identifier included in the sharing application, encrypt the primary key, and obtain the primary ciphertext data;

[0319] An update synchronization module is configured to update the ciphertext table based on the first-level ciphertext data and the second-level ciphertext data corresponding to the second-level key, and synchronize the second-level ciphertext data and the identity identifier to the key management interface.

[0320] The data decryption device provided in this embodiment, after obtaining a data request submitted for encrypted data in the storage space, sends the identity identifier contained in the data request to the key management interface, and determines the secondary key corresponding to the secondary ciphertext data based on the secondary ciphertext data returned by the key management interface, and then decrypts the first-level ciphertext data corresponding to the second-level ciphertext data based on the secondary key to obtain the first-level key, and finally decrypts the encrypted data according to the first-level key to obtain the target data, thereby improving the security of the target data through secondary encryption, and realizing data sharing through data decryption, so that users can share the target data without copying the data, effectively reducing the consumption of computing resources and the time it takes for users to obtain target data, and further improving the user experience.

[0321] The above is a schematic diagram of a data decryption device according to this embodiment. It should be noted that the technical solution of this data decryption device and the technical solution of the aforementioned data decryption method are based on the same concept. For details not described in detail in the technical solution of the data decryption device, please refer to the description of the technical solution of the aforementioned data decryption method.

[0322] Corresponding to the above method embodiment, the present application also provides a data encryption device embodiment, Figure 8 FIG. 1 shows a schematic diagram of the structure of a data encryption device provided by an embodiment of the present application. Figure 8 As shown, the device includes:

[0323] The application acquisition module 802 is configured to acquire an application from an original user to share encrypted data in a storage space with a target user;

[0324] A key determination module 804 is configured to determine a primary key for the encrypted data according to the first identity identifier of the original user included in the sharing application;

[0325] The encryption processing module 806 is configured to encrypt the primary key according to the secondary key generated by the second identity of the target user included in the sharing application to obtain primary ciphertext data;

[0326] The record synchronization module 808 is configured to record the correspondence between the first-level ciphertext data and the second-level ciphertext data corresponding to the second-level key, and synchronize the second-level ciphertext data and the second identity to the key management interface.

[0327] In an optional embodiment, the key determination module 804 includes:

[0328] an identification sending unit, configured to send the first identity included in the sharing application to the key management interface;

[0329] a ciphertext table reading unit, configured to read the ciphertext table of the storage space according to the original secondary ciphertext data returned by the key management interface;

[0330] a ciphertext data determining unit configured to determine original first-level ciphertext data corresponding to the original second-level ciphertext data according to the reading result;

[0331] The decryption processing unit is configured to decrypt the original first-level ciphertext data based on the original second-level key determined by the original second-level ciphertext data to obtain the first-level key.

[0332] In an optional embodiment, upon receiving the first identity identifier, the key management interface will query the correspondence between the secondary ciphertext data and the identity identifier based on the first identity identifier, determine the original secondary ciphertext data corresponding to the first identity identifier, and return the original secondary ciphertext data.

[0333] In an optional embodiment, the encryption processing module 806 includes:

[0334] an application parsing unit, configured to parse the sharing application to obtain the second identity identifier;

[0335] a secondary key generating unit configured to generate a secondary key corresponding to the target user according to the second identity identifier and a preset encryption algorithm;

[0336] The encryption processing unit is configured to perform encryption processing on the primary key based on the secondary key to obtain the primary ciphertext data.

[0337] In an optional embodiment, the record synchronization module 808 includes:

[0338] determining a secondary ciphertext data unit, configured to determine the secondary ciphertext data corresponding to the secondary key;

[0339] The recording unit is configured to establish a correspondence between the first-level ciphertext data and the second-level ciphertext data according to the second identity identifier, and record the correspondence in the ciphertext table of the storage space.

[0340] In an optional embodiment, the data encryption module further includes:

[0341] a sharing instruction determination module, configured to determine a sharing instruction sent by the original user to the target user with respect to the encrypted data; the sharing instruction includes a sharing link of the encrypted data;

[0342] The reminder information sending module is configured to send a reminder message to the original user that the target user agrees to share the encrypted data when the target user triggers the sharing link.

[0343] In an optional embodiment, the data encryption module further includes:

[0344] a write request obtaining module configured to obtain a write request submitted by the original user for the target data, and determine the storage space corresponding to the original user according to the write request;

[0345] an encryption writing module, configured to encrypt the target data using the primary key generated by the space identifier of the storage space, and write the obtained encrypted data into the storage space;

[0346] an encryption first-level key module configured to encrypt the first-level key based on the original second-level key generated by the first identity identifier to obtain original first-level ciphertext data corresponding to the original user;

[0347] a ciphertext table creation module configured to create a ciphertext table for the storage space based on the original first-level ciphertext data and the original second-level ciphertext data corresponding to the original second-level key;

[0348] A data synchronization module is configured to synchronize the original secondary ciphertext data and the first identity identifier to the key management interface; wherein the ciphertext table is used to record the correspondence between the secondary ciphertext data and the primary ciphertext data in the storage space.

[0349] In an optional embodiment, the data encryption module further includes:

[0350] a data request obtaining module configured to obtain a data request submitted by the target user for the encrypted data in the storage space;

[0351] a second identity sending module, configured to send the second identity included in the data request to the key management interface;

[0352] a second-level key determination module configured to determine, based on the second-level ciphertext data returned by the key management interface, the second-level key corresponding to the second-level ciphertext data;

[0353] a first-level ciphertext data decryption module, configured to decrypt the first-level ciphertext data based on the second-level key to obtain the first-level key;

[0354] The encrypted data decryption module is configured to decrypt the encrypted data according to the primary key to obtain the target data.

[0355] The data encryption device provided in this embodiment, when obtaining a sharing application from an original user to encrypt data in a shared storage space of a target user, determines the first-level key of the encrypted data according to the first identity identifier contained in the sharing application, and encrypts the first-level key according to the second-level key generated according to the second identity identifier contained in the sharing application to obtain first-level ciphertext data, and finally records the correspondence between the first-level ciphertext data and the second-level ciphertext data corresponding to the second-level key, and synchronizes the second-level ciphertext data and the second identity identifier to the key management interface, thereby improving data security through secondary encryption. In addition, in a data sharing scenario, data sharing operations can be completed without copying the data, further improving the user experience.

[0356] The above is a schematic diagram of a data encryption device according to this embodiment. It should be noted that the technical solution of this data encryption device and the technical solution of the above-mentioned data encryption method are based on the same concept. For details not described in detail in the technical solution of the data encryption device, please refer to the description of the technical solution of the above-mentioned data encryption method.

[0357] Corresponding to the above method embodiments, the present application also provides an embodiment of a data processing system, Figure 9 FIG. 1 shows a schematic diagram of a data processing system provided by an embodiment of the present application. Figure 9 As shown, the data processing system 900 includes:

[0358] Compute nodes 902, encryption nodes 904, and key management interface 906;

[0359] The computing node 902 is configured to receive a decryption request submitted by a target user for encrypted data; and send a data request carrying the identity of the target user to the encryption node 904 according to the decryption request;

[0360] The encryption node 904 is configured to send the identity included in the data request to the key management interface 906;

[0361] The key management interface 906 is configured to query the corresponding relationship between the secondary ciphertext data and the identity identifier according to the identity identifier, determine the secondary ciphertext data corresponding to the identity identifier, and send the secondary ciphertext data to the encryption node 904;

[0362] The encryption node 904 is further configured to determine a secondary key corresponding to the secondary ciphertext data; decrypt the primary ciphertext data corresponding to the secondary ciphertext data based on the secondary key to obtain the primary key; and decrypt the encrypted data according to the primary key to obtain the target data.

[0363] In an optional embodiment, the computing node 902 is further configured to: obtain a sharing application from an original user of the target data to share the encrypted data with the target user; and send the sharing application to the encryption node 904;

[0364] Correspondingly, the encryption node 904 is further configured to: determine the first-level key based on the write identity included in the sharing application; encrypt the first-level key based on the second-level key generated by the identity included in the sharing application to obtain the first-level ciphertext data; update the ciphertext table based on the first-level ciphertext data and the second-level ciphertext data corresponding to the second-level key, and synchronize the second-level ciphertext data and the identity to the key management interface 906.

[0365] In an optional embodiment, the encryption node 904 is further configured to: parse the secondary ciphertext data to obtain a secondary ciphertext identifier of the secondary ciphertext data; query the metadata set of the storage space based on the secondary ciphertext identifier, and determine a secondary key identifier corresponding to the secondary ciphertext identifier based on the query result; and determine the secondary key in the storage space based on the secondary key identifier;

[0366] The metadata set records the corresponding relationship between the secondary ciphertext identifier and the secondary key identifier of the storage space.

[0367] In an optional embodiment, the encryption node 904 is further configured to: read a ciphertext table in the metadata set of the storage space based on the secondary ciphertext data; determine the primary ciphertext data corresponding to the secondary ciphertext data based on the reading result; decrypt the primary ciphertext data based on the secondary key to obtain the primary key;

[0368] The ciphertext table is used to record the corresponding relationship between the secondary ciphertext data and the primary ciphertext data in the storage space.

[0369] The data processing system provided in this embodiment improves the security of target data through secondary encryption and realizes data sharing through data decryption, allowing users to share target data without copying the data, effectively reducing the consumption of computing resources and the time it takes for users to obtain target data, and further improving the user experience.

[0370] The above is a schematic diagram of a data processing system according to this embodiment. It should be noted that the technical solution of this data processing system and the technical solution of the data decryption method or data encryption method described above are based on the same concept. For details not described in detail in the technical solution of the data processing system, please refer to the description of the technical solution of the data decryption method or data encryption method described above.

[0371] Figure 10 The block diagram shows a first computing device 1000 according to an embodiment of the present application. Components of the computing device 1000 include, but are not limited to, a memory 1010 and a processor 1020. The processor 1020 is connected to the memory 1010 via a bus 1030, and a database 1050 is used to store data.

[0372] The computing device 1000 also includes an access device 1040 that enables the computing device 1000 to communicate via one or more networks 1060. Examples of these networks include a public switched telephone network (PSTN), a local area network (LAN), a wide area network (WAN), a personal area network (PAN), or a combination of communication networks such as the Internet. The access device 1040 may include one or more of any type of network interface (e.g., a network interface card (NIC)) whether wired or wireless, such as an IEEE 802.11 wireless local area network (WLAN) wireless interface, a Worldwide Interoperability for Microwave Access (Wi-MAX) interface, an Ethernet interface, a universal serial bus (USB) interface, a cellular network interface, a Bluetooth interface, a near field communication (NFC) interface, and the like.

[0373] In one embodiment of the present application, the above components of the computing device 1000 and Figure 10 Other components not shown in the figure may also be connected to each other, for example, via a bus. Figure 10 The computing device structure block diagram shown is for illustrative purposes only and is not intended to limit the scope of the present application. Those skilled in the art may add or replace other components as needed.

[0374] The computing device 1000 may be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., a tablet computer, a personal digital assistant, a laptop computer, a notebook computer, a netbook computer, etc.), a mobile phone (e.g., a smartphone), a wearable computing device (e.g., a smartwatch, smart glasses, etc.), or other types of mobile devices, or a stationary computing device such as a desktop computer or PC. The computing device 1000 may also be a mobile or stationary server.

[0375] The processor 1020 is configured to execute the following computer-executable instructions:

[0376] Get data requests submitted for encrypted data in storage space;

[0377] Sending the identity included in the data request to the key management interface;

[0378] Determining, based on the secondary ciphertext data returned by the key management interface, a secondary key corresponding to the secondary ciphertext data;

[0379] Decrypting the primary ciphertext data corresponding to the secondary ciphertext data based on the secondary key to obtain the primary key;

[0380] The encrypted data is decrypted according to the primary key to obtain target data.

[0381] The above is a schematic diagram of a computing device according to this embodiment. It should be noted that the technical solution of the computing device and the technical solution of the above-mentioned data decryption method are based on the same concept. For details not described in detail in the technical solution of the computing device, please refer to the description of the technical solution of the above-mentioned data decryption method.

[0382] Figure 11 The following is a block diagram of a second computing device 1100 according to an embodiment of the present application. The components of the computing device 1100 include, but are not limited to, a memory 1110 and a processor 1120. The processor 1120 is connected to the memory 1110 via a bus 1130, and a database 1150 is used to store data.

[0383] The computing device 1100 also includes an access device 1140 that enables the computing device 1100 to communicate via one or more networks 1160. Examples of such networks include a public switched telephone network (PSTN), a local area network (LAN), a wide area network (WAN), a personal area network (PAN), or a combination of communication networks such as the Internet. The access device 1140 may include one or more of any type of network interface (e.g., a network interface card (NIC)) whether wired or wireless, such as an IEEE 802.11 wireless local area network (WLAN) wireless interface, a Worldwide Interoperability for Microwave Access (Wi-MAX) interface, an Ethernet interface, a universal serial bus (USB) interface, a cellular network interface, a Bluetooth interface, a near field communication (NFC) interface, and the like.

[0384] In one embodiment of the present application, the above components of the computing device 1100 and Figure 11 Other components not shown in the figure may also be connected to each other, for example, via a bus. Figure 11 The computing device structure block diagram shown is for illustrative purposes only and is not intended to limit the scope of the present application. Those skilled in the art may add or replace other components as needed.

[0385] Computing device 1100 can be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., a tablet computer, a personal digital assistant, a laptop computer, a notebook computer, a netbook computer, etc.), a mobile phone (e.g., a smartphone), a wearable computing device (e.g., a smartwatch, smart glasses, etc.), or other types of mobile devices, or a stationary computing device such as a desktop computer or PC. Computing device 1100 can also be a mobile or stationary server.

[0386] The processor 1120 is configured to execute the following computer-executable instructions:

[0387] Obtaining a sharing request from the original user for encrypted data in the shared storage space of the target user;

[0388] Determining the primary key of the encrypted data according to the first identity identifier of the original user included in the sharing application;

[0389] Encrypting the primary key according to the secondary key generated by the second identity identifier of the target user included in the sharing application to obtain primary ciphertext data;

[0390] Record the correspondence between the first-level ciphertext data and the second-level ciphertext data corresponding to the second-level key, and synchronize the second-level ciphertext data and the second identity identifier to the key management interface.

[0391] The above is a schematic diagram of the second computing device of this embodiment. It should be noted that the technical solution of this computing device and the technical solution of the above-mentioned data encryption method are based on the same concept. For details not described in detail in the technical solution of the computing device, please refer to the description of the technical solution of the above-mentioned data encryption method.

[0392] An embodiment of the present application further provides a computer-readable storage medium storing computer instructions, which, when executed by a processor, are used to:

[0393] Get data requests submitted for encrypted data in storage space;

[0394] Sending the identity included in the data request to the key management interface;

[0395] Determining, based on the secondary ciphertext data returned by the key management interface, a secondary key corresponding to the secondary ciphertext data;

[0396] Decrypting the primary ciphertext data corresponding to the secondary ciphertext data based on the secondary key to obtain the primary key;

[0397] The encrypted data is decrypted according to the primary key to obtain target data.

[0398] The above is a schematic diagram of a computer-readable storage medium according to this embodiment. It should be noted that the technical solution of this storage medium and the technical solution of the above-mentioned data decryption method are based on the same concept. For details not described in detail in the technical solution of the storage medium, please refer to the description of the technical solution of the above-mentioned data decryption method.

[0399] An embodiment of the present application also provides a second computer-readable storage medium storing computer instructions, which, when executed by a processor, are used to:

[0400] Obtaining a sharing request from the original user for encrypted data in the shared storage space of the target user;

[0401] Determining the primary key of the encrypted data according to the first identity identifier of the original user included in the sharing application;

[0402] Encrypting the primary key according to the secondary key generated by the second identity identifier of the target user included in the sharing application to obtain primary ciphertext data;

[0403] Record the correspondence between the first-level ciphertext data and the second-level ciphertext data corresponding to the second-level key, and synchronize the second-level ciphertext data and the second identity identifier to the key management interface.

[0404] The above is a schematic diagram of a computer-readable storage medium according to this embodiment. It should be noted that the technical solution of this storage medium and the technical solution of the above-mentioned data encryption method are based on the same concept. For details not described in detail in the technical solution of the storage medium, please refer to the description of the technical solution of the above-mentioned data encryption method.

[0405] The foregoing description describes specific embodiments of the present application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that described in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order shown or the sequential order to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0406] The computer instructions include computer program code, which may be in source code form, object code form, executable file, or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal, and software distribution medium, etc. It should be noted that the content contained in the computer-readable medium may be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0407] It should be noted that for the aforementioned method embodiments, for ease of description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that this application is not limited by the order of the actions described, because according to this application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in this specification are all preferred embodiments, and the actions and modules involved are not necessarily required by this application.

[0408] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0409] The preferred embodiments of the present application disclosed above are intended only to help illustrate the present application. The optional embodiments do not describe all details in detail, nor do they limit the invention to the specific embodiments described. Obviously, many modifications and variations can be made based on the content of this application. This application selects and describes these embodiments in detail to better explain the principles and practical applications of this application, so that those skilled in the art can better understand and utilize this application. This application is limited only by the claims and their full scope and equivalents.

Claims

1. A data decryption method, comprising: Get data requests submitted for encrypted data in storage space; Sending the identity included in the data request to the key management interface, wherein the key management interface is an interface for hosting secondary key-related data, and the key management interface stores the correspondence between each user's identity and its corresponding secondary ciphertext data; Determining, based on the secondary ciphertext data returned by the key management interface, a secondary key corresponding to the secondary ciphertext data; Decrypting the primary ciphertext data corresponding to the secondary ciphertext data based on the secondary key to obtain the primary key; The encrypted data is decrypted according to the primary key to obtain target data.

2. According to the data decryption method according to claim 1, when the key management interface receives the identity identifier, it will query the correspondence between the secondary ciphertext data and the identity identifier based on the identity identifier, determine the secondary ciphertext data corresponding to the identity identifier, and return the secondary ciphertext data.

3. The data decryption method according to claim 1, wherein determining the secondary key corresponding to the secondary ciphertext data comprises: Parsing the secondary ciphertext data to obtain a secondary ciphertext identifier of the secondary ciphertext data; Querying the metadata set of the storage space based on the secondary ciphertext identifier, and determining the secondary key identifier corresponding to the secondary ciphertext identifier according to the query result; The secondary key is determined in the storage space according to the secondary key identifier; wherein the metadata set records the corresponding relationship between the secondary ciphertext identifier and the secondary key identifier of the storage space.

4. The data decryption method according to claim 1, wherein decrypting the primary ciphertext data corresponding to the secondary ciphertext data based on the secondary key to obtain the primary key comprises: Reading a ciphertext table in a metadata set of the storage space based on the secondary ciphertext data; Determine the first-level ciphertext data corresponding to the second-level ciphertext data according to the reading result; The first-level ciphertext data is decrypted based on the second-level key to obtain the first-level key; wherein the ciphertext table is used to record the corresponding relationship between the second-level ciphertext data and the first-level ciphertext data in the storage space.

5. The data decryption method according to claim 1, before executing the step of obtaining a data request submitted for the encrypted data in the storage space, further comprising: Determining a sharing instruction sent by an original user to which the storage space belongs to the target user with respect to the encrypted data; The sharing instruction includes a sharing link of the encrypted data; When the target user triggers the sharing link, the step of obtaining a data request submitted for the encrypted data in the storage space is executed.

6. The data decryption method according to claim 5, further comprising: When receiving a sharing termination instruction for the storage space, reading the first-level ciphertext data, the second-level ciphertext data, and the second-level key according to the sharing termination instruction; performing clearing processing on the first-level ciphertext data, the second-level ciphertext data, and the second-level key to obtain cleared data; Based on the clear data, synchronous clear data is sent to the key management interface, and a processing result returned by the key management interface for the synchronous clear data is received; the synchronous clear data is used to trigger a clear mechanism of the key management interface.

7. The data decryption method according to claim 1, further comprising: When receiving an operation request submitted by a target user for the target data, performing operation processing on the target data according to the operation request to obtain operation data; generating first operation information for the target user and second operation information for the original user to whom the storage space belongs according to the operation data; Sending the first operation information to the target user, and sending the second operation information to the original user; When receiving a copy instruction returned by the original user in response to the second operation information, the target data is copied.

8. The data decryption method according to claim 1, before executing the step of obtaining a data request submitted for the encrypted data in the storage space, further comprising: Obtaining a write request submitted by an original user for the target data, and determining the storage space corresponding to the original user according to the write request; encrypting the target data using the primary key generated by the space identifier of the storage space, and writing the obtained encrypted data into the storage space; Encrypting the primary key based on the original secondary key generated by writing the identity identifier to obtain the original primary ciphertext data corresponding to the original user; Creating a ciphertext table for the storage space according to the original first-level ciphertext data and the original second-level ciphertext data corresponding to the original second-level key; The original secondary ciphertext data and the write identity are synchronized to the key management interface, and the ciphertext table is added to the metadata set of the storage space.

9. The data decryption method according to claim 8, before executing the step of obtaining a data request submitted for the encrypted data in the storage space, further comprising: Obtaining a sharing application from an original user to share the encrypted data with a target user; Determining the primary key according to the write identity included in the sharing application; encrypting the primary key according to the secondary key generated by the identity identifier included in the sharing application to obtain the primary ciphertext data; The ciphertext table is updated based on the first-level ciphertext data and the second-level ciphertext data corresponding to the second-level key, and the second-level ciphertext data and the identity identifier are synchronized to the key management interface.

10. A data decryption device, comprising: an acquisition request module configured to acquire a data request submitted for encrypted data in the storage space; an identification sending module configured to send the identity included in the data request to a key management interface, wherein the key management interface is an interface for hosting secondary key-related data and stores a correspondence between each user's identity and its corresponding secondary ciphertext data; a key determination module configured to determine, based on the secondary ciphertext data returned by the key management interface, a secondary key corresponding to the secondary ciphertext data; A first decryption module is configured to decrypt the primary ciphertext data corresponding to the secondary ciphertext data based on the secondary key to obtain the primary key; The second decryption module is configured to decrypt the encrypted data according to the primary key to obtain target data.

11. A data encryption method, comprising: Obtaining a sharing application from an original user to share encrypted data in a storage space with a target user, wherein the sharing application is an application submitted by the original user after agreeing to share the encrypted data in the storage space with the target user; Determining the primary key of the encrypted data according to the first identity identifier of the original user included in the sharing application; Encrypting the primary key according to the secondary key generated by the second identity identifier of the target user included in the sharing application to obtain primary ciphertext data; Record the correspondence between the first-level ciphertext data and the second-level ciphertext data corresponding to the second-level key, and synchronize the second-level ciphertext data and the second identity identifier to the key management interface, wherein the key management interface is an interface for hosting second-level key-related data, and the key management interface stores the correspondence between each user's identity identifier and its corresponding second-level ciphertext data.

12. The data encryption method according to claim 11, wherein determining the primary key of the encrypted data based on the first identity identifier of the original user included in the sharing application comprises: Sending the first identity included in the sharing application to the key management interface; Reading the ciphertext table of the storage space according to the original secondary ciphertext data returned by the key management interface; Determine the original first-level ciphertext data corresponding to the original second-level ciphertext data according to the reading result; The original first-level ciphertext data is decrypted based on the original second-level key determined by the original second-level ciphertext data to obtain the first-level key.

13. According to the data encryption method according to claim 12, when the key management interface receives the first identity identifier, it will query the correspondence between the secondary ciphertext data and the identity identifier based on the first identity identifier, determine the original secondary ciphertext data corresponding to the first identity identifier, and return the original secondary ciphertext data.

14. The data encryption method according to claim 11, wherein the step of encrypting the primary key using the secondary key generated based on the second identity of the target user included in the sharing application to obtain the primary ciphertext data comprises: Parsing the sharing application to obtain the second identity identifier; Generate a secondary key corresponding to the target user according to the second identity identifier and a preset encryption algorithm; The first-level key is encrypted based on the second-level key to obtain the first-level ciphertext data.

15. The data encryption method according to claim 11, wherein the recording of the correspondence between the primary ciphertext data and the secondary ciphertext data corresponding to the secondary key comprises: Determining the secondary ciphertext data corresponding to the secondary key; A correspondence between the first-level ciphertext data and the second-level ciphertext data is established according to the second identity identifier, and is recorded in the ciphertext table of the storage space.

16. The data encryption method according to claim 11, before the step of obtaining a sharing request from the original user to share the encrypted data in the storage space with the target user, further comprising: Determining a sharing instruction sent by the original user to the target user with respect to the encrypted data; The sharing instruction includes a sharing link of the encrypted data; When the target user triggers the sharing link, a reminder message is sent to the original user indicating that the target user agrees to share the encrypted data.

17. The data encryption method according to claim 11, before the step of obtaining a sharing request from the original user to share the encrypted data in the storage space with the target user, further comprising: Obtaining a write request submitted by the original user for target data, and determining the storage space corresponding to the original user according to the write request; encrypting the target data using the primary key generated by the space identifier of the storage space, and writing the obtained encrypted data into the storage space; Encrypting the primary key based on the original secondary key generated by the first identity identifier to obtain the original primary ciphertext data corresponding to the original user; Creating a ciphertext table for the storage space according to the original first-level ciphertext data and the original second-level ciphertext data corresponding to the original second-level key; The original secondary ciphertext data and the first identity identifier are synchronized to the key management interface; wherein the ciphertext table is used to record the correspondence between the secondary ciphertext data and the primary ciphertext data in the storage space.

18. The data encryption method according to claim 17, further comprising: after the steps of recording the correspondence between the first-level ciphertext data and the second-level ciphertext data corresponding to the second-level key, and synchronizing the second-level ciphertext data and the second identity identifier to the key management interface are performed: Obtaining a data request submitted by the target user for the encrypted data in the storage space; Sending the second identity included in the data request to the key management interface; Determining, according to the secondary ciphertext data returned by the key management interface, the secondary key corresponding to the secondary ciphertext data; Decrypting the primary ciphertext data based on the secondary key to obtain the primary key; The encrypted data is decrypted according to the primary key to obtain the target data.

19. A data encryption device, comprising: an application acquisition module configured to acquire an application for sharing encrypted data in a storage space from an original user to a target user, wherein the application is an application submitted by the original user after agreeing to share the encrypted data in the storage space with the target user; a key determination module configured to determine the primary key of the encrypted data according to the first identity identifier of the original user included in the sharing application; an encryption processing module configured to encrypt the primary key according to the secondary key generated by the second identity identifier of the target user included in the sharing application to obtain primary ciphertext data; The record synchronization module is configured to record the correspondence between the first-level ciphertext data and the second-level ciphertext data corresponding to the second-level key, and synchronize the second-level ciphertext data and the second identity identifier to the key management interface, wherein the key management interface is an interface for hosting second-level key-related data, and the key management interface stores the correspondence between each user's identity identifier and its corresponding second-level ciphertext data.

20. A data processing system comprising: Compute nodes, encryption nodes, and key management interfaces; The computing node is configured to receive a decryption request submitted by a target user for encrypted data; According to the decryption request, a data request carrying the identity identifier of the target user is sent to the encryption node; The encryption node is configured to send the identity included in the data request to the key management interface, wherein the key management interface is an interface for hosting secondary key-related data, and the key management interface stores a correspondence between each user's identity and its corresponding secondary ciphertext data; The key management interface is configured to query the corresponding relationship between the secondary ciphertext data and the identity identifier according to the identity identifier, determine the secondary ciphertext data corresponding to the identity identifier; and send the secondary ciphertext data to the encryption node; The encryption node is further configured to determine a secondary key corresponding to the secondary ciphertext data; decrypt the primary ciphertext data corresponding to the secondary ciphertext data based on the secondary key to obtain the primary key; and decrypt the encrypted data according to the primary key to obtain the target data.

21. The data processing system according to claim 20, wherein the computing node is further configured to: obtain a sharing request from an original user of the target data to share the encrypted data with the target user; and send the sharing request to the encryption node; Accordingly, the encryption node is further configured to: determine the first-level key based on the write identity included in the sharing application; encrypt the first-level key based on the second-level key generated by the identity included in the sharing application to obtain the first-level ciphertext data; update the ciphertext table based on the first-level ciphertext data and the second-level ciphertext data corresponding to the second-level key, and synchronize the second-level ciphertext data and the identity to the key management interface.

22. The data processing system according to claim 20, wherein the encryption node is further configured to: parse the secondary ciphertext data to obtain a secondary ciphertext identifier of the secondary ciphertext data; Querying the metadata set in the storage space based on the secondary ciphertext identifier, and determining the secondary key identifier corresponding to the secondary ciphertext identifier according to the query result; determining the secondary key in the storage space according to the secondary key identifier; The metadata set records the corresponding relationship between the secondary ciphertext identifier and the secondary key identifier of the storage space.

23. The data processing system according to claim 20, wherein the encryption node is further configured to: read a ciphertext table in a metadata set of a storage space based on the secondary ciphertext data; determine the primary ciphertext data corresponding to the secondary ciphertext data based on the read result; and decrypt the primary ciphertext data based on the secondary key to obtain the primary key; in, The ciphertext table is used to record the corresponding relationship between the secondary ciphertext data and the primary ciphertext data in the storage space.

24. A computing device comprising: memory and processor; The memory is configured to store computer-executable instructions, and the processor is configured to execute the computer-executable instructions: Get data requests submitted for encrypted data in storage space; Sending the identity included in the data request to the key management interface, wherein the key management interface is an interface for hosting secondary key-related data, and the key management interface stores the correspondence between each user's identity and its corresponding secondary ciphertext data; Determining, based on the secondary ciphertext data returned by the key management interface, a secondary key corresponding to the secondary ciphertext data; Decrypting the primary ciphertext data corresponding to the secondary ciphertext data based on the secondary key to obtain the primary key; The encrypted data is decrypted according to the primary key to obtain target data.

25. A computing device comprising: memory and processor; The memory is configured to store computer-executable instructions, and the processor is configured to execute the computer-executable instructions: Obtaining a sharing application from an original user to share encrypted data in a storage space with a target user, wherein the sharing application is an application submitted by the original user after agreeing to share the encrypted data in the storage space with the target user; Determining the primary key of the encrypted data according to the first identity identifier of the original user included in the sharing application; Encrypting the primary key according to the secondary key generated by the second identity identifier of the target user included in the sharing application to obtain primary ciphertext data; Record the correspondence between the first-level ciphertext data and the second-level ciphertext data corresponding to the second-level key, and synchronize the second-level ciphertext data and the second identity identifier to the key management interface, wherein the key management interface is an interface for hosting second-level key-related data, and the key management interface stores the correspondence between each user's identity identifier and its corresponding second-level ciphertext data.

26. A computer-readable storage medium storing computer instructions, wherein when the instructions are executed by a processor, the steps of the data decryption method according to any one of claims 1 to 9 are implemented.

27. A computer-readable storage medium storing computer instructions, which, when executed by a processor, implement the steps of the data encryption method according to any one of claims 11 to 18.

Images