Data encryption storage method, storage device, user equipment and storage medium

Abstract

The application provides a data encryption storage method, a storage device, a user equipment and a storage medium. The method is applied to the storage device and includes the following steps: receiving a first message including data identification of target data and user identification sent by the user equipment; determining an encryption type of the target data according to the data identification and the user identification, and sending a second message including an encryption type judgment result to the user equipment; and performing full encryption or selective encryption on the target data according to different encryption types. The application can improve the efficiency of data storage.

Description

Technical Field

[0001] This invention relates to the field of data storage technology, and in particular to a data encryption storage method, storage device, user equipment, and storage medium. Background Technology

[0002] In today's era of rapid development of big data, it is widely used in all aspects of society, especially in areas such as big data analysis and prediction, which bring tremendous convenience to human societal development. As data is the core of analysis and prediction, its storage is of paramount importance.

[0003] To address data storage security issues, data is typically encrypted using a key. Current technology usually involves encrypting all data with a key and then storing all encrypted data. However, the types of information stored are diverse. If all data is encrypted, the encryption and decryption algorithms would be extremely time-consuming, and data transmission would also consume significant network resources, impacting storage efficiency. Summary of the Invention

[0004] This invention provides a data encryption storage method, storage device, user device, and storage medium to solve the problem that encrypting all data affects storage efficiency.

[0005] In a first aspect, embodiments of the present invention provide a data encryption and storage method, applied to a storage device, comprising:

[0006] Receive a first message sent by the user equipment, which includes a data identifier for the target data and a user identifier;

[0007] The encryption type of the target data is determined based on the data identifier and the user identifier, and a second message including the encryption type determination result is sent to the user equipment; the encryption type of the target data includes full encryption or selective encryption.

[0008] When the encryption type of the target data is full encryption, a third message including the target data and a first confirmation message is received from the user equipment; a first key is generated according to the first confirmation message; the target data is fully encrypted according to the first key; and a fourth message including the storage location information of the first key is sent to the user equipment; wherein, the first confirmation message is used to indicate that the user equipment confirms that the encryption type of the target data is full encryption.

[0009] When the encryption type of the data is selected encryption, the system receives a fifth message from the user equipment, which includes the target data and the second confirmation information; generates a second key based on the second confirmation information; performs selected encryption on the target data based on the second key; and sends a sixth message to the user equipment, which includes the storage location information of the second key; wherein the second confirmation information is used to indicate that the user equipment confirms that the encryption type of the target data is selected encryption.

[0010] In one possible implementation, before sending the fourth message including the first key storage location information to the user equipment, the method further includes:

[0011] The first key is divided into a preset number of key segments, and the preset number of key segments are stored in the corresponding preset number of key spaces; the storage location information of the first key is generated according to the index information of each key space;

[0012] When the encryption type of the data is selected as encryption, the target data includes public data and private data;

[0013] Accordingly, the target data is encrypted using the second key, including:

[0014] The second key is used to encrypt the privacy data, and the storage location information of the second key is generated based on the index information of the key space where the second key is stored.

[0015] In one possible implementation, the encryption type of the target data is determined based on the data identifier and the user identifier, including:

[0016] The data type is determined based on the data identifier; the data type includes plaintext data type or encrypted data type.

[0017] User level is determined based on user identifier;

[0018] When the user's level is not lower than the preset level, the encryption type of the target data is determined to be full encryption;

[0019] When the user's level is lower than the preset level and the data type is plaintext, the encryption type of the target data is determined to be selected encryption.

[0020] In one possible implementation, the method further includes:

[0021] After sending the fourth message to the user equipment, receive the first key confirmation message sent by the user equipment and record it;

[0022] After sending the sixth message to the user equipment, the receiving user equipment sends a second key confirmation message and records it.

[0023] Secondly, embodiments of the present invention provide a data encryption and storage method, applied to a user equipment, comprising:

[0024] A first message including a data identifier and a user identifier of the target data is sent to the storage device; the first message is used to instruct the storage device to determine the encryption type of the target data based on the data identifier and the user identifier; the encryption type of the target data includes full encryption or selective encryption.

[0025] Receive a second message sent by the storage device, including the encryption type determination result;

[0026] When the encryption type of the target data is full encryption, a third message including the target data and the first confirmation information is sent to the storage device; a fourth message including the storage location information of the first key is received from the storage device; wherein, the third message is used to instruct the storage device to generate a first key according to the first confirmation information, and to perform full encryption on the target data according to the first key; the first confirmation information is used to indicate that the encryption type of the target data is confirmed to be full encryption;

[0027] When the encryption type of the data is selected encryption, a fifth message including the target data and the second confirmation information is sent to the storage device; a sixth message including the storage location information of the second key is received from the storage device; wherein, the fifth message is used to instruct the storage device to generate a second key based on the second confirmation information, and to perform selected encryption on the target data based on the second key, and the second confirmation information is used to indicate that the encryption type of the target data is selected encryption.

[0028] In one possible implementation, the method further includes:

[0029] After receiving the fourth message from the storage device, send a first key confirmation message to the storage device;

[0030] After receiving the sixth message from the storage device, a second key confirmation message is sent to the storage device.

[0031] Thirdly, embodiments of the present invention provide a storage device, including a first memory, a first processor, and a first computer program stored in the first memory and executable on the first processor. When the first processor executes the first computer program, it implements the steps of the data encryption storage method as described in the first aspect or any possible implementation of the first aspect.

[0032] Fourthly, embodiments of the present invention provide a user equipment, including a second memory, a second processor, and a second computer program stored in the second memory and executable on the second processor. When the second processor executes the second computer program, it implements the steps of the data encryption storage method as described in the second aspect above or any possible implementation of the second aspect.

[0033] Fifthly, embodiments of the present invention provide a data encryption storage system, including the storage device as described in the third aspect above and the user equipment as described in the fourth aspect above.

[0034] In a sixth aspect, embodiments of the present invention provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the data encryption storage system as described in the first aspect or any possible implementation of the first aspect.

[0035] In a seventh aspect, embodiments of the present invention provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the data encryption storage system as described in the second aspect above or any possible implementation of the second aspect.

[0036] This invention provides a data encryption storage method, storage device, user equipment, and storage medium. The method involves receiving a first message from the user equipment, including a data identifier of the target data and a user identifier; determining the encryption type of the target data based on the data identifier and the user identifier; and sending a second message to the user equipment including the encryption type determination result. By encrypting all or selectively encrypting the target data according to different encryption types, the method can improve data storage efficiency and data transmission efficiency. Attached Figure Description

[0037] To more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0038] Figure 1 This is a flowchart illustrating the implementation of a data encryption and storage method for storage devices provided in an embodiment of the present invention.

[0039] Figure 2 This is a flowchart illustrating the implementation of a data encryption and storage method for user equipment provided in an embodiment of the present invention.

[0040] Figure 3 This is a schematic diagram of the signaling interaction of the data encryption and storage method provided in the embodiments of the present invention;

[0041] Figure 4 This is a schematic diagram of the structure of a data encryption storage device applied to a storage device provided in an embodiment of the present invention;

[0042] Figure 5This is a schematic diagram of the structure of a data encryption storage device applied to a user equipment provided in an embodiment of the present invention;

[0043] Figure 6 This is a schematic diagram of a storage device provided in an embodiment of the present invention;

[0044] Figure 7 This is a schematic diagram of a user equipment provided in an embodiment of the present invention. Detailed Implementation

[0045] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of the invention. However, those skilled in the art will understand that the invention can be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods are omitted so as not to obscure the description of the invention with unnecessary detail.

[0046] To make the objectives, technical solutions, and advantages of the present invention clearer, specific embodiments will be described below in conjunction with the accompanying drawings.

[0047] See Figure 1 The diagram illustrates the implementation flowchart of the data encryption storage method for storage devices provided by an embodiment of the present invention.

[0048] like Figure 1 As shown, a data encryption storage method, applied to a storage device, includes:

[0049] S101, Receive a first message sent by the user equipment, which includes the data identifier of the target data and the user identifier.

[0050] Optionally, both the data identifier and the user identifier can be numbers, characters, or other symbols used to distinguish different objects.

[0051] For example, taking civil affairs data as an example, civil affairs data involves a wide variety of categories, including major independent categories such as elderly care, minimum living allowance, marriage, and funeral services, and each major independent category contains numerous subcategories. Data identifiers can be used to represent different types of civil affairs data, and user identifiers can represent civil affairs departments in different regions.

[0052] S102, determine the encryption type of the target data based on the data identifier and the user identifier, and send a second message including the encryption type determination result to the user equipment; the encryption type of the target data includes full encryption or selective encryption.

[0053] Optionally, the encryption type of the data can be determined based on the importance of the target data and the importance of the user's identity, and the encryption type can be sent to the user equipment in the form of a message.

[0054] For example, taking civil affairs data as an example, for citizens, civil affairs data can include name, gender, ethnicity, ID card number, marital status, family relationship, etc. Some data needs to be stored in encrypted form, such as ID card number and marital / family relationship information, while other data does not need to be stored in encrypted form, such as gender and name. In this case, the citizen's civil affairs data can be stored in an encrypted form. However, for the civil affairs department, the data obtained by the department from summarizing, analyzing, and predicting the civil affairs data of each citizen is very important. Once leaked, it will cause serious social impact. Therefore, all the data obtained by the civil affairs department needs to be stored in a fully encrypted form.

[0055] S103, when the encryption type of the target data is full encryption, receive a third message sent by the user equipment including the target data and the first confirmation information; generate a first key according to the first confirmation information, encrypt the target data according to the first key, and send a fourth message including the storage location information of the first key to the user equipment; wherein, the first confirmation information is used to indicate that the user equipment confirms that the encryption type of the target data is full encryption.

[0056] Optionally, after the user confirms that the encryption type is full encryption, a first confirmation message will be sent from the user device to the storage device. The storage device will then generate a first key based on the first confirmation message. The first key is used to encrypt the target data. The first key can be generated according to existing technology.

[0057] Optionally, after sending the fourth message including the first key storage location information to the user equipment, the local first key storage location information is deleted to ensure that only the user equipment stores the first key storage location information, that is, only through the user equipment can the target data be encrypted and stored or decrypted and transmitted.

[0058] S104, when the encryption type of the data is selective encryption, receive a fifth message sent by the user equipment including target data and second confirmation information; generate a second key based on the second confirmation information, perform selective encryption on the target data based on the second key, and send a sixth message including the storage location information of the second key to the user equipment; wherein, the second confirmation information is used to indicate that the user equipment confirms that the encryption type of the target data is selective encryption.

[0059] Optionally, after the user confirms that the encryption type is selected, a second confirmation message is sent from the user device to the storage device. The storage device then generates a second key based on the second confirmation message. This second key is used to encrypt the target data. The second key can be generated using existing technology.

[0060] Optionally, after sending the sixth message including the second key storage location information to the user equipment, the local second key storage location information is deleted to ensure that only the user equipment stores the second key storage location information, that is, only through the user equipment can the target data be encrypted and stored or decrypted and transmitted.

[0061] This invention improves data storage efficiency and data transmission efficiency by receiving a first message from a user equipment that includes a data identifier and a user identifier for target data; determining the encryption type of the target data based on the data identifier and the user identifier; sending a second message to the user equipment that includes the encryption type determination result; and encrypting the target data completely or selectively according to different encryption types.

[0062] In some embodiments of the present invention, before sending the fourth message including the first key storage location information to the user equipment, the method further includes:

[0063] The first key is divided into a preset number of key segments, and the preset number of key segments are stored in the corresponding preset number of key spaces; the storage location information of the first key is generated according to the index information of each key space.

[0064] Optionally, the first key can be generated using existing technology, divided into multiple key segments, and stored separately to improve the security of key storage and reduce the risk of the first key being directly obtained.

[0065] In some embodiments of the present invention, when the encryption type of the data is selected encryption, the target data includes public data and private data;

[0066] Accordingly, the target data is encrypted using the second key, including:

[0067] The second key is used to encrypt the privacy data, and the storage location information of the second key is generated based on the index information of the key space where the second key is stored.

[0068] Optionally, a second key can be generated using existing technology. The first and second keys can be the same or different. When partially encrypting data, the second key is used to encrypt private data, while public data is stored directly. This can improve the efficiency of data storage and reduce the encryption, decryption, and transmission time of data.

[0069] In some embodiments of the present invention, determining the encryption type of the target data based on the data identifier and the user identifier includes:

[0070] The data type is determined based on the data identifier; the data type includes plaintext data type or encrypted data type.

[0071] User level is determined based on user identifier;

[0072] When the user's level is not lower than the preset level, the encryption type of the target data is determined to be full encryption;

[0073] When the user's level is lower than the preset level and the data type is plaintext, the encryption type of the target data is determined to be selected encryption.

[0074] Optionally, user level has higher priority than data type. When a user level is not lower than a preset level, it indicates that the user is an important user and all data uploaded by the user needs to be fully encrypted.

[0075] In some embodiments of the present invention, determining the encryption type of data based on the data identifier and the user identifier may further include:

[0076] Determine the data level based on the data identifier;

[0077] User level is determined based on user identifier;

[0078] If the user level is not lower than the preset level, and / or the data level is not lower than the preset data level, then the encryption type of the target data is determined to be full encryption.

[0079] If the user level is lower than the preset level and the data level is lower than the preset data level, then the encryption type of the target data is determined to be selected encryption.

[0080] In some embodiments of the present invention, the method further includes:

[0081] After sending the fourth message to the user equipment, receive the first key confirmation message sent by the user equipment and record it;

[0082] After sending the sixth message to the user equipment, the receiving user equipment sends a second key confirmation message and records it.

[0083] Optionally, after receiving and recording the first key confirmation message sent by the user equipment, the local first key storage location information is deleted; after receiving and recording the second key confirmation message sent by the user equipment, the local second key storage location information is deleted, thereby improving the security of data storage.

[0084] See Figure 2 The diagram illustrates the implementation flowchart of the data encryption and storage method for user equipment provided in this embodiment of the invention.

[0085] like Figure 2 As shown, a data encryption and storage method, applied to a user equipment, includes:

[0086] S201, a first message including a data identifier and a user identifier of the target data is sent to the storage device; the first message is used to instruct the storage device to determine the encryption type of the target data based on the data identifier and the user identifier; the encryption type of the target data includes full encryption or selective encryption.

[0087] S202, Receive a second message sent by the storage device, including the encryption type determination result;

[0088] S203, when the encryption type of the target data is full encryption, a third message including the target data and the first confirmation information is sent to the storage device; a fourth message including the storage location information of the first key is received from the storage device; wherein, the third message is used to instruct the storage device to generate a first key according to the first confirmation information, and to perform full encryption on the target data according to the first key; the first confirmation information is used to indicate that the encryption type of the target data is confirmed to be full encryption;

[0089] S204, when the encryption type of the data is selective encryption, a fifth message including the target data and the second confirmation information is sent to the storage device; a sixth message including the storage location information of the second key is received from the storage device; wherein, the fifth message is used to instruct the storage device to generate a second key based on the second confirmation information, and to perform selective encryption on the target data based on the second key, and the second confirmation information is used to indicate that the encryption type of the target data is selected encryption.

[0090] Optionally, the first key storage location information and the second key storage location information are stored in the user equipment, while the storage device does not store this information, which can improve the security of data storage.

[0091] In some embodiments of the present invention, the method further includes:

[0092] After receiving the fourth message from the storage device, send a first key confirmation message to the storage device;

[0093] After receiving the sixth message from the storage device, a second key confirmation message is sent to the storage device.

[0094] See Figure 3 This illustrates a signaling interaction diagram of the data encryption and storage method provided in an embodiment of the present invention. Combined with... Figure 3 The process of encrypting and storing data is explained in detail below:

[0095] S301, The user equipment sends the first message to the storage device;

[0096] For example, the first message may include a data identifier and a user identifier for the target data.

[0097] S302, the storage device determines the encryption type of the target data based on the first message;

[0098] For example, the encryption type can include full encryption or selective encryption.

[0099] S303, The storage device sends a second message to the user equipment;

[0100] For example, the second message may include the encryption type determination result.

[0101] S3041, When the encryption type is full encryption, the user equipment sends a third message to the storage device;

[0102] For example, the third message may include target data and first confirmation information, the first confirmation information being used to indicate that the user equipment confirms that the encryption type of the target data is fully encrypted.

[0103] S3042, The storage device generates a first key based on the third message and encrypts the data;

[0104] For example, the storage device generates a first key based on the first confirmation information, and encrypts all target data based on the first key.

[0105] S3043, The storage device sends a fourth message to the user equipment;

[0106] For example, the fourth message may include the first key storage location information.

[0107] S3051, when the encryption type is selected encryption, the user equipment sends the fifth message to the storage device;

[0108] For example, the fifth message may include target data and second confirmation information, the second confirmation information being used to indicate that the user equipment confirms that the encryption type of the target data is selected encryption.

[0109] S3052, The storage device generates a second key based on the fifth message and encrypts the data;

[0110] For example, the storage device generates a second key based on the second confirmation information, and selects and encrypts the target data based on the second key.

[0111] S3053, the storage device sends the sixth message to the user equipment;

[0112] For example, the sixth message may include second key storage location information.

[0113] Corresponding to the above-described data encryption and storage method, this invention also provides two data encryption and storage devices that have the same beneficial effects as the data encryption and storage method.

[0114] See Figure 4 This illustrates a schematic diagram of the structure of a data encryption storage device applied to a storage device, provided by an embodiment of the present invention.

[0115] like Figure 4 As shown, a data encryption storage device 40 is applied to a storage device and includes a first receiving module 401, a first processing module 402, a second processing module 403 and a third processing module 404.

[0116] The first receiving module 401 is used to receive a first message sent by the user terminal user equipment, which includes a data identifier of the target data and a user identifier;

[0117] The first processing module 402 is used to determine the encryption type of the target data based on the data identifier and the user identifier, and send a second message including the encryption type determination result to the user terminal user equipment; the encryption type of the target data includes full encryption or partial selective encryption.

[0118] The second processing module 403 is configured to, when the encryption type of the target data is full encryption, receive a third message sent by the user terminal equipment, which includes the target data and first confirmation information and first encryption type confirmation result information; generate a first key based on the first encryption type confirmation result information and the first confirmation information; perform full encryption on the target data based on the first key; and send a fourth message including the storage location information of the first key to the user terminal equipment; wherein, the first confirmation information is used to indicate that the user terminal equipment confirms that the encryption type of the target data is full encryption;

[0119] The third processing module 404 is used to receive a fifth message sent by the user terminal equipment, which includes target data and second encryption type confirmation result information, when the encryption type of the data is partial selective encryption; generate a second key based on the second confirmation information in the fifth message; selectively encrypt the target data based on the second key; and send a sixth message including the storage location information of the second key to the user terminal equipment; wherein the second confirmation information is used to indicate that the user terminal equipment confirms that the encryption type of the target data is selective encryption.

[0120] In some embodiments of the present invention, the data encryption storage device 40 further includes a fourth processing module and a fifth processing module;

[0121] The fourth processing module is used to: divide the first key into a preset number of key segments and store the preset number of key segments in corresponding preset number of key spaces before sending a fourth message including the storage location information of the first key to the user terminal equipment; generate the storage location information of the first key according to the index information of each key space; when the encryption type of the data is partial selective encryption, the target data includes public data and private data.

[0122] The fifth processing module is used to encrypt the target data according to the second key, including: encrypting the privacy data using the second key, and generating the storage location information of the second key according to the index information of the key space where the second key is stored.

[0123] In some embodiments of the present invention, the first processing module 402 may include a first determining unit, a second determining unit, a first judging unit, and a second judging unit;

[0124] The first determining unit is used to determine the data type based on the data identifier; the data type includes plaintext data type or ciphertext data type.

[0125] The second determining unit is used to determine the user level based on the user identifier;

[0126] The first judgment unit is used to determine that the encryption type of the target data is full encryption when the user level is not lower than the preset level.

[0127] The second judgment unit is used to determine that the encryption type of the target data is partial selective encryption when the user level is lower than the preset level and the data type is plaintext data.

[0128] In some embodiments of the present invention, the first processing module 402 may further include a third determining unit, a fourth determining unit, a third judging unit, and a fourth judging unit;

[0129] The third determining unit is used to determine the data level based on the data identifier;

[0130] The fourth determining unit is used to determine the user level based on the user identifier;

[0131] The third judgment unit is used to determine that the encryption type of the target data is full encryption if the user level is not lower than the preset level and / or the data level is not lower than the preset data level.

[0132] The fourth judgment unit is used to determine that the encryption type of the target data is selected encryption if the user level is lower than the preset level and the data level is lower than the preset data level.

[0133] In some embodiments of the present invention, the data encryption storage device 40 further includes a second receiving module and a third receiving module;

[0134] The second receiving module is used to receive and record the first key confirmation message sent by the user equipment after sending the fourth message to the user equipment.

[0135] The third receiving module is used to receive and record the second key confirmation message sent by the user equipment after sending the sixth message to the user equipment.

[0136] See Figure 5 This illustrates a schematic diagram of the structure of a data encryption storage device for user equipment provided in an embodiment of the present invention.

[0137] like Figure 5 As shown, a data encryption storage device 50, applied to a user equipment, may include a first sending module 501, a fourth receiving module 502, a sixth processing module 503, and a seventh processing module 504.

[0138] The first sending module 501 is used to send a first message including a data identifier and a user identifier of the target data to the storage device; the first message is used to instruct the storage device to determine the encryption type of the target data based on the data identifier and the user identifier; the encryption type of the target data includes full encryption or selective encryption.

[0139] The fourth receiving module 502 is used to receive a second message sent by the storage device, which includes the encryption type determination result;

[0140] The sixth processing module 503 is used to send a third message including the target data and first confirmation information to the storage device when the encryption type of the target data is full encryption; and to receive a fourth message including the storage location information of the first key sent by the storage device; wherein the third message is used to instruct the storage device to generate a first key according to the first confirmation information, and to perform full encryption on the target data according to the first key; the first confirmation information is used to indicate that the encryption type of the target data is confirmed to be full encryption;

[0141] The seventh processing module 504 is used to send a fifth message including target data and second confirmation information to the storage device when the encryption type of the data is selective encryption; and to receive a sixth message including second key storage location information sent by the storage device; wherein the fifth message is used to instruct the storage device to generate a second key based on the second confirmation information, and to perform selective encryption on the target data based on the second key, and the second confirmation information is used to indicate that the encryption type of the target data is selected encryption.

[0142] In some embodiments of the present invention, the data encryption storage device 50 may further include a second sending module and a third sending module;

[0143] The second sending module is used to send a first key confirmation message to the storage device after receiving the fourth message sent by the storage device.

[0144] The third sending module is used to send a second key confirmation message to the storage device after receiving the sixth message sent by the storage device.

[0145] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0146] Figure 6 This is a schematic diagram of a storage device provided in an embodiment of the present invention. Figure 6 As shown, the storage device 60 in this embodiment includes: a first processor 600, a first memory 601, and a first computer program 602 stored in the first memory 601 and executable on the first processor 600. When the first processor 600 executes the first computer program 602, it implements the steps described in the various data encryption storage method embodiments applied to the storage device, for example... Figure 1 S101 to S104 are shown. Alternatively, when the first processor 600 executes the first computer program 602, it implements the functions of each module / unit in the above-described device embodiments, for example... Figure 4 The functions of modules / units 401 to 404 are shown.

[0147] For example, the first computer program 602 can be divided into one or more modules / units, and one or more modules / units are stored in the first memory 601 and executed by the first processor 600 to complete the present invention. The one or more modules / units can be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of the first computer program 602 in the storage device 50. For example, the first computer program 602 can be divided into... Figure 4 The modules / units shown are 401 to 404.

[0148] Storage device 60 can be a computing device such as a desktop computer, laptop, handheld computer, or cloud server. Storage device 60 may include, but is not limited to, a first processor 600 and a first memory 601. Those skilled in the art will understand that... Figure 6 This is merely an example of storage device 60 and does not constitute a limitation on storage device 60. It may include more or fewer components than shown, or combine certain components, or different components. For example, storage device may also include input / output devices, network access devices, buses, etc.

[0149] The first processor 600 may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.

[0150] The first memory 601 can be an internal storage unit of the user equipment 60, such as a hard disk or memory of the user equipment 60. The first memory 601 can also be an external storage device of the user equipment 60, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the user equipment 60. Furthermore, the first memory 601 can include both internal and external storage units of the user equipment 60. The first memory 601 is used to store computer programs and other programs and data required by the user equipment. The first memory 601 can also be used to temporarily store data that has been output or will be output.

[0151] Figure 7 This is a schematic diagram of a user equipment provided in an embodiment of the present invention. Figure 7 As shown, the user equipment 70 in this embodiment includes: a second processor 700, a second memory 701, and a second computer program 702 stored in the second memory 701 and executable on the second processor 700. When the second processor 700 executes the second computer program 702, it implements the steps described above in the embodiments of the data encryption storage method applied to the storage device, for example... Figure 2 S201 to S204 are shown. Alternatively, when the second processor 700 executes the second computer program 702, it implements the functions of each module / unit in the above-described device embodiments, for example... Figure 5 The functions of modules / units 501 to 504 are shown.

[0152] For example, the second computer program 702 can be divided into one or more modules / units, one or more of which are stored in the second memory 701 and executed by the second processor 700 to complete the present invention. The one or more modules / units can be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of the second computer program 702 in the user device 70. For example, the second computer program 702 can be divided into... Figure 5 The modules / units shown are 501 to 504.

[0153] User equipment 70 may be a computing device such as a desktop computer, laptop, handheld computer, or cloud server. User equipment 70 may include, but is not limited to, a second processor 700 and a second memory 701. Those skilled in the art will understand that... Figure 7 This is merely an example of user equipment 70 and does not constitute a limitation on user equipment 70. It may include more or fewer components than shown, or combine certain components, or different components. For example, user equipment may also include input / output devices, network access devices, buses, etc.

[0154] The second processor 700 may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.

[0155] The second memory 701 can be an internal storage unit of the user equipment 70, such as a hard disk or memory of the user equipment 70. The second memory 701 can also be an external storage device of the user equipment 70, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the user equipment 70. Furthermore, the second memory 701 can include both internal storage units and external storage devices of the user equipment 70. The second memory 701 is used to store computer programs and other programs and data required by the user equipment. The second memory 701 can also be used to temporarily store data that has been output or will be output.

[0156] This invention also provides a data encryption storage system, including a storage device 60 and a user device 70.

[0157] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0158] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0159] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0160] In the embodiments provided by this invention, it should be understood that the disclosed apparatus / device and method can be implemented in other ways. For example, the apparatus / device embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0161] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0162] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0163] If integrated modules / units are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various data encryption storage method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in the computer-readable medium can be appropriately added or removed according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, the computer-readable medium does not include electrical carrier signals and telecommunication signals.

[0164] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.

Claims

1. A method for encrypting and storing data, characterized in that, Used in storage devices, including: Receive a first message sent by the user equipment, which includes a data identifier for the target data and a user identifier; The encryption type of the target data is determined based on the data identifier and the user identifier, and a second message including the encryption type determination result is sent to the user equipment; the encryption type of the target data includes full encryption or selective encryption. When the encryption type of the target data is full encryption, a third message including the target data and first confirmation information is received from the user equipment; a first key is generated according to the first confirmation information; the target data is fully encrypted according to the first key; and a fourth message including the storage location information of the first key is sent to the user equipment; wherein, the first confirmation information is used to indicate that the user equipment confirms that the encryption type of the target data is full encryption; When the encryption type of the target data is selected encryption, a fifth message including the target data and second confirmation information is received from the user equipment; a second key is generated according to the second confirmation information; the target data is selected encryption according to the second key; and a sixth message including the storage location information of the second key is sent to the user equipment; wherein, the second confirmation information is used to indicate that the user equipment confirms that the encryption type of the target data is selected encryption; Before sending the fourth message including the first key storage location information to the user equipment, the method further includes: The first key is divided into a preset number of key segments, and the preset number of key segments are stored in corresponding preset number of key spaces; the first key storage location information is generated according to the index information of each key space; When the encryption type of the target data is selected encryption, the target data includes public data and private data; Accordingly, the step of selectively encrypting the target data according to the second key includes: The privacy data is encrypted using the second key, and the storage location information of the second key is generated based on the index information of the key space where the second key is stored.

2. The data encryption and storage method according to claim 1, characterized in that, Determining the encryption type of the target data based on the data identifier and the user identifier includes: The data type is determined based on the data identifier; the data type includes plaintext data type or ciphertext data type. The user level is determined based on the user identifier; When the user level is not lower than a preset level, the encryption type of the target data is determined to be full encryption; When the user level is lower than the preset level and the data type is plaintext, the encryption type of the target data is determined to be selective encryption.

3. The data encryption and storage method according to claim 1 or 2, characterized in that, The method further includes: After sending the fourth message to the user equipment, receive and record the first key confirmation message sent by the user equipment; After sending the sixth message to the user equipment, the system receives and records the second key confirmation message sent by the user equipment.

4. A method for encrypting and storing data, characterized in that, Applied to user equipment, including: A first message including a data identifier of target data and a user identifier is sent to a storage device; the first message is used to instruct the storage device to determine the encryption type of the target data based on the data identifier and the user identifier; the encryption type of the target data includes full encryption or selective encryption. Receive a second message sent by the storage device, including the encryption type determination result; When the encryption type of the target data is full encryption, a third message including the target data and first confirmation information is sent to the storage device; a fourth message including first key storage location information is received from the storage device; wherein, the third message is used to instruct the storage device to generate a first key based on the first confirmation information, and to fully encrypt the target data based on the first key; the first confirmation information is used to indicate that the encryption type of the target data is full encryption; the first key storage location information is generated by the index information of each key space; the key space is a space corresponding to a preset number of key segments; the key segments are divided based on the first key; When the encryption type of the target data is selected encryption, a fifth message including the target data and second confirmation information is sent to the storage device, the target data including public data and private data; a sixth message including second key storage location information is received from the storage device; wherein, the fifth message is used to instruct the storage device to generate a second key according to the second confirmation information, and to perform selected encryption on the target data according to the second key, the second confirmation information being used to indicate that the encryption type of the target data is selected encryption; The step of selectively encrypting the target data according to the second key includes: The privacy data is encrypted using the second key, and the storage location information of the second key is generated based on the index information of the key space where the second key is stored.

5. The data encryption and storage method according to claim 4, characterized in that, The method further includes: After receiving the fourth message sent by the storage device, a first key confirmation message is sent to the storage device; After receiving the sixth message sent by the storage device, a second key confirmation message is sent to the storage device.

6. A storage device, comprising a first memory, a first processor, and a first computer program stored in the first memory and executable on the first processor, characterized in that, When the first processor executes the first computer program, it implements the steps of the data encryption and storage method as described in any one of claims 1 to 3 above.

7. A user equipment, comprising a second memory, a second processor, and a second computer program stored in the second memory and executable on the second processor, characterized in that, When the second processor executes the second computer program, it implements the steps of the data encryption and storage method as described in claim 4 or 5 above.

8. A data encryption storage system, characterized in that, It includes the storage device as described in claim 6 and the user equipment as described in claim 7.

9. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the data encryption and storage method as described in any one of claims 1 to 3, or the steps of the data encryption and storage method as described in claim 4 or 5.

Images