Data encryption method, device, equipment and storage medium

Abstract

This application discloses a data encryption method, apparatus, device, and storage medium. The method comprises the following steps: acquiring an operating system's I / O data stream in real time and merging the I / O data streams; dividing the merged I / O data streams into multiple data segments; selecting a data segment to be encrypted from the multiple data segments, and encrypting the data segment to be encrypted. This application can streamline the encryption process, save encryption time, and improve encryption efficiency.

Description

Technical Field

[0001] The present application relates to the field of data encryption technology, and in particular to a data encryption method, apparatus, device and storage medium. Background Art

[0002] With the rapid development of informatization, people's demand for information security has followed one after another. Talent competition, market competition, financial crisis, enemy spy agencies, etc. have brought huge risks to the development of enterprises and institutions. Internal espionage, hacker attacks, unconscious leaks and other espionage methods have become security risks between people, between enterprises, and between countries.

[0003] Currently, full-disk encryption technology primarily encrypts the entire disk and employs other protective measures, such as host monitoring and firewalls, for comprehensive protection. Disk encryption primarily provides a secure operating environment for users. Data itself is not encrypted. Once the operating system boots, data exists in plaintext on the hard drive, primarily protected by firewalls and other methods. The main drawback of disk encryption is the long encryption cycle, resulting in extended project implementation cycles, which users generally find unacceptable. Disk encryption technology fully encrypts the disk, making data recovery a significant headache if operating system issues arise. Decrypting a typical 500GB hard drive takes 3-4 hours. Summary of the Invention

[0004] The present application provides a data encryption method, apparatus, device and storage medium, aiming to solve the technical problem of a long time period for overall encryption of a disk.

[0005] To achieve the above objectives, the present application provides a data encryption method, which includes the following steps:

[0006] Acquire the IO data stream of the operating system and merge the IO data stream;

[0007] Divide the merged IO data stream into multiple data segments;

[0008] A data segment to be encrypted is selected from the multiple data segments, and the data segment to be encrypted is encrypted.

[0009] Optionally, a data group in the IO data stream is selected, and a hash value corresponding to the data group is calculated;

[0010] Obtaining a data boundary of the IO data stream according to the hash value and a preset value;

[0011] The IO data stream is divided into a plurality of data segments according to the data boundaries.

[0012] Optionally, if the result of an AND operation of the hash value and a preset value is zero, setting a data boundary after the last data block in the data group;

[0013] If the result of the AND operation between the hash value and the preset value is one, the data group is shifted backward by one position along the IO data stream, and the step of calculating the hash value corresponding to the data group and subsequent steps are repeated.

[0014] Optionally, obtaining the number of data blocks in the IO data stream, and converting the number of data blocks into a hexadecimal value;

[0015] Obtaining a hash value length of the hash value, and calculating a first remainder between the hexadecimal value and the hash value length;

[0016] Shift the preset hexadecimal initial value to the left by the first remainder digit to obtain the preset value.

[0017] Optionally, converting the IO data stream into a combination matrix according to data boundaries of the IO data stream;

[0018] The data segment to be encrypted is selected according to the combination matrix and the number of the data boundaries.

[0019] Optionally, an irrational number is randomly selected from a preset irrational array;

[0020] Multiplying the irrational number by the combined matrix to obtain a second matrix, and summing all internal values ​​of the second matrix to obtain a first sum value;

[0021] Obtaining a maximum prime value smaller than the number of data boundaries;

[0022] A second remainder of the first sum and the maximum prime value is calculated, and a data segment after a data boundary of the second remainder is selected as a data segment to be encrypted.

[0023] Optionally, generating a public key and a private key encryption pair according to a preset encryption algorithm, and recording the address of the data block in the data segment to be encrypted and the public key information in the bitmap information;

[0024] Encrypting the data block in the data segment to be encrypted using the public key to obtain a ciphertext corresponding to the data block, and storing the ciphertext in the data block;

[0025] The bitmap information is updated according to the updated data block.

[0026] To achieve the above-mentioned purpose, the present application also proposes a data encryption device based on data truncation, which includes a data capture module, a data segmentation module and a data encryption module; the data capture module is used to obtain the IO data stream of the operating system and merge the IO data stream; the data segmentation module is used to divide the merged IO data stream into multiple data segments; the data encryption module is used to select a data segment to be encrypted from the multiple data segments and encrypt the data segment to be encrypted.

[0027] To achieve the above-mentioned purpose, the present application also proposes a data encryption device based on data truncation, which includes a memory, a processor, and a data encryption program based on data truncation stored in the memory and executable on the processor. When the data encryption program based on data truncation is executed by the processor, the data encryption method is implemented.

[0028] To achieve the above-mentioned purpose, the present application further proposes a storage medium, on which a data encryption program based on data truncation is stored. When the data encryption program based on data truncation is executed by a processor, the data encryption method is implemented.

[0029] In this application, the operating system's IO data streams are acquired in real time and merged; the merged IO data streams are divided into multiple data segments; a data segment to be encrypted is selected from the multiple data segments, and the data segment to be encrypted is encrypted. Compared with the prior art, this application encrypts only the selected data segment to be encrypted, shifting the target of data encryption and decryption from the entire disk to the data segment to be encrypted in the file, and performing pseudo-random encryption on the data segment to be encrypted. This not only enhances the protection of critical data, but also streamlines the encryption and decryption process, saving encryption and decryption time. Therefore, the encryption method in this application is superior to conventional full-disk data encryption or file data header encryption. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the structures shown in these drawings without paying any creative work.

[0031] Figure 1 This is a schematic diagram of the module structure of a data encryption method according to an embodiment of the present application;

[0032] Figure 2 This is a flow chart of a data encryption method according to an embodiment of the present application;

[0033] Figure 3 This is a module structure diagram of a data encryption method according to an embodiment of the present application;

[0034] Figure 4 This is an example diagram of a data encryption method according to an embodiment of the present application;

[0035] Figure 5 This is an example diagram of a data encryption method according to an embodiment of the present application. DETAILED DESCRIPTION

[0036] It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application.

[0037] Please refer to Figure 1 , Figure 1 This is a hardware structure diagram of the data encryption device based on data truncation provided in various embodiments of this application. The data encryption device based on data truncation includes components such as execution module 01, memory 02, processor 03, and battery system. It can be understood by those skilled in the art that Figure 1 The device shown in the figure may also include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently. The processor 03 is connected to the memory 02 and the execution module 01 respectively. The memory 02 stores a data encryption program based on data truncation, and the data encryption program based on data truncation is simultaneously executed by the processor 03.

[0038] The execution module 01 can capture the IO data stream of the operating system and merge the IO data stream; divide the merged IO data stream into multiple data segments; select the data segment to be encrypted from the multiple data segments, encrypt the data segment to be encrypted, and feed back the above information to the processor 03.

[0039] Memory 02 can be used to store software programs and various data. Memory 02 may primarily include a program storage area and a data storage area. The program storage area can store the operating system and application programs required for various functions, while the data storage area can store data or information generated based on the use of the IoT terminal. Memory 02 may also include high-speed random access memory and non-volatile memory, such as multiple disk storage devices, flash memory devices, or other volatile solid-state storage devices.

[0040] Processor 03 is the control center of the processing platform. It connects all components of the IoT terminal using various interfaces and circuits. By running or executing software programs and / or modules stored in memory 02 and accessing data stored in memory 02, it performs various IoT terminal functions and processes data, thereby providing comprehensive monitoring of the data encryption device based on data truncation. Processor 03 may include one or more processing units; preferably, processor 03 may integrate an application processor and a modem processor. The application processor primarily processes the operating system, user interface, and application programs, while the modem processor primarily handles wireless communications. It is understood that the modem processor may not be integrated into processor 03.

[0041] Those skilled in the art will understand that Figure 1 The data encryption device structure based on data truncation shown in the figure does not constitute a limitation to the device, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0042] Based on the above hardware structure, various embodiments of the method of this application are proposed.

[0043] With the rapid development of informatization, people's demand for information security has followed one after another. Talent competition, market competition, financial crisis, enemy spy agencies, etc. have brought huge risks to the development of enterprises and institutions. Internal espionage, hacker attacks, unconscious leaks and other espionage methods have become security risks between people, between enterprises, and between countries.

[0044] Currently, full-disk encryption technology primarily encrypts the entire disk and employs other protective measures, such as host monitoring and firewalls, for comprehensive protection. Disk encryption primarily provides users with a secure operating environment. The data itself is not encrypted. Once the operating system is booted, the data exists in plain text on the hard drive, primarily protected by firewalls and other methods. The main drawback of disk encryption technology is the long time required to encrypt the disk, resulting in a longer project implementation cycle, which users generally cannot tolerate. Disk encryption technology fully encrypts the disk, and if the operating system encounters a problem, data recovery is a headache for users. Decrypting a 500GB hard drive typically takes 3-4 hours. Furthermore, disk encryption technology provides security control over all disk information, including system files.

[0045] As mentioned above, full disk encryption technology and disk encryption technology are used to securely manage the information on the entire disk, including system files, but they will greatly affect the efficiency and performance of the system.

[0046] In order to solve the above problems, this application proposes a data encryption method, referring to Figure 2 In the first embodiment of the data encryption method of the present application, the data encryption method includes:

[0047] Step S100, obtaining the IO data stream of the operating system and merging the IO data stream;

[0048] Currently, in addition to full-disk encryption, which encrypts the entire disk, there is also file encryption. File encryption typically involves encrypting the entirety or partial contents of important files on a disk, such as the header or tail. Specifically, file encryption uses encryption algorithms and various encryption techniques to encrypt documents on a network or computer to prevent unauthorized leakage. Encryption technology uses mathematical or physical means to protect electronic information during transmission or within storage devices to prevent data leakage. However, this partial encryption method is often predictable, and it is possible that files may be forgotten to be encrypted after they are generated.

[0049] To address this situation, this application adopts the idea of ​​partial data encryption to propose a streamlined encryption method, which lowers the data encryption and decryption to the process of IO data stream and performs pseudo-random encryption, greatly increasing the protection of key data and is better than full disk encryption or file data header encryption.

[0050] In this embodiment, the IO data stream is captured between the operating system and the storage, and then the IO data stream is subjected to data reduction and encryption. Specifically, an IO filter located between the client operating system and the virtual disk can be created, and the IO data stream between the operating system and the virtual disk can be obtained in real time through the IO filter. The IO data streams obtained within a certain period of time are merged according to a fixed IO data stream size, and the merged IO data stream includes multiple data blocks arranged in sequence. The fixed IO data stream size can be 128kb or 256kb. Furthermore, a stream represents the unstructured transmission of data, and an IO data stream refers to a stream used for input and output operations, that is, data is input or output in a stream manner.

[0051] Step S200, dividing the merged IO data stream into multiple data segments;

[0052] In this embodiment, rather than encrypting all captured IO data streams, the IO data streams are segmented into multiple data segments of varying sizes, from which data segments are selected for encryption. Specifically, since the merged IO data stream includes multiple sequentially arranged data blocks, before segmenting these blocks, it is necessary to first find the data boundaries of the IO data stream, segment the IO data stream based on the data boundaries, and then select one or more data segments from these data segments for encryption.

[0053] By dividing the IO data stream into multiple data segments based on data boundaries and encrypting selected data segments, this method eliminates the need to encrypt the entire disk and only selects a portion of the data for encryption, speeding up encryption and decryption and increasing encryption efficiency.

[0054] Step S300: selecting a data segment to be encrypted from the multiple data segments, and encrypting the data segment to be encrypted.

[0055] In this embodiment, after all boundaries in the IO data stream are identified, the IO data stream is divided into multiple data segments based on these boundaries. However, rather than encrypting all of these data segments, a data segment to be encrypted is selected from these multiple data segments and only the data segment to be encrypted is encrypted. Specifically, selecting a data segment to be encrypted involves selecting the data boundaries of the IO data stream, that is, selecting between which two data boundaries the data segment to be encrypted falls. Once the data boundaries of the data segment to be encrypted are selected, the data segment to be encrypted is obtained, and encryption of the data segment to be encrypted is then performed.

[0056] Compared with the existing technology, the present application encrypts only the selected data segments to be encrypted, and reduces the object of data encryption and decryption from the entire disk to the data segments to be encrypted in the file, and performs pseudo-random encryption on the data segments to be encrypted, thereby enhancing the protection of key data, streamlining the encryption and decryption process, and saving the time of encryption and decryption. Therefore, the encryption method in the present application is better than conventional full-disk data encryption or file data header encryption.

[0057] In one embodiment, the step of dividing the merged IO data stream into a plurality of data segments includes:

[0058] Selecting a data group in the IO data stream and calculating a hash value corresponding to the data group;

[0059] Obtaining a data boundary of the IO data stream according to the hash value and a preset value;

[0060] The IO data stream is divided into a plurality of data segments according to the data boundaries.

[0061] In this embodiment, the step of dividing an IO data stream into multiple data segments involves sequentially selecting data groups from the IO data stream, calculating hash values ​​corresponding to these data groups, and then determining data boundaries of the IO data stream based on the hash values ​​and a preset value. The IO data stream is then divided into multiple data segments based on the data boundaries. Specifically, the IO data stream is composed of multiple sequentially arranged data blocks. Therefore, the process of selecting a data group from the IO data stream is the process of selecting a preset number of data blocks from the IO data stream to form a data group, and calculating hash values ​​corresponding to these data blocks. After calculating the hash values ​​corresponding to the data groups, the calculated hash values ​​are ANDed with the preset value, and the data boundaries of the IO data stream are set based on the result of the AND operation. Specifically, if the result of the AND operation is 1, no data boundary is set. If the result of the AND operation is 0, the data boundary between the data group and the next data group is set as the data boundary of the IO data stream. That is, the data boundary between the last data block in the data group and the next data block is set as the data boundary of the IO data stream. After all data boundaries are selected in this way, the IO data stream is divided into multiple data segments based on the data boundaries, and one or more data segments are selected for encryption. Among them, the preset values ​​are set in advance by those skilled in the art according to preset rules and can be adjusted according to actual needs.

[0062] In one embodiment, the step of obtaining the data boundary of the IO data stream according to the hash value and a preset value includes:

[0063] If the result of the AND operation of the hash value and the preset value is zero, setting a data boundary after the last data block in the data group;

[0064] If the result of the AND operation between the hash value and the preset value is one, the data group is shifted backward by one position along the IO data stream, and the step of calculating the hash value corresponding to the data group and subsequent steps are repeated.

[0065] In this embodiment, since the merged IO data stream includes multiple data blocks arranged in sequence, a preset number of data blocks can be first selected from the IO data stream to form a data group, and the hash value corresponding to the data group is calculated. The preset number is set in advance by those skilled in the art according to preset rules and can be adjusted in real time according to actual conditions. The preset number can be 3, 4 or 5.

[0066] After obtaining the hash value corresponding to the data group, perform an AND operation on the hash value and the preset value, and determine whether to set the data boundary based on the result of the AND operation. If the result of the AND operation is zero, it is determined to set the data boundary, set the data boundary after the last data block in the data group, and move the preset number of data blocks backward along the IO data stream to select the preset number of data blocks again as the next data group, and calculate the hash value corresponding to the data group selected this time to determine whether to set the data boundary again; if the result of the AND operation is 1, the data boundary is not set, and the data group is moved back one data block along the IO data stream to select the preset number of blocks to generate a new data group, and recalculate the hash value corresponding to the preset number of data blocks in the data group selected this time. Calculate in this way until the hash values ​​corresponding to all data blocks in the IO data stream are calculated, and all data boundaries in the IO data stream can be found.

[0067] For example, the preset number is 3, and an IO data stream includes data block 1, data block 2, data block 3, ... data block 10; first, data block 1, data block 2, and data block 3 are selected from the IO data stream to form the first data group, then the hash values ​​corresponding to data block 1, data block 2, and data block 3 in the data group are calculated, and the hash value and the preset value are ANDed. Based on the result of the AND operation, it is determined whether to set a data boundary; if the result of the AND operation is 0, it is determined that a data boundary is set, and the area between data block 3 and data block 4 is set as the data boundary of the IO data stream. The data is then shifted backward 3 bits along the IO data stream, and data blocks 4, data block 5, and data block 6 are again selected from the IO data stream as a new data group. If the result of the AND operation is 1, it is determined that no data boundary is set, and a new data group is selected by shifting 1 bit along the IO data stream, that is, data block 2, data block 3, and data block 4 are selected from the IO data stream as a new data group, and the hash values ​​corresponding to data block 2, data block 3, and data block 4 are calculated and ANDed. By calculating in this way until the hash values ​​corresponding to all data blocks in the IO data stream are calculated, all data boundaries in the IO data stream can be found.

[0068] In one embodiment, before the step of obtaining the data boundary of the IO data stream according to the hash value and the preset value, the following steps are included:

[0069] Obtain the number of data blocks in the IO data stream, and convert the number of data blocks into a hexadecimal value;

[0070] Obtaining a hash value length of the hash value, and calculating a first remainder between the hexadecimal value and the hash value length;

[0071] Shift the preset hexadecimal initial value to the left by the first remainder digit to obtain the preset value.

[0072] In this embodiment, the preset value is calculated as follows: first, the number k of data blocks in the IO data stream is obtained, and the number k is converted from decimal to hexadecimal. The converted hexadecimal value is 0xk. Then, the hash value length of the hash value corresponding to the data group is obtained, and the first remainder of the hexadecimal value and the hash value length is calculated. Finally, the preset hexadecimal initial value is shifted left by the first remainder digit to obtain the preset value. Since the hash algorithm used in this application is the same hash algorithm, and the hash value length is determined only by the hash algorithm, the hash value length under the same algorithm is the same. Therefore, the hash value length corresponding to all data groups in this embodiment is the same. Among them, the hexadecimal initial value can be 0x1.

[0073] In one embodiment, the hexadecimal initial value may be 0x1, the number of data blocks in the captured IO data stream is 13, and the hexadecimal value obtained by converting 13 into hexadecimal is 0xd. The hash algorithm in this embodiment is sha256, and the hash value obtained by the sha256 algorithm has a hash value length of 64, that is, 0x40. The first remainder of the hexadecimal value 0xk and the hash value length 0x40 is calculated, and the first remainder obtained by calculating 0xd%0x40 is 0xd, and then 0x1 is shifted left by 0xd bits to obtain the preset position N of 0x10000000000000.

[0074] In one embodiment, the step of selecting a data segment to be encrypted from the plurality of data segments includes:

[0075] Converting the IO data stream into a combination matrix according to the data boundary of the IO data stream;

[0076] The data segment to be encrypted is selected according to the combination matrix and the number of the data boundaries.

[0077] As can be seen from the above, the captured IO data stream is divided into multiple data segments based on data boundaries. In this embodiment, one data segment is selected from these data segments as the data segment to be encrypted. Specifically, the IO data stream is first converted into a combination matrix based on the data boundaries of the IO data stream, and the data segment to be encrypted is selected based on the combination matrix and the number of data boundaries. Specifically, the conversion method is: the data groups in different data segments are sequentially arranged in different rows of the combination matrix. Furthermore, after obtaining the combination matrix, the data group to be encrypted is selected based on the combination matrix and the number of data boundaries.

[0078] In one embodiment, the step of selecting the data segment to be encrypted based on the combination matrix and the number of data boundaries includes:

[0079] Randomly select an irrational number from the preset irrational array;

[0080] Multiplying the irrational number by the combined matrix to obtain a second matrix, and summing all internal values ​​of the second matrix to obtain a first sum value;

[0081] Obtaining a maximum prime value smaller than the number of data boundaries;

[0082] A second remainder of the first sum and the maximum prime value is calculated, and a data segment after a data boundary of the second remainder is selected as a data segment to be encrypted.

[0083] In this embodiment, the steps for selecting a data segment to be encrypted based on the combination matrix and the number of data boundaries are as follows: first, randomly selecting an irrational number from a preset irrational array; multiplying the selected irrational number by the combination matrix to obtain a second matrix, summing all internal values ​​in the second matrix to obtain a first sum, and obtaining the maximum prime value less than the number of data boundaries; then calculating the second remainder between the first sum and the maximum prime value, and selecting the data segment after the second remainder of the data boundaries as the data segment to be encrypted. The preset irrational array is a randomly selected fragment of irrational numbers.

[0084] In one embodiment, the combination matrix is The default irrational array is a randomly selected irrational number segment The irrational number selected from the irrational array is e, then the process of multiplying the selected irrational number with the combination matrix to obtain the second matrix is ​​to multiply the combination matrix Multiply by the selected irrational number e to get the second matrix The calculation process of summing all internal values ​​in the second matrix is:

[0085] X=hash1*e+hash2*e+hash3*e+hash4*e+hash5*e+hash6*e+hash7*e

[0086] Where X is the first sum value obtained by summing the internal values ​​in the second matrix. After obtaining the first sum value, the maximum prime value Y less than the number of data boundaries is obtained. In this embodiment, the number of data boundaries is 3, so the maximum prime value less than the data boundaries is Y = 2. The second remainder of the first sum value and the maximum prime value is M = X%Y. The data segment between data boundary M and data boundary M+1 is then set as the data segment to be encrypted.

[0087] In one embodiment, the step of encrypting the data segment to be encrypted includes:

[0088] Generate a public key and a private key encryption pair according to a preset encryption algorithm, and record the address of the data block in the data segment to be encrypted and the public key information in the bitmap information;

[0089] Encrypting the data block in the data segment to be encrypted using the public key to obtain a ciphertext corresponding to the data block, and storing the ciphertext in the data block;

[0090] The bitmap information is updated according to the updated data block.

[0091] In this embodiment, after selecting and obtaining the data segment to be encrypted, the data segment to be encrypted needs to be encrypted. The specific encryption steps are: generating a public key and private key encryption pair according to a preset encryption algorithm, recording the address and public key information of the data block in the data segment to be encrypted in bitmap information; encrypting the data block in the data segment to be encrypted using the public key to obtain the ciphertext corresponding to the data block in the data segment to be encrypted, and storing the ciphertext in the data block of the data segment to be encrypted; and updating the bitmap information based on the updated data block. The preset encryption algorithm is set in advance by a person skilled in the art according to preset rules. The preset encryption algorithm can be the RSA encryption algorithm or the DES (Data Encryption Standard) encryption algorithm.

[0092] Specifically, if Figure 4 and Figure 5 As shown, in one embodiment, the data segment to be encrypted is (A03, B02, C03, E51, J03), and all data blocks in the IO data stream to be encrypted are encrypted in sequence. The encryption process for data block A03 is as follows: According to user instructions, the public key file location specified by the user is obtained, or a public key server is called to generate a public key and private key encryption pair, and then the address and public key information of data block A03 are recorded in the bitmap information. The public key is then used to encrypt data block A03, i.e., A03 + public key = A03m, and the ciphertext A03m is stored in data block A03. Finally, the data address pointer A03m' of A03m is updated and written to the bitmap information, completing the update of the bitmap information. All data in the data segment to be encrypted are updated according to the above method.

[0093] After encrypting the data segment to be encrypted, if the encrypted data segment needs to be decrypted, the encrypted data block is decrypted using the private key. Specifically, in one embodiment, when a user reads data and encounters an encrypted data block A03m, the user needs to read the A03 data block and decrypt the data A03 based on the read content. Specifically, the user can query the bitmap information to obtain the address pointer A03m' corresponding to the ciphertext data of the A03 data block. The ciphertext location A03m is then located using the pointer. The bitmap information is then used to obtain the private key required for decryption, which is paired with the public key of A03m. Thus, A03m and the private key can be combined to decrypt the A03m encrypted data. After decryption, the decrypted plaintext data is returned to the user.

[0094] Furthermore, after decrypting the encrypted data block, the bitmap information needs to be persistently saved to prevent loss of the bitmap information. This persistent saving can be scheduled, saved every second as needed, or saved every time the bitmap is updated, thus preventing data loss.

[0095] like Figure 3 As shown, the present application also proposes a data encryption device based on data truncation, the data encryption device based on data truncation comprising:

[0096] The data capture module A10 acquires the IO data stream of the operating system and merges the IO data stream;

[0097] The data segmentation module A20 segments the merged IO data stream into multiple data segments;

[0098] The data encryption module A30 selects a data segment to be encrypted from the multiple data segments and encrypts the data segment to be encrypted.

[0099] Optionally, the data segmentation module A20 is used to:

[0100] Selecting a data group in the IO data stream and calculating a hash value corresponding to the data group;

[0101] Obtaining a data boundary of the IO data stream according to the hash value and a preset value;

[0102] The IO data stream is divided into a plurality of data segments according to the data boundaries.

[0103] Optionally, the data segmentation module A20 is further configured to:

[0104] If the result of the AND operation of the hash value and the preset value is zero, setting a data boundary after the last data block in the data group;

[0105] If the result of the AND operation between the hash value and the preset value is one, the data group is shifted backward by one position along the IO data stream, and the step of calculating the hash value corresponding to the data group and subsequent steps are repeated.

[0106] Optionally, obtaining the number of data blocks in the IO data stream, and converting the number of data blocks into a hexadecimal value;

[0107] Obtaining a hash value length of the hash value, and calculating a first remainder between the hexadecimal value and the hash value length;

[0108] Shift the preset hexadecimal initial value to the left by the first remainder digit to obtain the preset value.

[0109] Optionally, the data encryption module A30 is used to:

[0110] Converting the IO data stream into a combination matrix according to the data boundary of the IO data stream;

[0111] The data segment to be encrypted is selected according to the combination matrix and the number of the data boundaries.

[0112] Optionally, the data encryption module A30 is further configured to:

[0113] Randomly select an irrational number from the preset irrational array;

[0114] Multiplying the irrational number by the combined matrix to obtain a second matrix, and summing all internal values ​​of the second matrix to obtain a first sum value;

[0115] Obtaining a maximum prime value smaller than the number of data boundaries;

[0116] A second remainder of the first sum and the maximum prime value is calculated, and a data segment after a data boundary of the second remainder is selected as a data segment to be encrypted.

[0117] Optionally, the data encryption module A30 is further configured to:

[0118] Generate a public key and a private key encryption pair according to a preset encryption algorithm, and record the address of the data block in the data segment to be encrypted and the public key information in the bitmap information;

[0119] Encrypting the data block in the data segment to be encrypted using the public key to obtain a ciphertext corresponding to the data block, and storing the ciphertext in the data block;

[0120] The bitmap information is updated according to the updated data block.

[0121] The present application also proposes a data encryption device based on data truncation, which includes a memory, a processor, and a data encryption program based on data truncation stored in the memory and executable on the processor. The data encryption program based on data truncation is used to execute the methods described in various embodiments of the present application.

[0122] The present application also proposes a storage medium on which a data encryption program based on data truncation is stored. The storage medium includes a computer-readable storage medium, which can be Figure 1The memory may also be at least one of a ROM (Read-Only Memory) / RAM (Random Access Memory), a magnetic disk, and an optical disk. The storage medium includes a number of instructions for enabling an IoT terminal device with a processor (which may be a mobile phone, a computer, a server, an IoT terminal, or a network device, etc.) to execute the methods described in the various embodiments of the present application.

[0123] In this application, the terms "first", "second", "third", "fourth" and "fifth" are used for descriptive purposes only and are not to be understood as indicating or implying relative importance. For ordinary technicians in this field, the specific meanings of the above terms in this application can be understood according to the specific circumstances.

[0124] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in multiple embodiments or examples of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine different embodiments or examples described in this specification and features of different embodiments or examples without contradiction.

[0125] Although the embodiments of the present application have been shown and described above, the scope of protection of the present application is not limited thereto. It is understood that the above embodiments are exemplary and should not be construed as limiting the present application. A person of ordinary skill in the art may make changes, modifications, and substitutions to the above embodiments within the scope of the present application, and such changes, modifications, and substitutions shall be included within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be subject to the scope of protection of the claims.

Claims

1. A data encryption method, characterized in that: The method comprises the following steps: Acquire the IO data stream of the operating system and merge the IO data stream; Divide the merged IO data stream into multiple data segments; Selecting a data segment to be encrypted from the multiple data segments, and encrypting the data segment to be encrypted; The step of selecting a data segment to be encrypted from the plurality of data segments includes: Converting the IO data stream into a combination matrix according to the data boundary of the IO data stream; Randomly selecting an irrational number from a preset irrational array and multiplying the resultant matrix by the combined matrix to obtain a second matrix, and summing all internal values ​​of the second matrix to obtain a first sum value; Obtain a maximum prime value smaller than the number of the data boundaries, calculate a second remainder of the first sum and the maximum prime value, and select a data segment after the second remainder data boundary as a data segment to be encrypted.

2. The data encryption method according to claim 1, wherein: The step of dividing the merged IO data stream into multiple data segments includes: Selecting a data group in the IO data stream and calculating a hash value corresponding to the data group; Obtaining a data boundary of the IO data stream according to the hash value and a preset value; The IO data stream is divided into a plurality of data segments according to the data boundaries.

3. The data encryption method as claimed in claim 2, wherein: The step of obtaining the data boundary of the IO data stream according to the hash value and the preset value includes: If the result of the AND operation of the hash value and the preset value is zero, setting a data boundary after the last data block in the data group; If the result of the AND operation between the hash value and the preset value is one, the data group is shifted backward by one position along the IO data stream, and the step of calculating the hash value corresponding to the data group and subsequent steps are repeated.

4. The data encryption method according to claim 2, wherein: Before the step of obtaining the data boundary of the IO data stream according to the hash value and the preset value, the method includes: Obtain the number of data blocks in the IO data stream, and convert the number of data blocks into a hexadecimal value; Obtaining a hash value length of the hash value, and calculating a first remainder between the hexadecimal value and the hash value length; Shift the preset hexadecimal initial value to the left by the first remainder digit to obtain the preset value.

5. The data encryption method according to claim 1, wherein: The step of encrypting the data segment to be encrypted comprises: Generate a public key and a private key encryption pair according to a preset encryption algorithm, and record the address of the data block in the data segment to be encrypted and the public key information in the bitmap information; Encrypting the data block in the data segment to be encrypted using the public key to obtain a ciphertext corresponding to the data block, and storing the ciphertext in the data block; The bitmap information is updated according to the updated data block.

6. A data encryption device based on data truncation, characterized in that: The data encryption device based on data truncation includes: A data capture module is used to obtain the IO data stream of the operating system and merge the IO data stream; The data segmentation module divides the merged IO data stream into multiple data segments; A data encryption module selects a data segment to be encrypted from the multiple data segments and encrypts the data segment to be encrypted; wherein, selecting the data segment to be encrypted from the multiple data segments includes: converting the IO data stream into a combination matrix according to the data boundary of the IO data stream; randomly selecting an irrational number from a preset irrational array and multiplying it with the combination matrix to obtain a second matrix, summing all internal values ​​in the second matrix to obtain a first sum value; obtaining a maximum prime value that is less than the number of data boundaries, calculating a second remainder between the first sum value and the maximum prime value, and selecting the data segment after the second remainder data boundary as the data segment to be encrypted.

7. A data encryption device based on data truncation, characterized in that: The invention comprises a memory, a processor, and a data encryption program based on data truncation stored in the memory and executable on the processor, wherein the data encryption program based on data truncation, when executed by the processor, implements the steps of the data encryption method according to any one of claims 1 to 5.

8. A storage medium, characterized in that: The storage medium stores a data encryption program based on data truncation, and when the data encryption program based on data truncation is executed by the processor, the steps of the data encryption method according to any one of claims 1 to 5 are implemented.

Images