Data encryption method and device, electronic equipment and storage medium

Abstract

This disclosure provides a data encryption method, apparatus, electronic device, and storage medium. One specific embodiment of the method includes: acquiring a byte stream to be encrypted; determining an encryption information generation rule corresponding to the byte stream to be encrypted; generating encryption information corresponding to the byte stream to be encrypted according to the encryption information generation rule; and concatenating the encryption information at a preset concatenation position in the byte stream to be encrypted to form an encrypted byte stream. This embodiment can avoid potential security vulnerabilities and does not damage the byte stream itself.

Description

Technical Field

[0001] The embodiments disclosed herein relate to the field of network security technology, specifically to data encryption methods, apparatus, electronic devices, and storage media. Background Technology

[0002] Currently, to ensure data security, a fixed encryption method is generally used to encrypt the entire byte stream.

[0003] However, this method of encrypting the entire byte stream can lead to hash collisions. When a hash collision occurs, the byte stream can still be decrypted using an incorrect decryption method and key, thus corrupting the original byte stream. Furthermore, encrypting in a fixed manner may pose a security risk of the encryption method being cracked. Summary of the Invention

[0004] Embodiments of this disclosure provide data encryption methods, apparatus, electronic devices, and storage media.

[0005] In a first aspect, embodiments of this disclosure provide a data encryption method, the method comprising: acquiring a byte stream to be encrypted; determining an encryption information generation rule corresponding to the byte stream to be encrypted; generating encryption information corresponding to the byte stream to be encrypted according to the encryption information generation rule; and concatenating the encryption information at a preset concatenation position in the byte stream to be encrypted to form an encrypted byte stream.

[0006] In some alternative implementations, the byte stream to be encrypted is a byte stream decoded from a Base64 encoded byte stream.

[0007] In some optional implementations, obtaining the byte stream to be encrypted includes: responding to receiving a file upload request, the file upload request including a first byte stream obtained by Base64 encoding the file to be uploaded, and Base64 decoding the first byte stream to obtain the byte stream to be encrypted.

[0008] In some optional implementations, the encryption information generation rule includes: a rule for determining the data to be encrypted and an encryption algorithm identifier; and the step of generating encryption information corresponding to the byte stream to be encrypted according to the encryption information generation rule includes: determining the data to be encrypted corresponding to the byte stream to be encrypted according to the rule for determining the data to be encrypted; encrypting the data to be encrypted using the encryption algorithm indicated by the encryption algorithm identifier to obtain encrypted data corresponding to the byte stream to be encrypted; and generating encryption information corresponding to the byte stream to be encrypted based on the encryption information generation rule corresponding to the byte stream to be encrypted and the encrypted data.

[0009] In some optional implementations, the encryption information generation rule further includes: byte stream related information generation rule; and before generating encryption information corresponding to the byte stream to be encrypted based on the encryption information generation rule corresponding to the byte stream to be encrypted and the encrypted data, the method further includes: generating related information corresponding to the byte stream to be encrypted according to the byte stream related information generation rule; and generating encryption information corresponding to the byte stream to be encrypted based on the encryption information generation rule corresponding to the byte stream to be encrypted and the encrypted data includes: generating encryption information corresponding to the byte stream to be encrypted based on the encryption information generation rule corresponding to the byte stream to be encrypted, the encrypted data, and related information.

[0010] In some alternative implementations, the file to be uploaded is an unstructured file.

[0011] In some alternative implementations, the method further includes storing the encrypted byte stream.

[0012] In some optional implementations, storing the encrypted byte stream includes: determining whether the data size of the encrypted byte stream is greater than a preset data size threshold; in response to determining no, storing the encrypted byte stream in a preset distributed non-relational database; and in response to determining yes, storing the encrypted byte stream in a preset distributed file system.

[0013] In some optional implementations, the preset distributed file system is the Hadoop Distributed File System (HDFS), and the preset distributed non-relational database is the Hadoop database HBase.

[0014] In some optional implementations, the method further includes: in response to receiving a file read request, obtaining a target encrypted byte stream corresponding to the file read request; obtaining target encryption information corresponding to the target encrypted byte stream based on the preset concatenation position; decrypting the target encrypted byte stream according to the target encryption information to obtain a decrypted byte stream; generating a target file based on the decrypted byte stream; and returning the target file as the file corresponding to the file read request.

[0015] Secondly, embodiments of this disclosure provide a data encryption device, the device comprising: a first acquisition unit configured to acquire a byte stream to be encrypted; a determination unit configured to determine an encryption information generation rule corresponding to the byte stream to be encrypted; a first generation unit configured to generate encryption information corresponding to the byte stream to be encrypted according to the encryption information generation rule; and a second generation unit configured to concatenate the encryption information at a preset concatenation position in the byte stream to be encrypted to form an encrypted byte stream.

[0016] In some alternative implementations, the byte stream to be encrypted is a byte stream decoded from a Base64 encoded byte stream.

[0017] In some optional implementations, the first acquisition unit is further configured to: in response to receiving a file upload request, the file upload request including a first byte stream obtained by Base64 encoding the file to be uploaded, perform Base64 decoding on the first byte stream to obtain the byte stream to be encrypted.

[0018] In some optional implementations, the encryption information generation rule includes: a data to be encrypted determination rule and an encryption algorithm identifier; and the first generation unit is further configured to: determine the data to be encrypted corresponding to the byte stream to be encrypted according to the data to be encrypted determination rule; encrypt the data to be encrypted using the encryption algorithm indicated by the encryption algorithm identifier to obtain encrypted data corresponding to the byte stream to be encrypted; and generate encryption information corresponding to the byte stream to be encrypted based on the encryption information generation rule corresponding to the byte stream to be encrypted and the encrypted data.

[0019] In some optional implementations, the encryption information generation rule further includes: byte stream related information generation rule; and the first generation unit is further configured to: generate related information corresponding to the byte stream to be encrypted according to the byte stream related information generation rule before generating encryption information corresponding to the byte stream to be encrypted based on the encryption information generation rule and encrypted data; and the generation of encryption information corresponding to the byte stream to be encrypted based on the encryption information generation rule and encrypted data includes: generating encryption information corresponding to the byte stream to be encrypted based on the encryption information generation rule, encrypted data and related information.

[0020] In some alternative implementations, the file to be uploaded is an unstructured file.

[0021] In some alternative implementations, the apparatus further includes a storage unit configured to store the encrypted byte stream.

[0022] In some optional implementations, the storage unit is further configured to: determine whether the data size of the encrypted byte stream is greater than a preset data size threshold; in response to determining no, store the encrypted byte stream in a preset distributed non-relational database; in response to determining yes, store the encrypted byte stream in a preset distributed file system.

[0023] In some optional implementations, the preset distributed file system is the Hadoop Distributed File System (HDFS), and the preset distributed non-relational database is the Hadoop Database (HBase).

[0024] In some optional embodiments, the apparatus further includes: a second acquisition unit configured to acquire a target encrypted byte stream corresponding to the file read request in response to receiving a file read request; a third acquisition unit configured to acquire target encrypted information corresponding to the target encrypted byte stream based on the preset concatenation position; a decryption unit configured to decrypt the target encrypted byte stream according to the target encrypted information to obtain a decrypted byte stream; and a feedback unit configured to generate a target file based on the decrypted byte stream and return the target file as the file corresponding to the file read request.

[0025] Thirdly, embodiments of this disclosure provide an electronic device, including: one or more processors; and a storage device having one or more programs stored thereon, which, when executed by the one or more processors, cause the one or more processors to implement the method described in any implementation of the first aspect.

[0026] Fourthly, embodiments of this disclosure provide a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by one or more processors, implements the method as described in any implementation of the first aspect.

[0027] To address the potential hash collisions and security vulnerabilities inherent in existing byte stream encryption methods, the data encryption method, apparatus, electronic device, and storage medium provided in this disclosure employ encryption rules corresponding to the byte stream to be encrypted, rather than using a fixed encryption method, thus avoiding potential security risks. Furthermore, by concatenating the encrypted information at a preset concatenation position within the byte stream to be encrypted, rather than encrypting the entire byte stream, the byte stream itself is not corrupted. Attached Figure Description

[0028] Other features, objects, and advantages of this disclosure will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings. The drawings are for illustrative purposes only and are not intended to limit the invention. In the drawings:

[0029] Figure 1 This is an exemplary system architecture diagram to which one embodiment of this disclosure can be applied;

[0030] Figure 2 This is a flowchart of an embodiment of the data encryption method according to the present disclosure;

[0031] Figure 3 This is a flowchart of yet another embodiment of the data encryption method according to the present disclosure;

[0032] Figure 4 This is a schematic diagram of a structure of an embodiment of the data encryption device according to the present disclosure;

[0033] Figure 5 This is a schematic diagram of the structure of a computer system suitable for implementing embodiments of the present disclosure. Detailed Implementation

[0034] The present disclosure will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings.

[0035] It should be noted that, unless otherwise specified, the embodiments and features described in this disclosure can be combined with each other. This disclosure will now be described in detail with reference to the accompanying drawings and embodiments.

[0036] Figure 1 An exemplary system architecture 100 is shown, to which embodiments of the data encryption methods, apparatus, electronic devices and storage media of this disclosure may be applied.

[0037] like Figure 1 As shown, system architecture 100 may include terminal devices 101, 102, and 103, a network 104, and a server 105. Network 104 serves as the medium for providing communication links between terminal devices 101, 102, and 103 and server 105. Network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0038] Users can use terminal devices 101, 102, and 103 to interact with server 105 via network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, and 103, such as online banking client applications, bank account manager client applications, short video social applications, audio and video conferencing applications, web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0039] Terminal devices 101, 102, and 103 can be either hardware or software. When terminal devices 101, 102, and 103 are hardware, they can be various electronic devices with sound acquisition devices (e.g., microphones), image acquisition devices (e.g., cameras), and displays, including but not limited to smartphones, tablets, e-book readers, MP3 players (Moving Picture Experts Group Audio Layer III), MP4 players (Moving Picture Experts Group Audio Layer IV), laptops, and desktop computers, etc. When terminal devices 101, 102, and 103 are software, they can be installed on the terminal devices listed above. They can be implemented as multiple software programs or software modules, or as a single software program or software module. No specific limitations are made here.

[0040] Server 105 can be a server that provides various data encryption and storage services. For example, server 105 can be a server that supports online banking services and provides corresponding data query, processing, and storage services.

[0041] Generally speaking, the data encryption method provided in this disclosure can be executed by server 105, and correspondingly, the data encryption device can also be set in server 105.

[0042] It should be noted that server 105 can be either hardware or software. When server 105 is hardware, it can be implemented as a distributed server cluster consisting of multiple servers, or as a single server. When server 105 is software, it can be implemented as multiple software programs or software modules (e.g., used to provide distributed services), or as a single software program or software module. No specific limitations are made here.

[0043] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0044] Continue to refer to Figure 2 The diagram illustrates a flow 200 of an embodiment of a data encryption method according to the present disclosure, the data encryption method comprising the following steps:

[0045] Step 201: Obtain the byte stream to be encrypted.

[0046] In this embodiment, the entity executing the data encryption method (e.g.) Figure 1 The server shown can first obtain the byte stream to be encrypted.

[0047] In some alternative implementations, the byte stream to be encrypted may be obtained from other functional modules of the aforementioned execution entity.

[0048] In some alternative implementations, the byte stream to be encrypted may also be obtained from an electronic device that provides other microservices and is network-connected to the aforementioned execution entity. For example, the execution entity may be a server providing back-end banking services, while the electronic device may be a server providing front-end request services such as querying, reading, writing, and deleting customer image data. When the electronic device receives a front-end request, for example, to write customer image data, it can send the byte stream corresponding to the customer image data to be written (e.g., customer face image data, customer ID card image data, customer handwritten signature image data, etc.) as the byte stream to be encrypted to the execution entity.

[0049] In some alternative implementations, the byte stream to be encrypted can also be obtained from a terminal device network-connected to the aforementioned execution entity. For example, the execution entity can be a server providing back-end banking processing, while the terminal device can be a terminal device with an online banking client application installed or a web browser installed, providing access to the online banking website. When a user uses the online banking client application installed on the aforementioned terminal device or accesses the online banking website using a web browser to conduct business, the terminal device can send the byte stream corresponding to the customer image data to be written (e.g., customer facial image data, customer ID card image data, customer handwritten signature image data, etc.) as the byte stream to be encrypted to the aforementioned execution entity.

[0050] In some optional implementations, the byte stream to be encrypted is a byte stream decoded from a Base64 encoded byte stream. This optional approach facilitates the transmission of 8-bit binary byte streams over a network.

[0051] Step 202: Determine the encryption information generation rules corresponding to the byte stream to be encrypted.

[0052] Here, the aforementioned executing entity can employ various implementation methods to determine the encryption information generation rules corresponding to the byte stream to be encrypted. The encryption information generation rules are used to indicate how to generate encryption information based on the byte stream to be encrypted.

[0053] In some optional implementations, the aforementioned execution entity can determine the encryption information generation rule corresponding to the file type of the byte stream to be encrypted, based on a preset correspondence between file types and encryption information generation rules. This is because, in practice, different file types often have different file formats, and the meaning of data at different positions in the byte stream is also different. However, for the same file type, the file format is the same, and the encryption information corresponding to the byte stream to be encrypted can be generated according to the same encryption information generation rule.

[0054] In some optional implementations, the aforementioned execution entity may also determine the encryption information generation rule corresponding to the number of bytes in the byte stream to be encrypted, according to a preset correspondence between the byte number range and the encryption information generation rule.

[0055] Step 203: Generate encrypted information corresponding to the byte stream to be encrypted according to the encrypted information generation rules.

[0056] In this embodiment, the aforementioned execution entity can generate encrypted information corresponding to the byte stream to be encrypted in accordance with the encrypted information generation rules determined in step 202.

[0057] In some optional implementations, the encryption information generation rules may include rules for determining the data to be encrypted and an encryption algorithm identifier. Accordingly, step 203 may include the following steps 2031 and 2032:

[0058] Step 2031: Determine the data to be encrypted corresponding to the byte stream to be encrypted according to the data to be encrypted determination rules.

[0059] Here, the rule for determining the data to be encrypted is used to indicate how to determine the data to be encrypted based on the byte stream to be encrypted. For example, the rule for determining the data to be encrypted could be: generate the data to be encrypted using at least one of the following from the byte stream to be encrypted, where at least one specifically includes: the file type, file size, and file header data corresponding to the byte stream to be encrypted. Another example is that the rule for determining the data to be encrypted could be: generate the data to be encrypted using byte stream data within a preset range from the byte stream to be encrypted, such as generating the data to be encrypted using the first ten bytes of the byte stream to be encrypted.

[0060] Step 2032: Use the encryption algorithm indicated by the encryption algorithm identifier to encrypt the data to be encrypted to obtain the encrypted data corresponding to the byte stream to be encrypted.

[0061] Here, the encryption algorithm indicated by the encryption algorithm identifier can be any currently known or future-developed encryption algorithm. The encryption algorithm identifier can be the encryption algorithm logic itself, the encryption algorithm identifier can be the program entry address corresponding to the encryption algorithm logic, or the encryption algorithm identifier can be the storage path information of the program entry address corresponding to the encryption algorithm logic (e.g., the storage path information of the encryption algorithm identifier in the configuration center). Thus, although encryption information generation rules have been customized for the byte stream to be encrypted, the encryption algorithm can be modified by further modifying the data in the storage area corresponding to the aforementioned storage path information (e.g., the configuration center), preventing the encryption algorithm from being cracked and further improving the security of data encryption.

[0062] Optionally, the encryption information generation rules may also include key information. Here, key information may include the key itself. Alternatively, key information may also include the key's storage path information (e.g., the key's storage path in the configuration center), according to which the corresponding key can be obtained. Similarly, the key can be modified by altering the data in the storage area corresponding to the aforementioned storage path information (e.g., the configuration center), preventing the encryption key from being cracked and further improving data encryption security.

[0063] Accordingly, step 2032 can be performed as follows: using the encryption algorithm indicated by the encryption algorithm identifier and the key indicated by the key information to encrypt the data to be encrypted to obtain encrypted data corresponding to the byte stream to be encrypted.

[0064] Step 2033: Generate encrypted information corresponding to the byte stream to be encrypted based on the encryption information generation rules corresponding to the byte stream to be encrypted and the encrypted data.

[0065] Here, the aforementioned execution entity can use various implementation methods to generate encrypted information corresponding to the byte stream to be encrypted based on the encryption information generation rules corresponding to the byte stream to be encrypted and the encrypted data.

[0066] For example, the aforementioned executing entity can concatenate the encryption information generation rules corresponding to the byte stream to be encrypted and the encrypted data to generate the encryption information corresponding to the byte stream to be encrypted.

[0067] For example, the aforementioned executing entity can also concatenate the encrypted data corresponding to the byte stream to be encrypted to generate encrypted information corresponding to the byte stream to be encrypted.

[0068] Alternatively, the encryption information generation rules may also include: byte stream related information generation rules.

[0069] Here, the byte stream-related information generation rule is used to indicate how to generate relevant information about the byte stream to be encrypted based on the byte stream to be encrypted. For example, the byte stream-related information generation rule could be: to generate byte stream-related information using at least one of the following from the byte stream to be encrypted: file size, file type, corresponding business transaction number, corresponding customer ID number, etc. Accordingly, the aforementioned executing entity can also execute step 2034 before step 2033:

[0070] Step 2034: Generate relevant information corresponding to the byte stream to be encrypted according to the byte stream related information generation rules.

[0071] Accordingly, step 2033 can be performed as follows: generating encrypted information corresponding to the byte stream to be encrypted based on the encryption information generation rules, encrypted data, and related information corresponding to the byte stream to be encrypted. For example, the encryption information generation rules, encrypted data, and related information corresponding to the byte stream to be encrypted can be concatenated to obtain the encrypted information corresponding to the byte stream to be encrypted.

[0072] Step 204: Concatenate the encrypted information at the preset concatenation position of the byte stream to be encrypted to form the encrypted byte stream.

[0073] For example, the preset concatenation position can be the header of the byte stream to be encrypted, that is, the encrypted information is concatenated before the header of the byte stream to be encrypted.

[0074] For example, the preset concatenation position can be the tail of the byte stream to be encrypted, that is, the encrypted information is concatenated after the tail of the byte stream to be encrypted.

[0075] For example, the preset concatenation position can be between the first and second bytes of the header of the byte stream to be encrypted, that is, concatenating the encrypted information between the first and second bytes of the header of the byte stream to be encrypted.

[0076] The data encryption method provided in the above embodiments of this disclosure avoids potential security risks by employing encryption rules corresponding to the byte stream to be encrypted, rather than using a fixed encryption method. Furthermore, by concatenating the encrypted information at a preset concatenation position in the byte stream to be encrypted, rather than encrypting the entire byte stream, the byte stream itself is not corrupted. In other words, it achieves both avoiding security risks and maintaining the integrity of the byte stream data.

[0077] Continue to refer to Figure 3 This illustrates a flow 300 of another embodiment of the data encryption method according to the present disclosure. The data encryption method includes the following steps:

[0078] Step 301: In response to receiving a file upload request, the file upload request includes a first byte stream obtained by Base64 encoding the file to be uploaded, and Base64 decoding the first byte stream to obtain a byte stream to be encrypted.

[0079] In this embodiment, the entity executing the data encryption method can receive file upload requests from other functional modules of the aforementioned entity, electronic devices providing other microservices connected to the aforementioned entity via a network, or terminal devices connected to the aforementioned entity via a network. The file to be uploaded corresponding to the file upload request can be of various types.

[0080] Optionally, the file to be uploaded can be an unstructured file. For example, the file to be uploaded can be an image file, a document file, etc. As an example, the file to be uploaded can be a customer's facial image file, customer's ID card image file, customer's handwritten signature image file, etc., collected when the customer submits a transaction using an online banking client application or by accessing the online banking website.

[0081] Step 302: Determine the encryption information generation rules corresponding to the byte stream to be encrypted.

[0082] Step 303: Generate encrypted information corresponding to the byte stream to be encrypted according to the encrypted information generation rules.

[0083] Step 304: Concatenate the encrypted information at the preset concatenation position of the byte stream to be encrypted to form an encrypted byte stream.

[0084] In this embodiment, the specific operations of steps 302, 303, and 304 and their resulting technical effects are as follows: Figure 2 In the embodiments shown, the operations and effects of steps 202, 203 and 204 are basically the same, and will not be described again here.

[0085] Step 305: Store the encrypted byte stream.

[0086] In some alternative implementations, step 305 may include the following steps:

[0087] Step 3051: Determine whether the size of the encrypted byte stream is greater than the preset data size threshold.

[0088] If it is determined that the value is not greater than the specified value, proceed to step 3052. Otherwise, if it is determined that the value is greater than the specified value, proceed to step 3053.

[0089] Step 3052: Store the encrypted byte stream in a preset distributed non-relational database.

[0090] Here, the aforementioned executing entity can store the encrypted byte stream in a preset distributed non-relational database if, in step 3051, the data size of the encrypted byte stream does not exceed a preset data size threshold. For example, the preset distributed non-relational database can be a Hadoop database, HBase. The distributed non-relational database enables real-time transmission of encrypted byte streams with relatively small data sizes.

[0091] Step 3053: Store the encrypted byte stream to a preset distributed file system.

[0092] Here, the aforementioned executing entity can store the encrypted byte stream to a preset distributed file system if, in step 3051, the size of the encrypted byte stream exceeds a preset data size threshold. For example, the preset distributed non-relational database can be the Hadoop Distributed File System (HDFS). The distributed file system enables distributed storage of encrypted byte streams with large data sizes.

[0093] By employing the optional methods in steps 3051 to 3053, different storage paths can be selected based on the data size, enabling real-time distributed storage of smaller encrypted byte streams. Larger encrypted byte streams, however, are stored using a distributed file system to avoid the inability to achieve real-time storage if all data is stored in a distributed database.

[0094] In some alternative implementations, the above process 300 may further include the following steps 306 to 310:

[0095] Step 306: In response to receiving a file read request, obtain the target encrypted byte stream corresponding to the file read request.

[0096] Here, the file read request may include the storage address information of the corresponding encrypted byte stream, and the aforementioned executing entity can then obtain the target encrypted byte stream corresponding to the file read request based on the aforementioned storage address information. For example, the file read request may be a request to obtain a customer's facial image file, ID card image file, or customer's handwritten signature image file for online banking services (such as transfers, balance inquiries, wealth management services, etc.).

[0097] Step 307: Obtain the target encrypted information corresponding to the target encrypted byte stream based on the preset splicing position.

[0098] Here, since the target encrypted byte stream is concatenated into the unencrypted byte stream according to the preset concatenation position, the target encrypted information corresponding to the target encrypted byte stream can be obtained accordingly based on the preset concatenation position.

[0099] In some optional implementations, the length of the encrypted information generated in step 303 and in the stored encrypted byte stream can be a fixed preset length. Therefore, the aforementioned execution entity can obtain data of a preset length (e.g., preset N bytes, where N is a positive integer) according to a preset concatenation position to obtain the target encrypted information.

[0100] In some alternative implementations, the execution entity may first obtain the length data of the encrypted information at a specified position relative to the preset concatenation position of the target encrypted byte stream, and then obtain the data of the above length (e.g., preset N bytes, where N is a positive integer) according to the preset concatenation position to obtain the target encrypted information.

[0101] Step 308: Decrypt the target encrypted byte stream according to the target encrypted information to obtain the decrypted byte stream.

[0102] Here, the aforementioned executing entity can decrypt the target encrypted byte stream according to the corresponding method for generating encrypted information in step 203, so as to obtain the decrypted byte stream.

[0103] Optionally, when the encryption information generation rule includes the rule for determining the data to be encrypted and the encryption algorithm identifier, and the encryption information in the encrypted byte stream is generated based on the encryption information generation rule corresponding to the byte stream to be encrypted and the encrypted data, then it can be done first according to... Figure 2 In the illustrated embodiment, step 2033, the method for generating encrypted information, involves parsing the target encrypted information to obtain the encryption information generation rules and the encrypted data. Then, the encrypted data is decrypted according to the decryption method corresponding to the encryption algorithm indicated by the encryption algorithm identifier in the encryption information generation rules, resulting in decrypted data. Next, the decrypted data is parsed according to the data to be encrypted determination rules in the encryption information generation rules to obtain parsed data. Finally, the decrypted byte stream is determined from the target encrypted byte stream based on the parsed data and a preset concatenation position. For example, when the parsed data includes the number of bytes in the decrypted byte stream (or the pre-encryption byte stream), the aforementioned number of bytes can be obtained from the target encrypted byte stream according to the preset concatenation position as the decrypted byte stream.

[0104] Optionally, when the encryption information generation rules also include byte stream-related information generation rules, and when the encryption information in the encrypted byte stream is generated based on the encryption information generation rules corresponding to the byte stream to be encrypted, the encrypted data, and related information, it can be done first according to... Figure 2In the illustrated embodiment, step 2033, the method for generating encrypted information, involves parsing the target encrypted information to obtain the encryption information generation rules, encrypted data, and related information. Then, the encrypted data is decrypted according to the decryption method corresponding to the encryption algorithm indicated by the encryption algorithm identifier in the encryption information generation rules, resulting in decrypted data. Next, the decrypted data is parsed according to the data to be encrypted determination rules in the encryption information generation rules to obtain parsed data. Finally, the decrypted byte stream is determined from the target encrypted byte stream based on the parsed data, related information, and a preset concatenation position. For example, when the parsed data or related information includes the number of bytes in the decrypted byte stream (or the pre-encryption byte stream), the aforementioned number of bytes can be obtained from the target encrypted byte stream as the decrypted byte stream according to the preset concatenation position.

[0105] Step 309: Generate a target file based on the decrypted byte stream, and return the target file as the file corresponding to the file read request.

[0106] Here, various implementation methods can be used to generate the target file based on the decrypted byte stream, and then the target file can be returned as the file corresponding to the file read request to the electronic device that received the corresponding file read request in step 306.

[0107] Optionally, the target file can be generated based on the parsed data and the decrypted byte stream. Alternatively, the target file can be generated based on the parsed data, related information, and the decrypted byte stream.

[0108] from Figure 3 It can be seen from this that, with Figure 2 Compared to the corresponding embodiments, the data encryption method in this embodiment, in its process 300, emphasizes that upon receiving a file upload request, the byte stream corresponding to the file upload request is encrypted using... Figure 2 The data encryption method in the illustrated embodiment encrypts the data before storage, and then decrypts and returns the target file upon receiving a file read request. Therefore, the scheme described in this embodiment can achieve complete file upload and read, and encrypts the data according to the corresponding byte stream of the file, rather than using a fixed method, thus avoiding potential security risks. Furthermore, the encrypted information is concatenated at a preset concatenation position in the byte stream to be encrypted, rather than encrypting the entire byte stream, preventing damage to the byte stream itself. In other words, it achieves both avoiding security risks and maintaining the integrity of the byte stream data. This enables secure file storage and retrieval while maintaining file integrity.

[0109] Further reference Figure 4 As an implementation of the methods shown in the above figures, this disclosure provides an embodiment of a data encryption device, which is similar to... Figure 2Corresponding to the method embodiments shown, this device can be specifically applied to various electronic devices.

[0110] like Figure 4 As shown, the data encryption device 400 of this embodiment includes: a first acquisition unit 401, a determination unit 402, a first generation unit 403, and a second generation unit 404. The first acquisition unit is configured to acquire a byte stream to be encrypted; the determination unit is configured to determine an encryption information generation rule corresponding to the byte stream to be encrypted; the first generation unit is configured to generate encryption information corresponding to the byte stream to be encrypted according to the encryption information generation rule; and the second generation unit is configured to concatenate the encryption information to a preset concatenation position in the byte stream to be encrypted to form an encrypted byte stream.

[0111] In this embodiment, the specific processing of the first acquisition unit 401, the determination unit 402, the first generation unit 403, and the second generation unit 404 of the data encryption device 400, and the resulting technical effects, can be referred to respectively. Figure 2 The relevant descriptions of steps 201, 202, 203 and 204 in the corresponding embodiments will not be repeated here.

[0112] In some alternative implementations, the byte stream to be encrypted may be a byte stream decoded from a Base64 encoded byte stream.

[0113] In some optional implementations, the first acquisition unit 401 may be further configured to: in response to receiving a file upload request, the file upload request including a first byte stream obtained by Base64 encoding the file to be uploaded, perform Base64 decoding on the first byte stream to obtain the byte stream to be encrypted.

[0114] In some optional implementations, the encryption information generation rule may include: a rule for determining the data to be encrypted and an encryption algorithm identifier; and the first generation unit 403 may be further configured to: determine the data to be encrypted corresponding to the byte stream to be encrypted according to the rule for determining the data to be encrypted; encrypt the data to be encrypted using the encryption algorithm indicated by the encryption algorithm identifier to obtain encrypted data corresponding to the byte stream to be encrypted; and generate encryption information corresponding to the byte stream to be encrypted based on the encryption information generation rule corresponding to the byte stream to be encrypted and the encrypted data.

[0115] In some optional implementations, the encryption information generation rule may further include: byte stream related information generation rule; and the first generation unit 403 may be further configured to: before generating encryption information corresponding to the byte stream to be encrypted based on the encryption information generation rule and encrypted data corresponding to the byte stream to be encrypted, generate related information corresponding to the byte stream to be encrypted according to the byte stream related information generation rule; and the generation of encryption information corresponding to the byte stream to be encrypted based on the encryption information generation rule and encrypted data may include: generating encryption information corresponding to the byte stream to be encrypted based on the encryption information generation rule, encrypted data and related information corresponding to the byte stream to be encrypted.

[0116] In some alternative implementations, the file to be uploaded may be an unstructured file.

[0117] In some alternative embodiments, the device may further include: a storage unit ( Figure 4 (Not shown in the image), is configured to store the encrypted byte stream.

[0118] In some alternative implementations, the storage unit ( Figure 4 (Not shown in the image) can be further configured to: determine whether the data size of the encrypted byte stream is greater than a preset data size threshold; in response to determining no, store the encrypted byte stream in a preset distributed non-relational database; in response to determining yes, store the encrypted byte stream in a preset distributed file system.

[0119] In some optional implementations, the preset distributed file system can be the Hadoop Distributed File System (HDFS), and the preset distributed non-relational database can be the Hadoop Database (HBase).

[0120] In some alternative embodiments, the device 400 may further include: a second acquisition unit ( Figure 4 (not shown in the image), configured to, in response to receiving a file read request, acquire the target encrypted byte stream corresponding to the file read request; the third acquisition unit ( Figure 4 (not shown in the image), configured to obtain target encrypted information corresponding to the target encrypted byte stream based on the preset splicing position; decryption unit ( Figure 4 (not shown in the image), configured to decrypt the target encrypted byte stream according to the target encryption information to obtain a decrypted byte stream; feedback unit ( Figure 4 (not shown in the image), is configured to generate a target file based on the decrypted byte stream, and return the target file as the file corresponding to the file read request.

[0121] It should be noted that the implementation details and technical effects of each unit in the data encryption device provided in the embodiments of this disclosure can be referred to the descriptions of other embodiments in this disclosure, and will not be repeated here.

[0122] The following is for reference. Figure 5 It shows a schematic diagram of the structure of a computer system 500 suitable for implementing the electronic device of the present disclosure. Figure 5 The computer system 500 shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments of this disclosure.

[0123] like Figure 5 As shown, the computer system 500 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage device 508 into a random access memory (RAM) 503. The RAM 503 also stores various programs and data required for the operation of the computer system 500. The processing device 501, ROM 502, and RAM 503 are interconnected via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0124] Typically, the following devices can be connected to I / O interface 505: input devices 506 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, etc.; output devices 507 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 508 including, for example, magnetic tapes, hard disks, etc.; and communication devices 509. Communication device 509 allows computer system 500 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 5 A computer system 500 with various electronic devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0125] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 509, or installed from a storage device 508, or installed from a ROM 502. When the computer program is executed by the processing device 501, it performs the functions defined in the methods of embodiments of this disclosure.

[0126] It should be noted that the computer-readable medium described in this disclosure can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in connection with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0127] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0128] The aforementioned computer-readable medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to perform the following functions: Figure 2 The illustrated embodiments and their alternative implementations demonstrate data encryption methods, and / or, as shown in the examples. Figure 3 The illustrated embodiments and their alternative implementations demonstrate data encryption methods.

[0129] Computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0130] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0131] The units described in the embodiments of this disclosure can be implemented in software or in hardware. The name of a unit does not necessarily limit the unit itself; for example, the first acquisition unit can also be described as "a unit that acquires the byte stream to be encrypted".

[0132] The above description is merely a preferred embodiment of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features disclosed in this disclosure that have similar functions.

Claims

1. A data encryption method, comprising: Obtain the byte stream to be encrypted; Determine the encryption information generation rules corresponding to the byte stream to be encrypted; Generate encrypted information corresponding to the byte stream to be encrypted according to the encrypted information generation rules; The encrypted information is concatenated at a preset concatenation position in the byte stream to be encrypted to form an encrypted byte stream; The step of determining the encryption information generation rule corresponding to the byte stream to be encrypted includes: determining the encryption information generation rule corresponding to the file type corresponding to the byte stream to be encrypted according to the preset correspondence between file types and encryption information generation rules; The encryption information generation rules include: rules for determining the data to be encrypted and an encryption algorithm identifier; and The rule for determining the data to be encrypted includes: generating the data to be encrypted using at least one of the following from the byte stream to be encrypted, wherein at least one specifically includes: the file type, file size, and file header data corresponding to the byte stream to be encrypted; The step of generating encrypted information corresponding to the byte stream to be encrypted according to the encrypted information generation rules includes: According to the rules for determining the data to be encrypted, determine the data to be encrypted corresponding to the byte stream to be encrypted; The encryption algorithm indicated by the encryption algorithm identifier is used to encrypt the data to be encrypted to obtain encrypted data corresponding to the byte stream to be encrypted; Based on the encryption information generation rules corresponding to the byte stream to be encrypted and the encrypted data, the encryption information corresponding to the byte stream to be encrypted is generated.

2. The method according to claim 1, wherein, The byte stream to be encrypted is the byte stream after decoding the Base64 encoded byte stream.

3. The method according to claim 1, wherein, The process of obtaining the byte stream to be encrypted includes: In response to receiving a file upload request, the file upload request includes a first byte stream obtained by Base64 encoding the file to be uploaded, and the first byte stream is Base64 decoded to obtain the byte stream to be encrypted.

4. The method according to claim 3, wherein, The encrypted information generation rules also include: byte stream related information generation rules; and Before generating the encrypted information corresponding to the byte stream to be encrypted based on the encryption information generation rules and encrypted data corresponding to the byte stream to be encrypted, the method further includes: Generate relevant information corresponding to the byte stream to be encrypted according to the byte stream-related information generation rules; and The step of generating encrypted information corresponding to the byte stream to be encrypted based on the encryption information generation rules and encrypted data includes: Based on the encryption information generation rules corresponding to the byte stream to be encrypted, the encrypted data, and related information, encrypted information corresponding to the byte stream to be encrypted is generated.

5. The method according to any one of claims 3-4, wherein, The file to be uploaded is an unstructured file.

6. The method according to claim 1, wherein, The method further includes: Store the encrypted byte stream.

7. The method according to claim 6, wherein, The storage of the encrypted byte stream includes: Determine whether the size of the encrypted byte stream is greater than a preset data size threshold; In response to a no-confirmation, the encrypted byte stream is stored in a preset distributed non-relational database; In response to confirmation, the encrypted byte stream is stored in a preset distributed file system.

8. The method according to claim 7, wherein, The preset distributed file system is the Hadoop Distributed File System (HDFS), and the preset distributed non-relational database is the Hadoop Database (HBase).

9. The method according to claim 8, wherein, The method further includes: In response to receiving a file read request, the target encrypted byte stream corresponding to the file read request is obtained; Based on the preset splicing position, obtain the target encrypted information corresponding to the target encrypted byte stream; The encrypted byte stream of the target is decrypted according to the target encryption information to obtain the decrypted byte stream; The target file is generated based on the decrypted byte stream, and the target file is returned as the file corresponding to the file read request.

10. A data encryption device, comprising: The first acquisition unit is configured to acquire the byte stream to be encrypted; The determining unit is configured to determine the encryption information generation rule corresponding to the byte stream to be encrypted. The determination of the encryption information generation rule corresponding to the byte stream to be encrypted includes: determining the encryption information generation rule corresponding to the file type corresponding to the byte stream to be encrypted according to a preset correspondence between file types and encryption information generation rules. The first generation unit is configured to generate encrypted information corresponding to the byte stream to be encrypted according to the encrypted information generation rules, wherein the encrypted information generation rules include: rules for determining the data to be encrypted and an encryption algorithm identifier; and The rule for determining the data to be encrypted includes: generating the data to be encrypted using at least one of the following from the byte stream to be encrypted, wherein at least one specifically includes: the file type, file size, and file header data corresponding to the byte stream to be encrypted; The step of generating encrypted information corresponding to the byte stream to be encrypted according to the encrypted information generation rules includes: According to the rules for determining the data to be encrypted, determine the data to be encrypted corresponding to the byte stream to be encrypted; The encryption algorithm indicated by the encryption algorithm identifier is used to encrypt the data to be encrypted to obtain encrypted data corresponding to the byte stream to be encrypted; Based on the encryption information generation rules corresponding to the byte stream to be encrypted and the encrypted data, generate encryption information corresponding to the byte stream to be encrypted; The second generation unit is configured to concatenate the encrypted information at a preset concatenation position in the byte stream to be encrypted to form an encrypted byte stream.

11. An electronic device, comprising: One or more processors; Storage device, on which one or more programs are stored, When the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the method as described in any one of claims 1-9.

12. A computer-readable storage medium having a computer program stored thereon, wherein, When the computer program is executed by one or more processors, it implements the method as described in any one of claims 1-9.

Images