Data encryption method and device, electronic equipment and computer storage medium

Abstract

The application provides a data encryption method and device, electronic equipment and computer storage medium. The data encryption method comprises the following steps: obtaining plaintext data input by a user; sending an encryption request to a key center after verifying the user; receiving a key time, a public key and key center identification information sent by the key center; determining an encryption cycle number and respective corresponding sub-keys based on the key time, the public key, the key center identification information and a preset private key; and performing cyclic encryption on the plaintext data by using each sub-key until the encryption cycle number is reached, so as to obtain ciphertext data corresponding to the plaintext data. According to the embodiment of the application, data encryption can be performed more safely and conveniently.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of data encryption and decryption, and particularly relates to a data encryption method and device, an electronic device and a computer storage medium. BACKGROUND

[0002] With the vigorous development of informatization and intelligentization, it has become a necessary requirement for various information systems to use password technology for identity authentication and data encryption storage and transmission, especially for the development of mobile services and the enhancement of terminal intelligence. Password technology plays an increasingly important role in data transmission, trusted authentication and data storage. The core content of password technology is to protect data by encryption method and effectively prevent the outside world from breaking the key through brute force calculation and guessing. Therefore, the key management problem becomes the primary core problem.

[0003] The key has a life cycle, which includes the valid time of the key and the certificate, and the maintenance time of the revoked key and certificate. Since the key requires confidentiality, it involves the management of the key, mainly including key generation, key backup, key recovery and key update.

[0004] The traditional 3DES algorithm is based on DES and uses triple DES, that is, two 56-bit keys K1 and K2 are used. The encryption initiator uses K1 to encrypt and K2 to decrypt, and then uses K1 to encrypt. The decryption user uses K1 to decrypt, K2 to encrypt, and then uses K1 to decrypt. The effect is to double the key length. For specific process, please refer to Figure 1 .

[0005] The existing technology has the following disadvantages: 1. Weak security. Today, with the increasing performance of computers, brute force cracking and dictionary guessing are becoming increasingly difficult. The encryption algorithm can quickly complete encryption for related files that need to be encrypted, which means that the encrypted documents can be cracked in an acceptable time, resulting in a decrease in the level of confidentiality. 2. Key change operation requires our technical personnel to first decrypt the encrypted data using the old key, and then encrypt the decrypted data using the new key. This operation requires the management of both new and old keys. Due to the inherent limitations of the algorithm, the encryption strength is not enough, and when the encrypted data involves a large amount of data, it will bring about cumbersome operations. Once the key is wrong, it will lead to the problem that the element data cannot be recovered.

[0006] Therefore, how to more safely and conveniently perform data encryption is a technical problem that needs to be solved by those skilled in the art. SUMMARY

[0007] The embodiment of the present application provides a data encryption method, device, electronic equipment and computer storage medium, which can more safely and conveniently encrypt data.

[0008] In a first aspect, the embodiment of the present application provides a data encryption method, comprising:

[0009] Obtaining plaintext data input by a user;

[0010] After verifying the legality of the user, sending an encryption request to a key center;

[0011] Receiving key time, a public key and key center identification information sent by the key center;

[0012] Determining an encryption cycle number and respective sub-keys corresponding to the encryption cycle number based on the key time, the public key, the key center identification information and a preset private key;

[0013] Encrypting the plaintext data by using each sub-key until the encryption cycle number is reached, to obtain ciphertext data corresponding to the plaintext data.

[0014] Optionally, after the plaintext data is encrypted by using each sub-key until the encryption cycle number is reached, to obtain ciphertext data corresponding to the plaintext data, the method further comprises:

[0015] Sending a decryption request to the key center;

[0016] Receiving key time, a public key and key center identification information sent by the key center;

[0017] Determining a decryption cycle number and respective sub-keys corresponding to the decryption cycle number based on the key time, the public key, the key center identification information and a preset private key;

[0018] Decrypting the ciphertext data by using each sub-key until the decryption cycle number is reached, to obtain the plaintext data.

[0019] Optionally, the step of encrypting the plaintext data by using each sub-key until the encryption cycle number is reached, to obtain ciphertext data corresponding to the plaintext data, comprises:

[0020] Segmenting the plaintext data to obtain plaintext data segments;

[0021] Encrypting the plaintext data segments by using each sub-key until the encryption cycle number is reached, to obtain the ciphertext data.

[0022] Optionally, after the encryption cycle number and respective sub-keys corresponding to the encryption cycle number are determined based on the key time, the public key, the key center identification information and a preset private key, the method further comprises:

[0023] Updating the sub-keys based on matrix conversion.

[0024] Optionally, the key center sends the key time, the public key and the key center identification information, comprising:

[0025] The key center sends the encrypted key time, the public key and the key center identification information.

[0026] Optionally, the public key comprises a current key version number, a separator, an update time, the key center identification information and a key string.

[0027] Optionally, the ciphertext data comprises a current key version number, a separator, an update time, the key center identification information and encrypted data.

[0028] In a second aspect, the embodiments of the present application provide a data encryption device, comprising:

[0029] The obtaining module is configured to obtain plaintext data input by a user.

[0030] The sending module is configured to send an encryption request to a key center after verifying the user.

[0031] The receiving module is configured to receive key time, a public key and key center identification information sent by the key center.

[0032] The determining module is configured to determine an encryption cycle number and respective sub-keys based on the key time, the public key, the key center identification information and a preset private key.

[0033] The encryption module is configured to cyclically encrypt the plaintext data using the respective sub-keys until the encryption cycle number is reached, to obtain ciphertext data corresponding to the plaintext data.

[0034] Optionally, the sending module is further configured to send a decryption request to the key center; the receiving module is further configured to receive key time, a public key and key center identification information sent by the key center; the determining module is further configured to determine a decryption cycle number and respective sub-keys based on the key time, the public key, the key center identification information and a preset private key; and the decryption module is configured to cyclically decrypt the ciphertext data using the respective sub-keys until the decryption cycle number is reached, to obtain the plaintext data.

[0035] Optionally, the encryption module is configured to segment the plaintext data to obtain plaintext data segments; and cyclically encrypt the plaintext data segments using the respective sub-keys until the encryption cycle number is reached, to obtain the ciphertext data.

[0036] Optionally, the device further comprises an updating module configured to update the sub-keys based on matrix conversion.

[0037] Optionally, the receiving module is configured to receive encrypted key time, a public key and key center identification information sent by the key center.

[0038] Optionally, the public key comprises a current key version number, a separator, an update time, key center identification information and a key string.

[0039] Optionally, the ciphertext data comprises a current key version number, a separator, an update time, key center identification information and encrypted data.

[0040] In a third aspect, an electronic device is provided, and the electronic device comprises:

[0041] a processor and a memory storing computer program instructions;

[0042] The processor executes the computer program instructions to implement the data encryption method of the first aspect.

[0043] In a fourth aspect, a computer storage medium is provided, and the computer storage medium stores computer program instructions. The computer program instructions are executed by a processor to implement the data encryption method of the first aspect.

[0044] The data encryption method, device, electronic device and computer storage medium provided by the embodiments of the present application can more securely and conveniently encrypt data. The data encryption method comprises: obtaining plaintext data input by a user; after verifying the user is legal, sending an encryption request to a key center; receiving a key time, a public key and key center identification information sent by the key center; determining an encryption cycle number and respective corresponding sub-keys based on the key time, the public key, the key center identification information and a preset private key; and encrypting the plaintext data using each sub-key until the encryption cycle number is reached, to obtain ciphertext data corresponding to the plaintext data. As can be seen, the method encrypts the plaintext data using each sub-key, and does not need to manage new and old keys, so that data can be more securely and conveniently encrypted. BRIEF DESCRIPTION OF DRAWINGS

[0045] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments of the present application. Those skilled in the art can obtain other drawings according to these drawings without any creative effort.

[0046] Figure 1 is a data encryption and decryption method flowchart in the prior art;

[0047] Figure 2 is a data encryption method flowchart provided by an embodiment of the present application;

[0048] Figure 3 is a data encryption method flowchart provided by an embodiment of the present application;

[0049] Figure 4 is a flowchart of a data decryption method provided by an embodiment of the present application;

[0050] Figure 5 is a structural diagram of a data encryption device provided by an embodiment of the present application;

[0051] Figure 6 is a structural diagram of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0052] The features and exemplary embodiments of various aspects of the present application will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are intended to explain the present application, but not to limit the present application. The present application can be implemented without some of the specific details described below. The following description of the embodiments is merely intended to provide a better understanding of the present application by showing examples of the present application.

[0053] It should be noted that, in this document, relational terms such as first and second and the like can be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Moreover, the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without more limitations, an element defined by the phrase "comprising a" does not exclude the existence of additional identical elements in the process, method, article, or apparatus that includes the element.

[0054] To solve the problems in the prior art, embodiments of the present application provide a data encryption method, device, electronic device and computer storage medium. First, the data encryption method provided by the embodiments of the present application will be introduced.

[0055] Figure 2 A flowchart of a data encryption method provided by an embodiment of the present application is shown. As shown in Figure 2 The data encryption method comprises the following steps.

[0056] S201, obtaining plaintext data input by a user.

[0057] S202, after verifying the legality of the user, sending an encryption request to a key center.

[0058] S203, receiving the key time, the public key and the key center identification information sent by the key center.

[0059] In one embodiment, the public key comprises a current key version number, a separator, an update time, key center identification information and a key string.

[0060] In one embodiment, receiving the key time, the public key and the key center identification information sent by the key center comprises: receiving the encrypted key time, the public key and the key center identification information sent by the key center.

[0061] S204, determining the encryption cycle number and the corresponding sub-key based on the key time, the public key, the key center identification information and the preset private key.

[0062] In one embodiment, after determining the encryption cycle number and the corresponding sub-key based on the key time, the public key, the key center identification information and the preset private key, the method further comprises: updating the sub-key based on matrix conversion.

[0063] S205, using each sub-key to cyclically encrypt the plaintext data until the encryption cycle number is reached, to obtain the ciphertext data corresponding to the plaintext data.

[0064] In one embodiment, the ciphertext data comprises a current key version number, a separator, an update time, key center identification information and encrypted data.

[0065] In one embodiment, using each sub-key to cyclically encrypt the plaintext data until the encryption cycle number is reached, to obtain the ciphertext data corresponding to the plaintext data, comprises: segmenting the plaintext data to obtain plaintext data segments; using each sub-key to cyclically encrypt the plaintext data segments until the encryption cycle number is reached, to obtain the ciphertext data.

[0066] In one embodiment, after using each sub-key to cyclically encrypt the plaintext data until the encryption cycle number is reached, to obtain the ciphertext data corresponding to the plaintext data, the method further comprises:

[0067] Sending a decryption request to the key center;

[0068] Receiving the key time, the public key and the key center identification information sent by the key center;

[0069] Determining the decryption cycle number and the corresponding sub-key based on the key time, the public key, the key center identification information and the preset private key;

[0070] Using each sub-key to cyclically decrypt the ciphertext data until the decryption cycle number is reached, to obtain the plaintext data.

[0071] The data encryption method comprises the following steps: obtaining plaintext data input by a user; sending an encryption request to a key center after verifying the user; receiving a key time, a public key and key center identification information sent by the key center; determining an encryption cycle number and respective corresponding sub-keys based on the key time, the public key, the key center identification information and a preset private key; and performing cyclic encryption on the plaintext data by using the respective sub-keys until the encryption cycle number is reached, to obtain ciphertext data corresponding to the plaintext data. It can be seen that the method performs cyclic encryption on the plaintext data by using the respective sub-keys, and does not need to manage new and old keys, so that the data encryption can be performed more safely and conveniently.

[0072] The above technical solutions will be described below with reference to a specific embodiment.

[0073] The embodiment can solve the above technical problems and provide safe, reliable, convenient and seamless data encryption and decryption service capabilities: 1. The internal encryption and decryption sub-key can be quickly generated by means of a clever algorithm design, which greatly enhances the encryption strength without significantly prolonging the encryption time. 2. The original encryption key K2 is publicly disclosed in the new algorithm, so the algorithm is also an asymmetric encryption and decryption algorithm. In actual operation, the public key can be replaced by the key center at regular intervals, which effectively ensures the effectiveness of the encryption and the traceability of the decryption process, and is of great significance for the use in the fields of national security and finance.

[0074] The technical solutions of the embodiment mainly include five parts: an encryption and decryption algorithm, a key file format, an encrypted data format, an encryption and decryption API and a transparent key changing method. The following will be described respectively.

[0075] I. Encryption and decryption algorithm

[0076] Two 256-bit original keys K1 and K2 (which can be public keys refreshed at regular intervals) and a key time T are used. The encryption party will use the sub-key K1 r-1 to encrypt the file to be encrypted, and then use the sub-key K2 r-1 to encrypt, and then use the sub-key K1 r to decrypt, and then use the sub-key K2 r to decrypt, and the cycle is repeated N times; the decryption party will use the sub-key K2 r to encrypt the encrypted file, and then use the sub-key K1 r to encrypt, and then use the sub-key K2 r-1 to decrypt, and then use the sub-key K1 r-1 to decrypt, and the cycle is repeated N times, and finally the plaintext text before encryption is obtained. The number N is calculated by the original keys K1 and K2. After each round of encryption and decryption, the sub-key K1 N and the sub-key K2 NAll will be deformed.

[0077] K1 r-1 , K2 r-1 → K1 r , K2 r , the update mode of the intermediate sub-key is as follows:

[0078] Each time the relevant sub-key and the original key K2 corresponding to a random prime number R (since K2 is the public key of the remote update, it can be saved and correspond to a large enough random prime number at the same time) is operated as follows:

[0079] 1, transpose K1, K2 into corresponding matrix J1, J2.

[0080] 2, when updating the sub-key, K1 r-1 , K2 r-1 and matrix J2 r-1 , J1 r-1 respectively XOR (⊕) operation, so as to obtain K1 r , K2 r .

[0081] 3, J2 r-1 , J1 r-1 is respectively shifted to the left according to the following rules:

[0082] The last row remains unchanged, and the shift offset of the second to last row, the third to last row and the fourth to last row is 1 bit, 2 bits and 4 bits respectively, and the shift offset is increased in turn, so as to obtain J2 r , J1 r .

[0083] Or use the following method to further improve the encryption strength:

[0084] The last row remains unchanged, the last column remains unchanged, the left circular shift offset of the second to last row is 1 bit, the up circular shift offset of the second to last column is 1 bit, the left circular shift offset of the third to last row is 2 bits, the up circular shift offset of the third to last column is 2 bits, the left circular shift offset of the fourth to last row is 4 bits, the up circular shift offset of the third to last column is 4 bits, and the shift offset is increased in turn, so as to obtain J2 r , J1 r .

[0085] After the above operation is completed, it is ready for the next sub-key update.

[0086] Wherein N times the first 8 bits and the last 8 bits of the original key K1 and K2 are taken, and the remainder is obtained after taking the remainder (recommended greater than 3). (N = K1⊙K2)

[0087] The exogenous input key in the algorithm is only the original key K1 and K2. The subsequent sub-keys are generated by operation of the original key, which greatly reduces the difficulty of password saving and memory, while not reducing the encryption degree.

[0088] II. Key file format

[0089] The key file format is shown in the following table:

[0090]

[0091] The key file consists of four parts: the current key version number, the separator, the update time, the key center ID and the key string. Each change of the public key will generate a version number in the key file and be recorded. The key file stores the latest version of the key string currently used, and the key center retains all key string records. The key string uses a length of 128 bits or more to ensure that any decryption algorithm and device cannot be cracked within a limited time. To ensure the security of the transmission process, the key file itself is also encrypted, so that the key file distribution process is also secure.

[0092] III. Encrypted data format

[0093] The encrypted data format is shown in the following table:

[0094]

[0095] The encrypted data also consists of four parts: the current key version number, the separator, the update time, the key center ID and the encrypted data. The key version number indicates the key version (or agreed public key) used by the encrypted data.

[0096] IV. Encryption and decryption API

[0097] The embodiment provides a unified encryption and decryption API, which provides high encryption and low cracking ability for plaintext files, and verification record ability for encrypted file decryption.

[0098] For the encryption API, the data encryption method flow is as shown in Figure 3

[0099] (1) The encryption API obtains the input data that needs to be encrypted.

[0100] (2) Apply for encryption request to the encryption center, and judge whether it is a legal user according to the feedback information. If yes, start to encrypt.

[0101] (3) The encryption center records the request record, and transmits the time, public key and encryption center ID and other information to the encryption party. The transmission also uses encryption means to encrypt the transmission content. ​

[0102] (4) The encryption API uses the obtained public key and the added private key entered by the user to calculate the number of cycles N and the generated sub-key Kn, and automatically uses the generated sub-key to cyclically encrypt the plaintext (the plaintext can be encrypted multiple times, or the plaintext is segmented and encrypted using different sub-keys).

[0103] (5) When the number of cycles N decreases to 0, the encryption ends, and the ciphertext is obtained.

[0104] For the decryption API, the flow of the data decryption method is as shown in Figure 4

[0105] (1) According to the input ciphertext data, the key version number information in the header and other information are parsed.

[0106] (2) A decryption request is applied to the encryption center, and whether it is a legal user is judged according to the feedback information. If yes, the decryption is started.

[0107] (3) The encryption center records the request record, and transmits the time, public key and encryption center ID and other information to the encryption side. The transmission content is also encrypted using encryption means.

[0108] (4) The decryption API uses the obtained public key and the added private key entered by the user to calculate the number of cycles N and the generated sub-key Kn, and automatically uses the generated sub-key to cyclically encrypt the plaintext (the plaintext can be encrypted multiple times, or the plaintext is segmented and encrypted using different sub-keys).

[0109] (5) When the number of cycles N decreases to 0, the decryption ends, and the plaintext is obtained.

[0110] Five, transparent and reliable key change method.

[0111] Based on the above key file format, encryption data format, encryption and decryption API design, a transparent and reliable key change mechanism can be realized. After the key jump, there is no need to re-flash the original encrypted data, and seamless connection of new and old version keys is realized.

[0112] Based on the above key file format, encryption data format, encryption and decryption API design, the history of the encrypted file can be tracked. All encryption and decryption operations will make operation requests to the key center (if there is no network, the last time + public key + key center ID is used for operation). Therefore, each operation is recorded and retained in the key center (except for the case of being unable to connect to the network), effectively improving the security of data encryption and providing a guarantee for reliable data flow.

[0113] ​The encryption and decryption operation is transparent by means of a smart key file and an encrypted data format design, meanwhile, the data flow traceability is provided, and the difficulty of data leakage is reduced. Meanwhile, the batch refreshing operation of the data encrypted by the old key is not needed, and the seamless connection of the new and old version keys is realized.

[0114] The encryption strength of the existing algorithm cannot face the cracking problem caused by the increasingly powerful computer performance, and the cracking difficulty of the confidential data is greatly improved. Meanwhile, the key update of a large amount of encrypted data is time-consuming and error-prone, and the cumbersome operation of the new and old version key management is improved, the data security is improved, the complex operation steps of the prior art are solved, the problem that the element data cannot be recovered due to the key error is avoided. Meanwhile, the data flow of the confidential data can be tracked, and the use and circulation of the data can be blocked immediately once the ciphertext leakage occurs.

[0115] Figure 5 is a structural schematic diagram of a data encryption device provided by an embodiment of the present application, as shown in Figure 5 The data encryption device comprises:

[0116] The acquisition module 501 is configured to acquire plaintext data input by a user.

[0117] The sending module 502 is configured to send an encryption request to a key center after verifying the user.

[0118] The receiving module 503 is configured to receive a key time, a public key and key center identification information sent by the key center.

[0119] The determination module 504 is configured to determine an encryption cycle number and respective sub-keys based on the key time, the public key, the key center identification information and a preset private key.

[0120] The encryption module 505 is configured to perform cyclic encryption on the plaintext data by using the respective sub-keys until the encryption cycle number is reached, so as to obtain ciphertext data corresponding to the plaintext data.

[0121] In an embodiment, the sending module 502 is further configured to send a decryption request to the key center; the receiving module 503 is further configured to receive a key time, a public key and key center identification information sent by the key center; the determination module 504 is further configured to determine a decryption cycle number and respective sub-keys based on the key time, the public key, the key center identification information and a preset private key; and the decryption module is configured to perform cyclic decryption on the ciphertext data by using the respective sub-keys until the decryption cycle number is reached, so as to obtain the plaintext data.

[0122] In one embodiment, the encryption module 505 is configured to segment the plaintext data to obtain plaintext data segments, and to encrypt the plaintext data segments using respective sub-keys until a number of encryption cycles is reached to obtain ciphertext data.

[0123] In one embodiment, the apparatus further includes an updating module configured to update the sub-keys based on the matrixing conversion.

[0124] In one embodiment, the receiving module 503 is configured to receive the encrypted key time, the public key and the key center identification information sent by the key center.

[0125] In one embodiment, the public key includes a current key version number, a separator, an update time, key center identification information and a key string.

[0126] In one embodiment, the ciphertext data includes a current key version number, a separator, an update time, key center identification information and encrypted data.

[0127] Figure 5 Each module / unit in the apparatus has the function of implementing each step in the method and achieves the corresponding technical effects, and for brevity, will not be described here. Figure 2

[0128] Figure 6 FIG. 1 shows a structural schematic diagram of an electronic device according to an embodiment of the present application.

[0129] The electronic device can include a processor 601 and a memory 602 having stored computer program instructions.

[0130] Specifically, the processor 601 can include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement one or more embodiments of the present application.

[0131] The memory 602 can include a mass storage for data or instructions. By way of example and not limitation, the memory 602 can include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive or a combination of two or more of these. The memory 602 can include removable or non-removable (or fixed) media, where appropriate. The memory 602 can be internal or external to the electronic device, where appropriate. In certain embodiments, the memory 602 can be non-volatile solid-state memory.

[0132] ​In one example, the memory 602 can be a Read Only Memory (ROM). In one example, the ROM can be a mask programmed ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), an electrically alterable ROM (EAROM), or a flash memory, or a combination of two or more of these.

[0133] The processor 601 implements any of the above-described data encryption methods by reading and executing computer program instructions stored in the memory 602.

[0134] In one example, the electronic device can further include a communication interface 603 and a bus 610. As shown, the processor 601, the memory 602, and the communication interface 603 are connected through the bus 610 and complete communication therebetween. Figure 6

[0135] The communication interface 603 is mainly used to realize communication between various modules, devices, units, and / or equipment in the embodiments of the present application.

[0136] The bus 610 includes hardware, software, or both, which couples the components of the electronic device to each other. By way of example, and not limitation, the bus can include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a HyperTransport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an InfiniBand interconnect, a Low Pin Count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association local (VLB) bus, or another suitable bus or interconnect, or a combination of two or more of these. Where appropriate, the bus 610 can include one or more buses. Although the present embodiments describe and show a particular bus, the present application contemplates any suitable bus or interconnect.

[0137] In addition, the embodiments of the present application can be implemented by a computer storage medium. The computer storage medium stores computer program instructions; the computer program instructions are executed by a processor to implement any of the above-described data encryption methods.

[0138] ​It is to be understood that the application is not limited to particular configurations and processes described herein and shown in the drawings. The detailed description is not to be taken in a limiting sense, and the scope of the present application is defined by the appended claims. In the above embodiments, several specific steps are described and illustrated in order to provide a thorough understanding of the present application. However, the process of the present application can be carried out in some orders of the steps, under some conditions, and using some alternatives, all without departing from the spirit and scope of the application.

[0139] The functional modules shown in the structural block diagrams described above can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application specific integrated circuits (ASICs), appropriate firmware, plug-ins, functional cards, and the like. When implemented in software, the elements of the present application are program or code segments to perform a desired task. The program or code segments can be stored in a machine-readable medium, or transmitted by a data signal carried in a carrier wave over a transmission medium or communication link. A "machine-readable medium" includes any medium that can store or transfer information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, and the like. The code segments can be downloaded via a computer network such as the Internet, an intranet, and the like.

[0140] It is also to be understood that the example embodiments described in this application are based on a series of steps or apparatuses to describe some methods or systems. However, the present application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiments, or in an order different from the embodiments, or several steps can be performed simultaneously.

[0141] The computer program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other processing devices to cause a series of operational steps to be performed on the computer, other programmable apparatus or other processing devices to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks. These computer program instructions can also be stored in a computer readable medium that can direct a computer, other programmable data processing apparatus, or other processing devices to operate in a particular manner, such that the instructions stored in the computer readable medium produce an article of manufacture including instructions which implement the function / act specified in the flowchart and / or block diagram block or blocks.

[0142] The above merely describes a specific implementation of the present application. Those skilled in the art can clearly understand the specific working processes of the system, modules and units described above for the convenience and brevity of description, and the corresponding processes in the foregoing method embodiments can be referred to, which will not be described herein again. It should be understood that the protection scope of the present application is not limited in this way, and any person skilled in the art can easily think of various equivalent modifications or replacements within the technical range disclosed in the present application, and these modifications or replacements should be covered in the protection scope of the present application.

Claims

1. A data encryption method, characterized in that, include: Obtain plaintext data input by the user; After verifying the user's legitimacy, an encryption request is sent to the key center; Receive the key time, public key, and key center identification information sent by the key center; Based on the key time, the public key, the key center identification information, and the preset private key, the number of encryption loops and the corresponding subkeys are determined. The number of encryption loops is calculated and determined by the public key that is refreshed periodically. The plaintext data is repeatedly encrypted using each of the subkeys until the encryption cycle number is reached, thereby obtaining the ciphertext data corresponding to the plaintext data. The method further includes, after determining the number of encryption loops and the corresponding subkeys based on the key time, the public key, the key center identifier information, and the preset private key: The subkey is updated based on matrix transformation; The subkey is updated by performing a matrix transformation on the subkey and a random prime number corresponding to the periodically refreshed public key.

2. The data encryption method according to claim 1, characterized in that, After the method involves repeatedly encrypting the plaintext data using each of the sub-keys until the encryption cycle number is reached to obtain the ciphertext data corresponding to the plaintext data, the method further includes: Send a decryption request to the key center; Receive the key time, public key, and key center identification information sent by the key center; Based on the key time, the public key, the key center identification information, and the preset private key, the number of decryption loops and the corresponding sub-keys are determined. The ciphertext data is decrypted repeatedly using each of the subkeys until the number of decryption cycles is reached, thus obtaining the plaintext data.

3. The data encryption method according to claim 1, characterized in that, The step of cyclically encrypting the plaintext data using each of the sub-keys until the encryption cycle number is reached, to obtain the ciphertext data corresponding to the plaintext data, includes: The plaintext data is segmented to obtain plaintext data fragments; The plaintext data segment is repeatedly encrypted using each of the subkeys until the encryption cycle number is reached, thus obtaining the ciphertext data.

4. The data encryption method according to claim 1, characterized in that, The receipt of the key time, public key, and key center identifier information sent by the key center includes: Receive the encrypted key time, public key, and key center identification information sent by the key center.

5. The data encryption method according to claim 1, characterized in that, The public key includes the current key version number, separator, update time, key center identification information, and key string.

6. The data encryption method according to claim 1, characterized in that, The encrypted data includes the current key version number, separator, update time, key center identification information, and encrypted data.

7. A data encryption device, characterized in that, include: The acquisition module is used to acquire plaintext data input by the user; The sending module is used to send an encryption request to the key center after verifying the user's legitimacy; The receiving module is used to receive the key time, public key, and key center identification information sent by the key center; The determination module is used to determine the number of encryption loops and the corresponding subkeys based on the key time, the public key, the key center identification information and the preset private key. The number of encryption loops is calculated and determined by the public key that is refreshed periodically. An encryption module is used to repeatedly encrypt the plaintext data using each of the subkeys until the encryption cycle number is reached, so as to obtain the ciphertext data corresponding to the plaintext data. The determining module is further configured to update the subkey based on matrix transformation; the subkey is updated by performing matrix transformation on the relevant subkey and a random prime number corresponding to the periodically refreshed public key.

8. An electronic device, characterized in that, The electronic device includes: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, it implements the data encryption method as described in any one of claims 1-6.

9. A computer storage medium, characterized in that, The computer storage medium stores computer program instructions, which, when executed by a processor, implement the data encryption method as described in any one of claims 1-6.

Images