Data encryption method, device, electronic device and storage medium

Abstract

The present invention discloses a data encryption method, device, electronic device and storage medium. Obtain target data to be encrypted, divide the target data into at least two data fragments, and assign a fragment identifier to each data fragment respectively; generate a data encryption file of the target data according to the data fragments, and determine an encryption verification file of the target data according to the data fragments and the fragment identifiers of the data fragments; use the data encryption file and the encryption verification file as the target encryption file of the target data. The target encryption file can be determined according to the data encryption file and the encryption verification file determined by the data fragments and the fragment identifiers of the data fragments, thereby achieving the effect of improving data encryption efficiency and ensuring the security of data transmission under the same data encryption strength.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a data encryption method, device, electronic equipment and storage medium. Background Art

[0002] At present, the development of vehicles is gradually moving towards networking. Vehicles continuously upload running data through the Internet of Vehicles, so that vehicles can perform fault monitoring and management well. In order to prevent the adverse effects of Internet of Vehicles data information leakage, it is necessary to encrypt the Internet of Vehicles data to prevent the data from being stolen during transmission.

[0003] The current encryption algorithms are mainly divided into symmetric encryption algorithms and asymmetric encryption algorithms. Symmetric encryption algorithms are mature in technology and have fast encryption speed, but they may be cracked by force. If the key is leaked, the data will be completely leaked. Asymmetric encryption algorithms have strong confidentiality and are more difficult to crack, but the algorithm has a large amount of calculation, which causes the server to run slowly and inefficiently, making it difficult to use to encrypt large amounts of data. Therefore, there is generally a huge contradiction between data encryption efficiency and data encryption strength, that is, if the encryption efficiency is high, the encryption strength is low, and if the encryption strength is high, the encryption efficiency is low. Summary of the invention

[0004] The present invention provides a data encryption method, device, electronic device and storage medium to solve the problem of the contradiction between data encryption efficiency and data encryption strength.

[0005] According to one aspect of the present invention, a data encryption method is provided, wherein the method comprises:

[0006] Obtaining target data to be encrypted, dividing the target data into at least two data segments, and assigning a segment identifier to each data segment;

[0007] generating a data encryption file of the target data according to the data fragments, and determining an encryption verification file of the target data according to the data fragments and fragment identifiers of the data fragments;

[0008] The data encryption file and the encryption verification file are used as target encryption files of the target data.

[0009] According to another aspect of the present invention, there is provided a data encryption device, wherein the device comprises:

[0010] A fragment identifier allocation module, used for acquiring target data to be encrypted, dividing the target data into at least two data fragments, and respectively allocating a fragment identifier to each data fragment;

[0011] an encrypted file determination module, configured to generate a data encryption file of the target data according to the data fragment, and determine an encryption verification file of the target data according to the data fragment and the fragment identifier of the data fragment;

[0012] The target encrypted file determination module is used to use the data encrypted file and the encrypted verification file as the target encrypted file of the target data.

[0013] According to another aspect of the present invention, there is provided an electronic device, the electronic device comprising:

[0014] at least one processor; and

[0015] a memory communicatively connected to the at least one processor; wherein,

[0016] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the data encryption method described in any embodiment of the present invention.

[0017] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the data encryption method described in any embodiment of the present invention when executed.

[0018] The technical solution of the embodiment of the present invention obtains the target data to be encrypted, divides the target data into at least two data fragments, and assigns a fragment identifier to each data fragment, breaking the whole into parts, providing more possibilities for data encryption, and making the data encryption method more flexible; generating data fragments with fragment identifiers to record the position of each data fragment, considering the logic and integrity of the data, adding fragment identifiers, and conveniently distinguishing different data fragments. Further, generating a data encryption file of the target data according to the data fragments to improve the security of the target data; and determining an encryption verification file of the target data according to the data fragments and the fragment identifiers of the data fragments to verify whether the target data has been tampered with or leaked during the data transmission process; further, using the data encryption file and the encryption verification file as the target encryption file of the target data for data transmission. The problem of the contradiction between data encryption efficiency and data encryption strength is solved, and the target encryption file can be determined according to the data encryption file and the encryption verification file determined by the data fragments and the fragment identifiers of the data fragments, so as to achieve the effect of improving data encryption efficiency and ensuring the security of data transmission at a lower data encryption strength.

[0019] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0021] Figure 1 is a flow chart of a data encryption method provided according to Embodiment 1 of the present invention;

[0022] Figure 2 A schematic diagram of allocating fragment identifiers to data fragments provided by an embodiment of the present invention;

[0023] Figure 3 is a flow chart of a data encryption method provided according to Embodiment 2 of the present invention;

[0024] Figure 4 is a flow chart of a data encryption method provided according to Embodiment 3 of the present invention;

[0025] Figure 5 A schematic diagram of a process for encrypting target data provided by an embodiment of the present invention;

[0026] Figure 6 A schematic diagram of the overall process of a data encryption method provided by an embodiment of the present invention;

[0027] Figure 7 is a structural schematic diagram of a data encryption device provided according to a fourth embodiment of the present invention;

[0028] Figure 8 It is a structural schematic diagram of an electronic device that implements a data encryption method provided in Embodiment 5 of the present invention. DETAILED DESCRIPTION

[0029] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0030] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0031] Embodiment 1

[0032] Figure 1 A flowchart of a data encryption method is provided for the first embodiment of the present invention. This embodiment is applicable to the case of data encryption transmission. The method can be executed by a data encryption device. The data encryption device can be implemented in the form of hardware and / or software. The data encryption device can be configured in a computer. Figure 1 As shown, the method includes:

[0033] S110, obtaining target data to be encrypted, dividing the target data into at least two data segments, and assigning a segment identifier to each data segment respectively.

[0034] The target data may be understood as data to be encrypted, generally data to be transmitted. For example, the target data may be vehicle transmission data, or may be digital data carrying personal information or involving personal privacy, such as digital identity information and / or call information.

[0035] The data segments can be understood as multiple data segments divided for the target data. Optionally, the target data is divided into at least two data segments according to a preset encryption segment length. Optionally, the preset encryption segment length is usually a segment length based on 8 bits. Exemplarily, the preset encryption segment length can be a segment length of 16 bits, 32 bits, 64 bits, 128 bits or more.

[0036] The fragment identifier can be understood as an identifier used to mark the arrangement position of the data fragment. Specifically, the fragment identifier is allocated according to the sequence of the data fragments to generate the data fragments with the identifier, such as Figure 2 In the embodiment of the present invention, the segment identifier may be a segment address.

[0037] S120: Generate a data encryption file of the target data according to the data fragment, and determine an encryption verification file of the target data according to the data fragment and the fragment identifier of the data fragment.

[0038] In the embodiment of the present invention, the data encryption file of the target data is generated according to the data fragment, and the target data itself can be encrypted according to the data fragment, thereby reducing the possibility of leakage of the target data and improving the security of the target data transmission; the encryption verification file of the target data is determined according to the data fragment and the fragment identifier of the data fragment, and it can be verified whether the target data is leaked during the transmission process, thereby adding a layer of guarantee for data security. The data encryption file and the encryption verification file provide double security guarantee for the target data.

[0039] S130: Use the data encryption file and the encryption verification file as the target encryption file of the target data.

[0040] Specifically, the data encryption file and the encryption verification file are combined as the target encryption file of the target data, and data transmission is performed.

[0041] The technical solution of the embodiment of the present invention obtains the target data to be encrypted, divides the target data into at least two data fragments, and assigns a fragment identifier to each data fragment, breaking the whole into parts, providing more possibilities for data encryption, and making the data encryption method more flexible; generating data fragments with fragment identifiers to record the position of each data fragment, considering the logic and integrity of the data, adding fragment identifiers, and conveniently distinguishing different data fragments. Further, generating a data encryption file of the target data according to the data fragments to improve the security of the target data; and determining an encryption verification file of the target data according to the data fragments and the fragment identifiers of the data fragments to verify whether the target data has been tampered with or leaked during the data transmission process; further, using the data encryption file and the encryption verification file as the target encryption file of the target data for data transmission. The problem of the contradiction between data encryption efficiency and data encryption strength is solved, and the target encryption file can be determined according to the data encryption file and the encryption verification file determined by the data fragments and the fragment identifiers of the data fragments, so as to achieve the effect of improving data encryption efficiency and ensuring the security of data transmission at a lower data encryption strength.

[0042] Embodiment 2

[0043] Figure 3This is a flow chart of a data encryption method provided in the second embodiment of the present invention. This embodiment refines how to generate the data encryption file of the target data according to the data fragments described in the above embodiment. Figure 3 As shown, the method includes:

[0044] S210: Obtain target data to be encrypted, divide the target data into at least two data segments, and assign a segment identifier to each data segment.

[0045] S220. Divide the data segments of the target data into at least two types of data segments based on a preset classification algorithm.

[0046] The classification algorithm can be understood as an algorithm that can divide the data segments of the target data into at least two types. It can be a decision tree classification method, a naive Bayesian classification algorithm, a fuzzy classification method, or a custom classification algorithm. It is understandable that the classification algorithm can be preset according to demand and is not specifically limited here.

[0047] Optionally, dividing the data segments of the target data into at least two types of data segments based on a preset classification algorithm includes: randomly generating a target value, and dividing the data segments of the target data into two types of data segments based on whether a quotient obtained by dividing a segment identifier of each data segment by the target value is an integer; or dividing the data segments of the target data into two types of data segments based on whether the segment identifier of each data segment is an odd number or an even number.

[0048] Among them, the target value can be understood as a value used to divide the data fragments of the target data into at least two types of data fragments. Optionally, the target value can be a composite number, etc. It can be understood that the target value can be preset according to the needs, and is not specifically limited here. It can make the number of at least two types of data fragments after division close, which is conducive to the further encryption of the target data. Among them, the composite number can be understood as an integer greater than 1 that can be divided by 1 and itself, and can also be divided by other numbers (except 0). For example, 4, 6, 8 or 9. Specifically, a composite number is randomly generated, and the fragment identifier of each data fragment is divided by the composite number. If the quotient obtained is an integer, the data fragment of the target data is divided into one type of data fragment; if the quotient obtained is a non-integer, the data fragment of the target data is divided into another type of data fragment. Alternatively, an even number is randomly generated, and the fragment identifier of each data fragment is divided by the even number. If the obtained quotient is an integer, the data fragments of the target data are divided into one type of data fragments; if the obtained quotient is a non-integer, the data fragments of the target data are divided into another type of data fragments.

[0049] Optionally, the data segments with the fragment identifier being an odd number are divided into data segments of one type of the target data; the data segments with the fragment identifier being an even number are divided into data segments of another type of the target data. Exemplarily, each type of data segment after the division may be a data segment of type A and a data segment of type B, or a data segment of the first type and a data segment of the second type, etc.

[0050] It can be understood that the data fragments are divided into two types of data fragments according to whether the quotient obtained by dividing the fragment identifier of each data fragment by the composite number or the even number is an integer, or according to whether the fragment identifier of each data fragment is an odd number or an even number. The division method is simple and can make the number of two types of data fragments close, which is more conducive to further encryption of the target data.

[0051] In an embodiment of the present invention, after dividing the target data into data segments based on a preset classification algorithm, the number of types of the data segments determined is generally related to which specific classification algorithm is used. The number of types obtained can be determined based on actual conditions and is not specifically limited here.

[0052] S230: Encrypt each type of data fragment respectively to obtain a sub-encrypted file corresponding to each type of data fragment.

[0053] Specifically, after the data segments of the target data are divided into at least two types of data segments according to a preset classification algorithm, each type of data segment is encrypted respectively to obtain a sub-encrypted file corresponding to each type of data segment. Optionally, the sub-encrypted file may be a sub-encrypted file 1 and a sub-encrypted file 2 corresponding to the data segment type, or a first sub-encrypted file and a second sub-encrypted file, etc. Specifically, for example, data segments whose segment identifiers are odd numbers are divided into Class A data segments; data segments whose segment identifiers are even numbers are divided into Class B data segments; Class A data segments are encrypted to obtain Sub-encrypted file 1; Class B data segments are encrypted to obtain Sub-encrypted file 2.

[0054] In the embodiment of the present invention, different algorithms may be used to encrypt data for different types of data fragments.

[0055] Optionally, encrypting each type of data fragment separately to obtain a sub-encrypted file corresponding to each type of data fragment includes: for different types of data fragments, using different encryption algorithms to encrypt the data fragments to obtain the sub-encrypted files corresponding to the data fragments.

[0056] The encryption algorithm may be understood as an algorithm for encrypting unencrypted data segments and generating corresponding sub-encrypted files.

[0057] Optionally, the encryption algorithm may be Message-Digest Algorithm 5 (DM5), Data Encryption Standard (DES), Secure Hash Algorithm 1 (SHA1), Rivest-Shamir-Adleman (RSA), Hash-based Message Authentication Code (HMAC) or Advanced Encryption Standard (AES), etc. It is understandable that the encryption algorithm used for encryption of each type of data fragment can be preset according to demand and is not specifically limited here.

[0058] Optionally, the A-type data fragments may be encrypted using the DM5 encryption algorithm, and the B-type data fragments may be encrypted using the DES encryption algorithm.

[0059] In an embodiment of the present invention, different encryption algorithms can be used for the encryption of different types of data fragments, and different encryption keys can be used to generate sub-encrypted files corresponding to each type of data fragment, so as to increase the difficulty of cracking and ensure the security of data transmission. Among them, the key can be understood as a parameter input in the encryption algorithm. The encryption key can be preset according to needs and is not specifically limited here. It can be understood that the keys corresponding to different encryption algorithms can be the same or different. In an embodiment of the present invention, different keys are usually used to improve the encryption strength. For example, the DM5 encryption algorithm is used to encrypt the A-type data fragment, and the encryption key is key 1, and the sub-encrypted file 1 is generated; the DES encryption algorithm is used to encrypt the B-type data fragment, and the encryption key is key 2, and the sub-encrypted file 2 is generated.

[0060] S240: Merge the sub-encrypted files corresponding to the various types of data fragments to obtain a data encryption file of the target data.

[0061] Specifically, the data fragments are divided into various types of data fragments through a preset classification algorithm, and further, the various types of data fragments are encrypted respectively through different preset encryption algorithms to obtain sub-encrypted files corresponding to the various types of data fragments, and further, the obtained sub-encrypted files are merged to obtain the data encryption file of the target data.

[0062] S250: Determine an encryption verification file of the target data according to the data fragment and the fragment identifier of the data fragment.

[0063] S260: Use the data encryption file and the encryption verification file as the target encryption file of the target data.

[0064] The technical solution of the embodiment of the present invention divides the data fragments of the target data into at least two types of data fragments based on a preset classification algorithm; further, encrypts each type of data fragment separately to obtain a sub-encrypted file corresponding to each type of data fragment, and divides the data fragments into different types and encrypts them respectively by different encryption algorithms, which can reduce the possibility of data being cracked; further, merges the sub-encrypted files corresponding to the various types of data fragments to obtain the data encryption file of the target data. The effect of cross-encrypting data through multiple different encryption algorithms is achieved to improve the security of data transmission.

[0065] Embodiment 3

[0066] Figure 4 This is a flow chart of a data encryption method provided in Embodiment 3 of the present invention. This embodiment refines how to determine the encryption verification file of the target data according to the data fragment and the fragment identifier of the data fragment in the above embodiment. Figure 4 As shown, the method includes:

[0067] S310: Obtain target data to be encrypted, divide the target data into at least two data segments, and assign a segment identifier to each data segment.

[0068] S320: Generate a data encryption file of the target data according to the data fragment.

[0069] S330. Extract a verification segment from at least two data segments, and encrypt the extracted verification segment to obtain target verification data.

[0070] Among them, the verification fragment can be understood as a data fragment used to verify whether the target data is leaked. In an embodiment of the present invention, for the verification fragment, one or more data fragments can be extracted from at least two data fragments by a preset random sampling method. For example, the target data is divided into data fragment 1, data fragment 2, data fragment 3 and data fragment 4, and data fragment 1 and data fragment 3 can be extracted as verification fragments. Among them, the random sampling method can be preset according to specific needs and is not specifically limited here. For example, the random sampling method can be a simple random sampling method, a stratified random sampling method or a clustered random sampling method. Furthermore, the number of verification fragments extracted by the preset random sampling method can be preset according to specific needs and is not specifically limited here. In an embodiment of the present invention, the random sampling method is used to extract the verification fragment, which can reduce the amount of data that needs to be calculated, thereby improving the encryption speed.

[0071] Furthermore, the extracted verification fragment is encrypted to obtain target verification data, so as to verify whether the target data is leaked and improve the security of data transmission.

[0072] In the embodiment of the present invention, there are multiple ways to encrypt the extracted verification fragment, and it can be preset according to the needs, and it is not specifically limited here. Exemplarily, the verification fragment can be encrypted by a message authentication code algorithm, a message-digest algorithm 5 (DM5), a data encryption standard (DES), a key encryption algorithm (Rivest-Shamir-Adleman, RSA), a secure hash algorithm 1 (SHA1), or an advanced encryption standard (AES).

[0073] In an embodiment of the present invention, the extracted verification fragment can be encrypted by a message authentication code algorithm. The message authentication code algorithm is simple in structure, and the underlying algorithm has a black box nature, which is easy to replace. And by encrypting the extracted verification fragment by a message authentication code algorithm, a corresponding message verification code can be obtained to verify the integrity of the target data during transmission, which can add a layer of security guarantee for data security.

[0074] Optionally, encrypting the extracted verification fragment to obtain target verification data includes: encrypting the extracted verification fragment based on a message authentication code algorithm to obtain a message verification code, and using the message verification code as the target verification data.

[0075] The message authentication code (MAC) algorithm can be understood as a hash function with a secret key. Specifically, the extracted verification fragment can be encrypted by the message authentication code algorithm to obtain a corresponding message authentication code.

[0076] Furthermore, after the extracted verification fragment is encrypted by a message authentication code algorithm to obtain a message authentication code, the message authentication code is used as target verification data.

[0077] S340: Obtain a segment identifier of each of the verification segments, and generate an identifier record file based on the segment identifiers of the verification segments.

[0078] Specifically, the segment identifier of each of the extracted verification segments is recorded, and further, the segment identifier of the verification segment is obtained to generate an identifier record file.

[0079] S350: Encrypt the target verification data, the identification record file and the preset classification algorithm to obtain an encrypted verification file of the target data.

[0080] Specifically, the target verification data, the identification record file and the preset classification algorithm are encrypted using a key to obtain an encrypted verification file of the target data. It is understandable that the key used here may be different from the key in the above embodiment to increase the difficulty of cracking the encrypted data and ensure the security of the target data. Optionally, the target verification data, the identification record file and the preset classification algorithm are encrypted using a message authentication code algorithm, and the key used may be key 3. That is, key 3 is a parameter input in the message authentication code algorithm.

[0081] Exemplarily, the message authentication code obtained by encrypting the extracted verification fragment based on the message authentication code algorithm, the identification record file generated based on the fragment identification of the verification fragment, and the preset classification algorithm for dividing the data fragments of the target data into at least two types of data fragments are encrypted using the key 3 to obtain the encrypted verification file of the target data. Exemplarily, the encryption process of the target data can be as follows Figure 5As shown. Specifically, the target data is divided into multiple data fragments; a fragment identifier is assigned to each data fragment; one or more data fragments are randomly extracted, encrypted using the MAC algorithm to obtain a message verification code 1, and an identification record file generated by recording the fragment identifier of the extracted data fragment; the data fragments are divided into Class A data fragments and Class B data fragments using the classification algorithm, the Class A data fragments are encrypted using the DM5 encryption algorithm, the encryption key is key 1, and a sub-encrypted file 1 is generated; the Class B data fragments are encrypted using the DES encryption algorithm, the encryption key is key 2, and a sub-encrypted file 2 is generated, and the sub-encrypted file 1 and the sub-encrypted file 2 are merged to generate a data encryption file; the message verification code 1, the identification record file, and the classification algorithm for dividing the data fragment types are encrypted using key 3 to obtain an encrypted verification file.

[0082] In the embodiment of the present invention, the integrity of the target data and whether the target data has been tampered with or leaked can be verified through the encrypted verification file of the target data.

[0083] S360: Use the data encryption file and the encryption verification file as the target encryption file of the target data.

[0084] Further, the target data is encrypted to obtain a target encrypted file, and then data is transmitted. Further, the target data is decrypted to obtain the target data.

[0085] In the embodiment of the present invention, the data decryption process for the target data may correspond to the data encryption process for the target data.

[0086] Optionally, decrypting the target data to obtain the target data specifically includes: in response to a data decryption request for the target data, obtaining a target encrypted file of the target data; determining a sub-encrypted file corresponding to each type of data fragment in the data encryption file, and decrypting each sub-encrypted file respectively to obtain each type of data fragment; decrypting the encrypted verification file to obtain target verification data, an identification record file and a preset classification algorithm for the target data; merging various types of data fragments according to the preset classification algorithm to obtain plaintext data; determining a to-be-verified fragment in the plaintext data according to the fragment identifier in the identification record file, and encrypting the to-be-verified fragment according to the encryption method of the target verification data to obtain the to-be-verified data; and determining whether the plaintext data is the target data according to the data to be verified and the target verification data.

[0087] Among them, the data decryption request can be understood as a data decryption request initiated for the target data. There are many ways to generate the data decryption request, for example, it can be generated when a decryption request control that acts on a preset setting for initiating a data decryption request is received, or it can be generated when a preset trigger event for triggering the start of data decryption is detected; or it can be generated when preset sound information or gesture information is detected, etc. Among them, the trigger event can be set according to the actual situation and is not specifically limited here. The plaintext data can be understood as the target data that has not been encrypted. In other words, it can be the target data before encryption, or the target data after decryption.

[0088] In the embodiment of the present invention, for the data encryption process of the target data, the corresponding data decryption process of the target data may be as follows:

[0089] Specifically, in response to a data decryption request initiated for the target data, a target encrypted file of the target data is obtained, wherein the target encrypted file includes a data encryption file and an encryption verification file.

[0090] Further, exemplarily, during the data encryption process, the data segments may be divided into Class A data segments and Class B data segments according to a target value (for example: 4); further, the Class A data segments are encrypted using the DM5 encryption algorithm to generate sub-encrypted file 1, and the Class B data segments are encrypted using the DES encryption algorithm to generate sub-encrypted file 2, and the sub-encrypted file 1 and the sub-encrypted file 2 are merged to form a data encryption file.

[0091] Correspondingly, the data decryption process can be to obtain sub-encrypted file 1 corresponding to the class A data segment and sub-encrypted file 2 corresponding to the class B data segment in the data encryption file, further, use the DM5 encryption algorithm to decrypt the sub-encrypted file 1 to obtain the class A data segment, and use the DES encryption algorithm to decrypt the encrypted file 2 to obtain the class B data segment.

[0092] In an embodiment of the present invention, the target verification data is a message verification code obtained by encrypting the extracted verification fragment based on a message authentication code algorithm. Optionally, the message verification code obtained by encrypting the extracted verification fragment based on a message authentication code algorithm may be a message verification code 1 or a first message verification code, etc.

[0093] Furthermore, in the data encryption process, a classification algorithm may be used to divide the data fragments into Class A data fragments and Class B data fragments according to a target value (for example: 4), an identification record file may be generated based on the fragment identification of the verification fragment, and the verification fragment may be encrypted through a message verification code algorithm to obtain a message verification code 1, which is encrypted using a key 3 to determine an encrypted verification file.

[0094] Correspondingly, the data decryption process may be to use key 3 to decrypt the encrypted verification file, and obtain the target value (eg 4) of the classification algorithm, the identification record file and the message verification code 1 in the encrypted verification file.

[0095] Furthermore, according to the target value (eg, 4) in the obtained encryption verification file, various types of data fragments are merged to obtain plaintext data.

[0096] Furthermore, the verification fragment is obtained according to the fragment identifier of the verification fragment recorded in the identification record file, and the verification fragment is re-encrypted using the message verification code algorithm to obtain the re-encrypted message verification code, for example, message verification code 2.

[0097] Further, whether the plaintext data is the target data is determined based on the data to be verified and the target verification data. In an embodiment of the present invention, it can be to compare whether the message verification 1 and the message verification code 2 are consistent. If they are consistent, the message has not been leaked or tampered with during data transmission. If the message verification 1 and the message verification code are inconsistent, the message may be leaked or tampered with during data transmission. Further, in the case where the message verification 1 and the message verification code 2 are inconsistent, a message leakage prompt information can be generated. Optionally, the message leakage prompt information can be prompted by a message leakage prompt device. Exemplarily, when the message verification 1 and the message verification code 2 are inconsistent, the message leakage related prompt text or picture can be displayed by the display device, and / or the message leakage related prompt voice can be prompted by the speaker. So that the user can discover the message leakage in time and deal with it to avoid causing greater losses.

[0098] The technical solution of the embodiment of the present invention is to extract a verification fragment from at least two data fragments, encrypt the extracted verification fragment, and obtain target verification data; further, obtain the fragment identification of each verification fragment, and generate an identification record file based on the fragment identification of the verification fragment; further, encrypt the target verification data, the identification record file and the preset classification algorithm to obtain an encrypted verification file of the target data. This is to verify whether the target data has been tampered with or leaked during the data transmission process. If the target data has been tampered with or leaked during the data transmission process, it can be processed in time to achieve the effect of protecting the security of the target data.

[0099] Figure 6 The overall flow diagram of a data encryption method provided by an embodiment of the present invention; as shown in Figure 6, the data encryption method can be divided into a sender and a receiver. The plaintext data can be understood as the target data, the sender can be understood as the encryption process of the Internet of Vehicles data, and the receiver can be understood as the decryption process of the Internet of Vehicles data.

[0100] The overall encryption process of the Internet of Vehicles data can be:

[0101] The plaintext data is divided into multiple data fragments with fragment identifiers. One or more data fragments are randomly selected, encrypted using the MAC algorithm, and a message authentication code 1 is obtained, and an identifier record file generated by recording the fragment identifiers of the extracted data fragments is generated.

[0102] The multiple data fragments are divided into Class A data fragments and Class B data fragments through a classification algorithm, and the Class A data fragments and Class B data fragments are encrypted respectively by key 1 and key 2 to obtain sub-encrypted file 1 and sub-encrypted file 2, and sub-encrypted file 1 and sub-encrypted file 2 are merged into a data encryption file.

[0103] The obtained message verification code 1, the identification record file, and the classification algorithm for dividing the data segment types are encrypted by the key 3 to obtain an encrypted verification file.

[0104] The data encryption file and the encryption verification file are sent to the recipient as the target encryption file.

[0105] The encrypted verification file is decrypted by key 3 to obtain message verification code 1, identification record file and classification algorithm. Sub-encrypted file 1 and sub-encrypted file 2 are decrypted by key 1 and key 2 respectively to obtain class A data fragments and class B data fragments, and class A data fragments and class B data fragments are used as plain text data. The obtained plain text data is filtered by the fragment identifier in the obtained identification record file to obtain data fragments, and the data fragments are encrypted by the MAC algorithm to obtain message verification code 2, and the message verification code 1 and the message verification code 2 are used for verification to determine whether the plain text data is leaked during the transmission process.

[0106] Exemplarily, the Internet of Vehicles data encryption method may include:

[0107] 1. File processing: The file processing module can be a computer, a server, a file processing software, etc. Its main function is to split the file to be encrypted into multiple data fragments according to the preset encryption fragment length, and then assign fragment identifiers according to the data order to generate data fragments with identifiers. The preset encryption fragment length is based on 8 bits, and 16 bits, 32 bits, 64 bits, 128 bits and above fragment lengths can be selected. The length of the fragment identifier is based on 8 bits, and its length is a multiple of 8. Generally, the length of the fragment identifier is less than the length of the data fragment. In particular, when the amount of data is large and the data capacity is insufficient, multi-packet transmission will also be used. For example, the length of the fragment identifier is 8, and the data fragment is a preset encryption fragment of 16 bits. Its maximum capacity is 255*16=4080 bits of file data. When the file data is greater than 4080, multi-packet transmission is used. This module will also compose the sub-encrypted file 1 and the sub-encrypted file 2 into an encrypted file. The classification algorithm, message authentication code, and fragment identifier file are composed of an encrypted verification file.

[0108] 2. Verification encryption: A module for generating a message authentication code, which can be composed of a computer, a server, an encryption module, etc. Its main function is to randomly select one or more data fragments and generate a message authentication code through a preset encryption algorithm to verify the integrity of the data and perform identity authentication. The present invention adopts a random sampling algorithm to reduce the amount of data that needs to be calculated, thereby improving the encryption speed. The module also records the fragment identifier of the randomly selected data fragment and generates a fragment identifier file.

[0109] 3. Data classification: A module that divides data fragments into Class A data fragments and Class B data fragments according to a classification algorithm. Its main components can be computers, servers, file processing software, etc. Example 1: randomly generate a composite number, divide the fragment identifier by the composite number, and those that can be divided evenly are classified as Class A data fragments, and those that cannot be divided evenly are classified as Class B data fragments. Example 2: The fragment identifiers with odd numbers are classified as Class A data fragments, and the fragment identifiers with even numbers are classified as Class B data fragments, and so on.

[0110] 4. Data encryption: Encrypt files according to a preset encryption algorithm. It can be composed of computers, servers, encryption modules, etc. For example, the DM5 encryption algorithm is used to encrypt the A-type data fragment, and its encryption key is key 1, generating sub-encrypted file 1, and the DES encryption algorithm is used to encrypt the B-type data fragment, and its encryption key is key 2, generating sub-encrypted file 2. The DM5 encryption algorithm, DES encryption algorithm, or RSA encryption algorithm can be used to encrypt the data fragment to generate a data encryption file.

[0111] In order to solve the contradiction between encryption efficiency and encryption strength, an encryption structure with three sets of encryption algorithms cross-linked is adopted. Under the same encryption strength, the encryption efficiency is greatly improved, and the encryption strength is strong and the encryption efficiency is higher. This makes the encryption efficiency of large amounts of data in the Internet of Vehicles better and saves encryption costs.

[0112] The technical solution of the embodiment of the present invention improves the encryption efficiency by constructing three encryption algorithms for cross-encryption, compared with the encryption structure composed of the same three encryption algorithms. It solves the possibility of a single encryption algorithm being forcibly cracked, adopts three encryption keys, and uses multiple sets of different encryption algorithms, which greatly reduces the possibility of being cracked. It reduces the possibility of vehicle data being stolen and user privacy being leaked due to plain text transmission during the transmission of Internet of Vehicles data.

[0113] Embodiment 4

[0114] Figure 7 This is a schematic diagram of the structure of a data encryption device provided by Embodiment 4 of the present invention. Figure 7 As shown, the device includes: a segment identifier allocation module 410, an encrypted file determination module 420 and a target encrypted file determination module 430.

[0115] Among them, the fragment identifier allocation module 410 is used to obtain the target data to be encrypted, divide the target data into at least two data fragments, and assign a fragment identifier to each data fragment respectively; the encryption file determination module 420 is used to generate a data encryption file of the target data according to the data fragments, and determine the encryption verification file of the target data according to the data fragments and the fragment identifiers of the data fragments; the target encryption file determination module 430 is used to use the data encryption file and the encryption verification file as the target encryption file of the target data.

[0116] The technical solution of the embodiment of the present invention obtains the target data to be encrypted, divides the target data into at least two data fragments, and assigns a fragment identifier to each data fragment, breaking the whole into parts, providing more possibilities for data encryption, and making the data encryption method more flexible; generating data fragments with fragment identifiers to record the position of each data fragment, considering the logic and integrity of the data, adding fragment identifiers, and conveniently distinguishing different data fragments. Further, generating a data encryption file of the target data according to the data fragments to improve the security of the target data; and determining an encryption verification file of the target data according to the data fragments and the fragment identifiers of the data fragments to verify whether the target data has been tampered with or leaked during the data transmission process; further, using the data encryption file and the encryption verification file as the target encryption file of the target data for data transmission. The problem of the contradiction between data encryption efficiency and data encryption strength is solved, and the target encryption file can be determined according to the data encryption file and the encryption verification file determined by the data fragments and the fragment identifiers of the data fragments, so as to achieve the effect of improving data encryption efficiency and ensuring the security of data transmission at a lower data encryption strength.

[0117] Optionally, the encrypted file determination module 420 includes: a data segment type classification unit, a sub-encrypted file determination unit and a data encrypted file determination unit.

[0118] Among them, the data segment type classification unit is used to divide the data segments of the target data into at least two types of data segments based on a preset classification algorithm; the sub-encryption file determination unit is used to encrypt each type of data segment respectively to obtain a sub-encryption file corresponding to each type of data segment; the data encryption file determination unit is used to merge the sub-encryption files corresponding to various types of data segments to obtain the data encryption file of the target data.

[0119] Optionally, the data segment type classification unit is used to:

[0120] A target value is randomly generated, and the data segments of the target data are divided into two types of data segments according to whether a quotient obtained by dividing a segment identifier of each data segment by the target value is an integer;

[0121] or,

[0122] The data segments of the target data are divided into two types of data segments according to whether the segment identifier of each data segment is an odd number or an even number.

[0123] Optionally, the sub-encrypted file determining unit is used to:

[0124] For different types of data fragments, different encryption algorithms are used to encrypt the data fragments to obtain sub-encrypted files corresponding to the data fragments.

[0125] Optionally, the encrypted file determination module 420 includes: a target verification data determination unit, an identification record file determination unit and an encryption verification file unit.

[0126] Among them, the target verification data determination unit is used to extract the verification fragment from at least two data fragments, encrypt the extracted verification fragment, and obtain the target verification data; the identification record file determination unit is used to obtain the fragment identification of each of the verification fragments, and generate an identification record file based on the fragment identification of the verification fragment; the encryption verification file unit is used to encrypt the target verification data, the identification record file and the preset classification algorithm to obtain the encrypted verification file of the target data.

[0127] Optionally, the target verification data determination unit is used to:

[0128] The extracted verification fragment is encrypted based on a message authentication code algorithm to obtain a message verification code, and the message verification code is used as target verification data.

[0129] Optionally, the data encryption method is also used for:

[0130] In response to a data decryption request for the target data, obtaining a target encrypted file of the target data;

[0131] Determine the sub-encrypted file corresponding to each type of data fragment in the data encryption file, and decrypt each sub-encrypted file to obtain each type of data fragment;

[0132] Decrypting the encrypted verification file to obtain target verification data, identification record file and preset classification algorithm of the target data;

[0133] Merging various types of data fragments according to the preset classification algorithm to obtain plaintext data;

[0134] Determine the to-be-verified segment in the plaintext data according to the segment identifier in the identification record file, and encrypt the to-be-verified segment according to the encryption method of the target verification data to obtain the to-be-verified data;

[0135] Determine whether the plaintext data is the target data according to the data to be verified and the target verification data.

[0136] The data encryption device provided in the embodiment of the present invention can execute the data encryption method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0137] Embodiment 5

[0138] Figure 8 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0139] like Figure 8 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0140] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0141] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as a data encryption method.

[0142] In some embodiments, the data encryption method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the data encryption method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the data encryption method in any other appropriate manner (e.g., by means of firmware).

[0143] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0144] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0145] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0146] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0147] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0148] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0149] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0150] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A data encryption method, characterized in that: include: Obtaining target data to be encrypted, dividing the target data into at least two data segments, and assigning a segment identifier to each data segment; generating a data encryption file of the target data according to the data fragments, and determining an encryption verification file of the target data according to the data fragments and fragment identifiers of the data fragments; Using the data encryption file and the encryption verification file as the target encryption file of the target data; The step of generating a data encryption file of the target data according to the data fragments includes: Dividing the data segments of the target data into at least two types of data segments based on a preset classification algorithm; Encrypt each type of data fragment respectively to obtain a sub-encrypted file corresponding to each type of data fragment; Merging the sub-encrypted files corresponding to the various types of data fragments to obtain the data encryption file of the target data; The step of determining the encryption verification file of the target data according to the data fragment and the fragment identifier of the data fragment includes: Extracting a verification segment from at least two data segments, and encrypting the extracted verification segment to obtain target verification data; Obtaining a segment identifier of each of the verification segments, and generating an identifier record file based on the segment identifiers of the verification segments; The target verification data, the identification record file and the preset classification algorithm are encrypted to obtain an encrypted verification file of the target data.

2. The method according to claim 1, characterized in that The method of dividing the data segments of the target data into at least two types of data segments based on a preset classification algorithm includes: A target value is randomly generated, and the data segments of the target data are divided into two types of data segments according to whether a quotient obtained by dividing the segment identifier of each data segment by the target value is an integer; or, The data segments of the target data are divided into two types of data segments according to whether the segment identifier of each data segment is an odd number or an even number.

3. The method according to claim 1, characterized in that The method of encrypting each type of data fragment respectively to obtain a sub-encrypted file corresponding to each type of data fragment includes: For different types of data fragments, different encryption algorithms are used to encrypt the data fragments to obtain sub-encrypted files corresponding to the data fragments.

4. The method according to claim 1, characterized in that: The step of encrypting the extracted verification fragment to obtain target verification data includes: The extracted verification fragment is encrypted based on a message authentication code algorithm to obtain a message verification code, and the message verification code is used as target verification data.

5. The method according to claim 1, characterized in that Also includes: In response to a data decryption request for the target data, obtaining a target encrypted file of the target data; Determine the sub-encrypted file corresponding to each type of data fragment in the data encryption file, and decrypt each sub-encrypted file to obtain each type of data fragment; Decrypting the encrypted verification file to obtain target verification data, identification record file and preset classification algorithm of the target data; Merging various types of data fragments according to the preset classification algorithm to obtain plaintext data; Determine the to-be-verified segment in the plaintext data according to the segment identifier in the identification record file, and encrypt the to-be-verified segment according to the encryption method of the target verification data to obtain the to-be-verified data; Determine whether the plaintext data is the target data according to the data to be verified and the target verification data.

6. A data encryption device, characterized in that: include: A fragment identifier allocation module, used for acquiring target data to be encrypted, dividing the target data into at least two data fragments, and respectively allocating a fragment identifier to each data fragment; an encrypted file determination module, configured to generate a data encryption file of the target data according to the data fragment, and determine an encryption verification file of the target data according to the data fragment and the fragment identifier of the data fragment; A target encryption file determination module, used for using the data encryption file and the encryption verification file as the target encryption file of the target data; Wherein, the encrypted file determination module includes: a data segment type classification unit, configured to classify the data segments of the target data into at least two types of data segments based on a preset classification algorithm; A sub-encrypted file determining unit, used to encrypt each type of data fragment respectively to obtain a sub-encrypted file corresponding to each type of data fragment; A data encryption file determination unit, used for merging sub-encryption files corresponding to various types of data fragments to obtain a data encryption file of the target data; Wherein, the encrypted file determination module includes: A target verification data determination unit, configured to extract a verification segment from at least two data segments, encrypt the extracted verification segment, and obtain target verification data; an identification record file determining unit, configured to obtain a segment identification of each of the verification segments, and generate an identification record file based on the segment identification of the verification segment; The encrypted verification file unit is used to encrypt the target verification data, the identification record file and the preset classification algorithm to obtain an encrypted verification file of the target data.

7. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the data encryption method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the data encryption method according to any one of claims 1 to 5 when executed.

Images