Data encryption and decryption method, device, storage medium and electronic equipment

Abstract

The present disclosure provides a data encryption and decryption method, device, computer program product, non-transitory computer-readable storage medium and electronic equipment. The data encryption method comprises: obtaining original data, the original data comprising at least two target fields; obtaining a first key corresponding to each target field in the at least two target fields, wherein different target fields in the at least two target fields correspond to different first keys; and encrypting each target field in the at least two target fields by using the first key corresponding to each target field in the at least two target fields to obtain encrypted data corresponding to the original data. The encryption and decryption method improves the security of the data.

Description

Technical Field

[0001] This disclosure generally relates to the field of computer technology, and more specifically to a data encryption and decryption method, apparatus, computer program product, non-transitory computer-readable storage medium, and electronic device. Background Technology

[0002] This section is intended to introduce aspects of the art that may relate to the various aspects of this disclosure described below and / or claimed. It is believed that this section will help provide background information to facilitate a better understanding of the various aspects of this disclosure. Therefore, it should be understood that these statements should be interpreted in this context and not as an admission of prior art.

[0003] With the continuous innovation and development of computer technology, while making people's lives more convenient, the issue of data security has gradually become prominent.

[0004] Currently, the most common approach to database security is to use accounts with different privileges to restrict user access to the database. This only provides basic protection. Once hackers illegally obtain database usernames and passwords, the data in the database will be completely exposed. Furthermore, many data breaches are perpetrated by company employees. Therefore, without data encryption, it is very convenient for internal employees to access information in the database.

[0005] Of course, a few companies will encrypt the target fields in the database, but they often use the same key to encrypt all the target fields, which still cannot effectively guarantee data security.

[0006] Therefore, it is necessary to propose a new data encryption and decryption scheme to alleviate or solve at least one of the above-mentioned technical problems. Summary of the Invention

[0007] The purpose of this disclosure is to provide a data encryption and decryption method, apparatus, computer program product, non-transitory computer-readable storage medium, and electronic device to improve data security.

[0008] According to a first aspect of this disclosure, a data encryption method is provided, comprising: obtaining original data, the original data including at least two target fields; obtaining a first key corresponding to each of the at least two target fields, wherein different target fields in the at least two target fields correspond to different first keys; and encrypting each of the at least two target fields using the first key corresponding to each of the at least two target fields to obtain encrypted data corresponding to the original data.

[0009] According to a second aspect of this disclosure, a data decryption method is provided, comprising: obtaining encrypted data, the encrypted data being obtained by encrypting original data, the original data including at least two target fields; obtaining a first key corresponding to each of the at least two target fields, wherein different target fields among the at least two target fields correspond to different first keys; and decrypting the encrypted data using the first key corresponding to each of the at least two target fields to obtain the original data.

[0010] According to a third aspect of this disclosure, a data encryption device is provided, comprising: a first acquisition module for acquiring original data, the original data including at least two target fields; a second acquisition module for acquiring a first key corresponding to each of the at least two target fields, wherein different target fields among the at least two target fields correspond to different first keys; and an encryption module for encrypting each of the at least two target fields using the first key corresponding to each of the at least two target fields to obtain encrypted data corresponding to the original data.

[0011] According to a fourth aspect of this disclosure, a data decryption apparatus is provided, comprising: a third acquisition module for acquiring encrypted data, the encrypted data being obtained by encrypting original data, the original data including at least two target fields; a fourth acquisition module for acquiring a first key corresponding to each of the at least two target fields, wherein different target fields among the at least two target fields correspond to different first keys; and a decryption module for decrypting the encrypted data using the first key corresponding to each of the at least two target fields to obtain the original data.

[0012] According to a fifth aspect of this disclosure, a computer program product is provided, including program code instructions that, when executed by a computer, cause the computer to perform the method described according to a first or second aspect of this disclosure.

[0013] According to a sixth aspect of this disclosure, a non-transitory computer-readable storage medium is provided storing computer instructions, wherein the computer instructions are configured to cause the computer to perform the method described according to a first or second aspect of this disclosure.

[0014] According to a seventh aspect of this disclosure, an electronic device is provided, comprising: a processor; a memory in electronic communication with the processor; and instructions stored in the memory and executable by the processor to cause the electronic device to perform the method according to a first or second aspect of this disclosure.

[0015] According to the various embodiments provided in this disclosure, different target fields are encrypted using different first keys, which ensures the isolation between different target fields. Even if the first key of some target fields is leaked, it can ensure that other target fields cannot be decrypted, thereby improving data security.

[0016] It should be understood that the content described in this section is not intended to identify key or essential features of the claimed invention, nor is it intended to be used alone to determine the scope of the claimed invention. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this disclosure or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In all drawings, the same reference numerals refer to similar but not necessarily the same elements.

[0018] Figure 1 A system architecture diagram is shown for one embodiment of the data encryption and decryption method according to this disclosure;

[0019] Figure 2A A flowchart of one embodiment of the data encryption method according to this disclosure is shown;

[0020] Figure 2B A schematic diagram illustrating the key management method of the data encryption method according to this disclosure is shown;

[0021] Figure 2C A schematic diagram of the storage structure according to the data encryption method of this disclosure is shown;

[0022] Figure 2D A schematic diagram illustrating a specific example of a data encryption method according to this disclosure is shown;

[0023] Figure 3A A flowchart of one embodiment of the data decryption method according to this disclosure is shown;

[0024] Figure 3B A schematic diagram illustrating a specific example of a data decryption method according to this disclosure is shown;

[0025] Figure 4A An exemplary block diagram of a data encryption apparatus according to an embodiment of the present disclosure is shown;

[0026] Figure 4BAn exemplary block diagram of a data decryption apparatus according to an embodiment of the present disclosure is shown;

[0027] Figure 5 A schematic diagram of an example electronic device 500 that can be used to implement embodiments of the present disclosure is shown.

[0028] Specific implementation method

[0029] The present disclosure will be described more fully below with reference to the accompanying drawings. However, the present disclosure may be embodied in many alternative forms and should not be construed as limited to the embodiments described herein. Therefore, although the present disclosure is readily adaptable to various modifications and alternatives, specific embodiments thereof are shown by way of example in the accompanying drawings and will be described in detail herein. However, it should be understood that this is not intended to limit the present disclosure to the specific forms disclosed, but rather, the present disclosure covers all modifications, equivalents, and alternatives falling within the spirit and scope of the present disclosure as defined by the claims.

[0030] It should be understood that although various elements may be described herein using terms such as first, second, etc., these elements should not be limited by these terms. These terms are used only to distinguish one element from another. For example, a first element may be referred to as a second element, and similarly, a second element may be referred to as a first element, without departing from the teachings of this disclosure.

[0031] This document describes several examples using block diagrams and / or flowcharts, where each block represents a section of circuitry, modular blocks, or code comprising one or more executable instructions for implementing a specified logical function. It should also be noted that in other implementations, the functions within a block may occur out of order. For example, depending on the functions involved, two blocks shown consecutively may actually execute substantially simultaneously, or these blocks may sometimes execute in reverse order.

[0032] The phrases “according to… embodiments” or “in… embodiments” as used herein mean that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one implementation of this disclosure. The phrases “according to… embodiments” or “in… embodiments” appearing in different places throughout this document do not necessarily refer to the same embodiment, nor are they necessarily separate or alternative embodiments that are mutually exclusive with other embodiments.

[0033] Figure 1 An exemplary system architecture 100 is shown, in which embodiments of the data encryption and decryption methods, apparatuses, terminal devices, and storage media of this disclosure can be applied.

[0034] like Figure 1As shown, system architecture 100 may include terminal devices 101, 102, and 103, a network 104, and a server 105. Network 104 serves as the medium for providing communication links between terminal devices 101, 102, and 103 and server 105. Network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0035] Users can use terminal devices 101, 102, and 103 to interact with server 105 via network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, and 103, such as voice interaction applications, video conferencing applications, short video social applications, web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0036] Terminal devices 101, 102, and 103 can be either hardware or software. When terminal devices 101, 102, and 103 are hardware, they can be various electronic devices with microphones and speakers, including but not limited to smartphones, tablets, e-book readers, MP3 players (Moving Picture Experts Group Audio Layer III), MP4 players (Moving Picture Experts Group Audio Layer IV), portable computers, and desktop computers, etc. When terminal devices 101, 102, and 103 are software, they can be installed in the aforementioned electronic devices. They can be implemented as multiple software programs or software modules, or as a single software program or software module. No specific limitations are made here.

[0037] Server 105 can be a server that provides various services, such as a backend server that processes data storage requests, data encryption requests, or data decryption requests sent by terminal devices 101, 102, and 103.

[0038] In some cases, the data encryption and decryption methods provided in this disclosure can be executed by terminal devices 101, 102, and 103. Accordingly, data encryption and decryption devices can be set in terminal devices 101, 102, and 103. In this case, system architecture 100 may not include server 105.

[0039] In some cases, the data encryption and decryption methods provided in this disclosure can be executed by server 105. Accordingly, the data encryption and decryption device can be set in server 105. In this case, system architecture 100 may not include terminal devices 101, 102, and 103.

[0040] In some cases, the data encryption and decryption methods provided in this disclosure can be jointly executed by terminal devices 101, 102, 103 and server 105, and correspondingly, data encryption and decryption devices can also be respectively set in server 105.

[0041] It should be noted that server 105 can be either hardware or software. When server 105 is hardware, it can be implemented as a distributed server cluster consisting of multiple servers, or as a single server. When server 105 is software, it can be implemented as multiple software programs or software modules (e.g., used to provide distributed services), or as a single software program or software module. No specific limitations are made here.

[0042] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0043] Figure 2 shows a flowchart of an embodiment of the data encryption method according to this disclosure. The method in this embodiment can be... Figure 1 Implemented by the terminal equipment in, or by Figure 1 The server in the middle is implemented, or by Figure 1 The terminal devices and servers in the process are implemented together.

[0044] like Figure 2A As shown, the data encryption method 200 in this embodiment includes the following steps:

[0045] Step 210: Obtain the raw data, which includes at least two target fields.

[0046] In this embodiment, the raw data may include multiple fields. Each field, as a unit of information, can be used to describe a certain characteristic of the data. For example, the raw data may be salary data, which may include fields such as employee ID, bank card number, and salary amount.

[0047] In this embodiment, the fields of the original data can be divided into ordinary fields and important fields. Ordinary fields can store information of moderate importance or sensitivity, such as the employee number mentioned above, which usually will not cause serious consequences even if leaked. Important fields can store information of high importance or sensitivity, such as the bank card number and salary amount mentioned above, which may have serious consequences if leaked. In this embodiment, only important fields can be encrypted, while ordinary fields are not encrypted. Important fields will be referred to as target fields below.

[0048] Step 220: Obtain the first key corresponding to each of the at least two target fields, wherein different target fields in the at least two target fields correspond to different first keys.

[0049] In this embodiment, the first key is used to encrypt and decrypt the original data.

[0050] In this embodiment, the algorithm for generating the first key is not limited, such as DES (Data Encryption Standard), IDEA (International Data Encryption Algorithm), RSA (an encryption algorithm proposed by Ron Rivest, Adi Shamir and Leonard Adleman), DSA (Digital Signature Algorithm), etc.

[0051] For different target fields, the algorithm for generating the corresponding first key can be the same or different. The goal is to ensure that different target fields correspond to different first keys.

[0052] In this embodiment, the timing of the first key generation is not limited. The first key can be generated after the original data is acquired. Alternatively, if the field information of the original data is known, the first key can also be generated before the original data is acquired.

[0053] Step 230: Using the first key corresponding to each of the at least two target fields, encrypt each of the at least two target fields to obtain the encrypted data corresponding to the original data.

[0054] In this embodiment, for each target field, it is encrypted using the first key corresponding to that target field to obtain the encryption result corresponding to that target field. The encryption results corresponding to each target field together constitute the encrypted data corresponding to the original data.

[0055] In this embodiment, different target fields are encrypted using different first keys, ensuring the isolation between different target fields. Even if the first key of some target fields is leaked, it can still ensure that other target fields cannot be decrypted, thereby improving data security.

[0056] Figure 2BA schematic diagram of the key management method of the data encryption method according to this disclosure is shown. In an exemplary embodiment, as shown in Figure 2, during the encryption phase, the user can specify a key identifier for each target field. In this embodiment, the execution entity of the method generates a first key corresponding to each key identifier and records the correspondence between the target field and the first key, such as "field 1 - key 1", "field 2 - key 2", etc. During the decryption phase, the execution entity of the method in this embodiment obtains the corresponding first key according to the field identifier and decrypts the data accordingly.

[0057] In an optional embodiment, the algorithm for generating the first key can be an asymmetric encryption algorithm, such as the RSA algorithm. In this case, the first key may include a first public key and a first private key. The first public key is used to encrypt the original data or target field. The first private key is used to decrypt the encrypted original data or target field. The first public key and the first private key form a key pair. In step 230, each of the at least two target fields can be encrypted using the first public key corresponding to each target field.

[0058] In an optional embodiment, the complexity of the first key corresponding to the target field can be set according to the importance of the target field. For example, if there are at least two target fields, including a first target field and a second target field, and the importance of the first target field is higher than that of the second target field, then the complexity of the first key corresponding to the first target field is higher than that of the first key corresponding to the second target field.

[0059] Different target fields may have varying degrees of importance or sensitivity. For example, the "bank card password" field is obviously more important or sensitive than the "bank card number" field. This embodiment sets the complexity of the first key corresponding to the target field based on its importance, which increases the difficulty of cracking the key for highly important target fields, further improving data security.

[0060] In an optional embodiment, the first key can be further encrypted. In this case, step 220 may include: obtaining a second key; and using the second key to decrypt the encrypted first key to obtain the first key.

[0061] In this embodiment, the second key is used to encrypt and decrypt the first key. The second key can be used to encrypt all of the first key, and can also be called the master key.

[0062] The algorithm for generating the second key can be the same as or different from the algorithm for generating the first key. Optionally, the algorithm for generating the second key can be the same as the algorithm for generating the first key. Optionally, the algorithm for generating the second key can be an asymmetric encryption algorithm. In this case, the second key can further include a second public key (or a master public key) and a second private key (or a master private key). The second public key is used to encrypt the first key (optionally, including the first public key and the first private key). The second private key is used to decrypt the encrypted first key (optionally, including the first public key and the first private key). The second public key and the second private key form a master key pair.

[0063] In this embodiment, by adding another layer of encryption to the first key, the security of the data can be further improved.

[0064] In an optional embodiment, the encrypted data, the first key, and the second key can be stored in different storage entities. These storage entities can be physical entities, such as storage devices, or virtual entities, such as storage services.

[0065] Figure 2C A schematic diagram of a storage structure according to the data encryption method of this disclosure is shown. For example, as... Figure 2C As shown, encrypted data can be stored in a database, the first key (including the first public key and the first private key) can be stored in a key store, and the second key (including the second public key and the second private key) can be stored in a key management service (KMS). Within the key management system, the stored keys can be retrieved via an interface after authentication.

[0066] In this embodiment, the encrypted data, the first key, and the second key are stored in different locations, which increases the difficulty of obtaining all three at the same time and further improves the security of the data.

[0067] Figure 2D A schematic diagram illustrating a specific example of a data encryption method according to this disclosure is shown. In this example, such as Figure 2D As shown, firstly, after the user submits the original data, the executing entity of the method in this embodiment obtains the encrypted first public key from the key store, obtains the master private key from the key management system, and decrypts the encrypted first public key using the master private key to obtain the decrypted first public key. Secondly, the executing entity of the method in this embodiment uses the decrypted first public key to encrypt the original data to obtain encrypted data, wherein different target fields in the original data correspond to different first public keys. Finally, the executing entity of the method in this embodiment stores the encrypted data in the database.

[0068] Figure 3AA flowchart illustrating an embodiment of the data decryption method according to this disclosure is shown. The method in this embodiment can be... Figure 1 Implemented by the terminal equipment in, or by Figure 1 The server in the middle is implemented, or by Figure 1 The terminal devices and servers in the process are implemented together.

[0069] like Figure 3A As shown, the data decryption method 300 in this embodiment includes the following steps:

[0070] Step 310: Obtain encrypted data. The encrypted data is obtained by encrypting the original data, which includes at least two target fields.

[0071] Step 320: Obtain the first key corresponding to each of the at least two target fields, wherein different target fields in the at least two target fields correspond to different first keys.

[0072] Step 330: Decrypt the encrypted data using the first key corresponding to each of the at least two target fields to obtain the original data.

[0073] In an optional embodiment, the complexity of the first key corresponding to the target field can be set according to the importance of the target field. For example, if there are at least two target fields, including a first target field and a second target field, and the importance of the first target field is higher than that of the second target field, then the complexity of the first key corresponding to the first target field is higher than that of the first key corresponding to the second target field.

[0074] In an optional embodiment, the algorithm for generating the first key can be an asymmetric encryption algorithm, such as the RSA algorithm. In this case, the first key may include a first public key and a first private key. The first public key is used to encrypt the original data or the target field. The first private key is used to decrypt the encrypted original data or the target field. The first public key and the first private key form a key pair. In step 330, the encrypted data can be decrypted using the first private key corresponding to each of at least two target fields.

[0075] In an optional embodiment, the first key can be further encrypted. In this case, step 320 may include: obtaining a second key; and using the second key to decrypt the encrypted first key to obtain the first key.

[0076] In an optional embodiment, the algorithm for generating the second key can be an asymmetric encryption algorithm. In this case, the second key further includes a second public key (or a master public key) and a second private key (or a master private key). The second public key is used to encrypt the first key (optionally, including the first public key and the first private key). The second private key is used to decrypt the encrypted first key (optionally, including the first public key and the first private key). The second public key and the second private key form a master key pair.

[0077] In an optional embodiment, the encrypted data, the first key, and the second key can be stored in different storage entities.

[0078] Figure 3B A schematic diagram illustrating a specific example of a data decryption method according to this disclosure is shown. In this example, such as Figure 3B As shown, firstly, after the user submits the original query request, the execution entity of this embodiment retrieves encrypted data from the database, an encrypted first private key from the key store, and a master private key from the key management system. It then uses the master private key to decrypt the encrypted first private key, obtaining a decrypted first private key. Secondly, the execution entity uses the decrypted first private key to decrypt the encrypted data, obtaining the original data. Different target fields in the original data correspond to different first private keys. Finally, the execution entity returns the original data to the user.

[0079] Figure 4A An exemplary block diagram of a data encryption apparatus according to embodiments of the present disclosure is shown. Figure 4A As shown, the data encryption device 410 includes: a first acquisition module 411 for acquiring original data, the original data including at least two target fields; a second acquisition module 412 for acquiring a first key corresponding to each of the at least two target fields, wherein different target fields in the at least two target fields correspond to different first keys; and an encryption module 413 for encrypting each of the at least two target fields using the first key corresponding to each of the at least two target fields to obtain encrypted data corresponding to the original data.

[0080] In an optional embodiment, at least two target fields include a first target field and a second target field, wherein the first target field is more important than the second target field, and the complexity of the first key corresponding to the first target field is higher than the complexity of the first key corresponding to the second target field.

[0081] In an optional embodiment, the first key corresponding to each of the at least two target fields includes a first public key and a first private key; and the encryption module 413 is further configured to: encrypt each of the at least two target fields using the first public key corresponding to each of the at least two target fields.

[0082] In an optional embodiment, the second acquisition module 412 is further configured to: acquire a second key; and use the second key to decrypt the encrypted first key to obtain the first key.

[0083] In an optional embodiment, the second key includes a second public key and a second private key; and the second acquisition module 412 is further configured to: decrypt the encrypted first key using the second public key.

[0084] In an optional embodiment, the first key is stored in a first storage entity, the second key is stored in a second storage entity; and the data encryption device further includes a storage module for storing encrypted data in a third storage entity.

[0085] Figure 4B An exemplary block diagram of a data decryption apparatus according to embodiments of the present disclosure is shown. Figure 4B As shown, the data decryption device 420 includes: a third acquisition module 421, used to acquire encrypted data, which is obtained by encrypting the original data, the original data including at least two target fields; a fourth acquisition module 422, used to acquire a first key corresponding to each of the at least two target fields, wherein different target fields in the at least two target fields correspond to different first keys; and a decryption module 423, used to decrypt the encrypted data using the first key corresponding to each of the at least two target fields to obtain the original data.

[0086] In an optional embodiment, at least two target fields include a first target field and a second target field, wherein the first target field is more important than the second target field, and the complexity of the first key corresponding to the first target field is higher than the complexity of the first key corresponding to the second target field.

[0087] In an optional embodiment, the fourth acquisition module 422 is further configured to: acquire a second key; and use the second key to decrypt the encrypted first key to obtain the first key.

[0088] In an optional embodiment, the second key includes a second public key and a second private key; and the fourth acquisition module 422 is further configured to: decrypt the encrypted first key using the second private key.

[0089] In an optional embodiment, the first key includes a first public key and a first private key; and the decryption module 423 is further configured to: decrypt the encrypted data using the first private key corresponding to each of the at least two target fields.

[0090] In an optional embodiment, the encrypted data, the first key, and the second key are located in different storage entities.

[0091] It should be understood that Figure 4A and Figure 4B The various modules of the devices 410 and 420 shown can be used with reference to Figure 2A Method 200 and described Figure 3A The various steps in method 300 are described above. Therefore, the operations, features, and advantages described above for methods 200 and 300 also apply to apparatus 410 and 420 and their included modules. For the sake of brevity, some operations, features, and advantages will not be repeated here.

[0092] Figure 5 A schematic block diagram of an example electronic device 500 that can be used to implement embodiments of the present disclosure is shown. See also Figure 5 The present invention describes a structural block diagram of an electronic device 500 that can serve as a server or client of the present disclosure, which is an example of a hardware device that can be applied to various aspects of the present disclosure. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein. Figure 5As shown, the electronic device 500 includes a computing unit 501, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 502 or a computer program loaded from a storage unit 508 into a random access memory (RAM) 503. The RAM 503 may also store various programs and data required for the operation of the device 500. The computing unit 501, ROM 502, and RAM 503 are interconnected via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504. Multiple components in the device 500 are connected to the I / O interface 505, including: an input unit 706, such as a keyboard, mouse, etc.; an output unit 507, such as various types of displays, speakers, etc.; a storage unit 508, such as a disk, optical disk, etc.; and a communication unit 509, such as a network card, modem, wireless transceiver, etc. The communication unit 509 allows the device 500 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0093] The computing unit 501 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 501 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 501 performs the various methods and processes described above, such as data encryption and decryption methods. For example, in some embodiments, the data encryption and decryption methods may be implemented as computer software programs tangibly contained in a machine-readable medium, such as storage unit 508. In some embodiments, part or all of the computer program may be loaded and / or installed on device 500 via ROM 502 and / or communication unit 509. When the computer program is loaded into RAM 503 and executed by the computing unit 501, one or more steps of the data encryption and decryption methods described above may be performed. Alternatively, in other embodiments, the computing unit 501 may be configured to perform data encryption and decryption methods by any other suitable means (e.g., by means of firmware).

[0094] The various illustrative logics, logic blocks, modules, circuits, and algorithmic processes described in conjunction with the aspects disclosed herein can be implemented as electronic hardware, computer software, or a combination of both. The interchangeability of hardware and software has been generally described in terms of functionality and illustrated in the aforementioned illustrative components, blocks, modules, circuits, and processes. Whether this functionality is implemented in hardware or software depends on the specific application and the design constraints on the overall system.

[0095] Hardware and data processing apparatuses for implementing the various illustrative logics, logic blocks, modules, and circuits described in conjunction with the aspects disclosed herein may be implemented or performed by general-purpose single-chip or multi-chip processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs) or other programmable logic devices, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A general-purpose processor may be a microprocessor or any conventional processor, controller, microcontroller, or state machine. A processor may also be implemented as a combination of computing devices, such as a combination of a DSP and a microprocessor, multiple microprocessors, one or more microprocessors combined with a DSP core, or any other such configuration. In some aspects, specific processes and methods may be performed by circuits specific to a given function.

[0096] In one or more aspects, the described functionality can be implemented in hardware, digital electronic circuits, computer software, firmware (including the structures disclosed in this specification and their equivalents) or any combination thereof. The aspects of the subject matter described in this specification can also be implemented as one or more computer programs, i.e., one or more modules of computer program instructions encoded on a computer storage medium for execution by a data processing apparatus or for controlling the operation of a data processing apparatus.

[0097] If implemented in software, the functionality can be stored or transferred as one or more instructions or code onto a computer-readable medium. The processes of the methods or algorithms disclosed herein can be implemented in a processor-executable software module that may reside on a computer-readable medium. Computer-readable media include computer storage media and communication media, including any medium capable of transferring a computer program from one place to another. Storage media can be any available medium accessible to a computer. By way of example and not limitation, this computer-readable medium may include RAM, ROM, EEPROM, CD-ROM or other optical disc storage, disk storage or other magnetic storage devices, or any other medium that can be used to store the required program code in the form of instructions or data structures and is accessible to a computer. Furthermore, any connection can be properly referred to as a computer-readable medium. The disks and discs used herein include high-density optical discs (CDs), laser discs, optical discs, digital versatile discs (DVDs), floppy disks, and Blu-ray discs, wherein disks typically magnetically copy data, while discs optically copy data using lasers. Combinations of the above should also be included within the scope of computer-readable media. Additionally, the operation of a method or algorithm may be one or any combination or set of code and instructions on machine-readable and computer-readable media, which may be incorporated into a computer program product.

[0098] The various embodiments in this disclosure are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the device embodiments, equipment embodiments, computer-readable storage medium embodiments, and computer program product embodiments are basically similar to the method embodiments, so the descriptions are relatively simple, and relevant parts can be referred to the descriptions of the method embodiments.

Claims

1. A data encryption method, comprising: Obtain the raw data, which includes at least two target fields; Obtain a first key corresponding to each of the at least two target fields, wherein different target fields among the at least two target fields correspond to different first keys; Using the first key corresponding to each of the at least two target fields, each of the at least two target fields is encrypted to obtain the encrypted data corresponding to the original data; The first key is obtained by decrypting the encrypted first key using the second key; Wherein, the first key is stored in the first storage entity, and the second key is stored in the second storage entity; and The method further includes: The encrypted data is stored in a third storage entity.

2. The method according to claim 1, wherein, The at least two target fields include a first target field and a second target field, wherein the first target field is more important than the second target field, and the complexity of the first key corresponding to the first target field is higher than the complexity of the first key corresponding to the second target field.

3. The method according to claim 1, wherein, The first key corresponding to each of the at least two target fields includes a first public key and a first private key; as well as The step of encrypting each of the at least two target fields using the first key corresponding to each of the at least two target fields includes: Each of the at least two target fields is encrypted using the first public key corresponding to each target field.

4. The method according to claim 1, wherein, Obtaining the first key corresponding to each of the at least two target fields includes: Obtain the second key; The first key is decrypted using the second key to obtain the first key.

5. The method according to claim 4, wherein, The second key includes a second public key and a second private key; as well as The step of decrypting the encrypted first key using the second key includes: The encrypted first key is decrypted using the second public key.

6. A data decryption method, the method comprising: Obtain encrypted data, which is obtained by encrypting the original data, wherein the original data includes at least two target fields; Obtain the first key corresponding to each of the at least two target fields, wherein different target fields in the at least two target fields correspond to different first keys; The encrypted data is decrypted using the first key corresponding to each of the at least two target fields to obtain the original data; The first key is obtained by decrypting the encrypted first key using the second key; The encrypted data, the first key, and the second key are located in different storage entities.

7. The method according to claim 6, wherein, The at least two target fields include a first target field and a second target field, wherein the first target field is more important than the second target field, and the complexity of the first key corresponding to the first target field is higher than the complexity of the first key corresponding to the second target field.

8. The method according to claim 6, wherein, Obtaining the first key corresponding to each of the at least two target fields includes: Obtain the second key; use the second key to decrypt the encrypted first key to obtain the first key.

9. The method according to claim 8, wherein, The second key includes a second public key and a second private key; as well as The step of decrypting the encrypted first key using the second key includes: The encrypted first key is decrypted using the second private key.

10. The method according to claim 6, wherein, The first key includes a first public key and a first private key; as well as The step of decrypting the encrypted data using the first key corresponding to each of the at least two target fields includes: The encrypted data is decrypted using the first private key corresponding to each of the at least two target fields.

11. A data encryption device, comprising: The first acquisition module is used to acquire raw data, which includes at least two target fields. The second acquisition module is used to acquire the first key corresponding to each of the at least two target fields. Wherein, different target fields in the at least two target fields correspond to different first keys; An encryption module is used to encrypt each of the at least two target fields using the first key corresponding to each of the at least two target fields to obtain encrypted data corresponding to the original data. The first key is obtained by decrypting the encrypted first key using the second key; Wherein, the first key is stored in the first storage entity, and the second key is stored in the second storage entity; and The data encryption device also includes a storage module for: The encrypted data is stored in a third storage entity.

12. A data decryption device, comprising: The third acquisition module is used to acquire encrypted data, which is obtained by encrypting the original data, and the original data includes at least two target fields. The fourth acquisition module is used to acquire the first key corresponding to each of the at least two target fields, wherein different target fields in the at least two target fields correspond to different first keys; The decryption module is used to decrypt the encrypted data using the first key corresponding to each of the at least two target fields to obtain the original data; The first key is obtained by decrypting the encrypted first key using the second key; The encrypted data, the first key, and the second key are located in different storage entities.

13. A computer program product comprising program code instructions that, when executed by a computer, cause the computer to perform the method of at least one of claims 1-10.

14. A non-transitory computer-readable storage medium storing computer instructions, wherein, The computer instructions are used to cause the computer to perform the method according to at least one of claims 1-10.

15. An electronic device comprising: processor, A memory that communicates electronically with the processor; as well as Instructions, which are stored in the memory and can be executed by the processor, to cause the electronic device to perform the method according to at least one of claims 1-10.

Images