A data encryption and decryption method based on data classification and grading

Abstract

The present invention relates to a data encryption and decryption method based on data classification and grading, and belongs to the field of data security. The data encryption and decryption method of the present invention includes four parts: data classification and categorization management, query statement preprocessing, secure cryptographic services, data storage and data transmission. The present invention provides a method for data encryption and decryption based on data classification and grading, which enhances the security of data in storage and transmission. The key is managed by the system, eliminating the possibility of human leakage of the key. At the same time, data is managed by classification and grading, and different key groups and encryption algorithms are used for different classifications and grades to further ensure the security of the data. In addition to being used for data classification and grading, the method provided by the secure cryptographic service of the present invention can be used for data security storage and secure transmission in various forms such as data middle platform, big data, and data lake.

Description

Technical Field

[0001] The present invention belongs to the field of data security, and in particular relates to a data encryption and decryption method based on data classification and grading. Background Art

[0002] With the application of informatization, cloud computing, Internet of Things, artificial intelligence and other new technologies, the interconnection of all things has become a trend. Everyone is generating a lot of data every moment. The leakage of sensitive data in these data has brought more and more troubles and harm to business entities, and even more serious damage to the interests of society and the country. The reasons are: ① poor security awareness and lack of necessary confidentiality awareness; ② most of them are stored in relational databases, big data platforms, NoSQL databases, and file systems in plain text, and "suspicious" people can easily obtain sensitive data. In view of this, the conventional practice is to use passwords to ensure data security, but the problems with these practices are: ① using fixed passwords, there is a risk of being cracked; ② the password is in the hands of a few people, there is a risk of leakage, loss, and forgetting; ③ for relational databases, encrypting fields affects query (encrypted data cannot be matched by keyword query) and convenience of use; ④ during data transmission, when decrypting, the password will be leaked, which will cause the risk of leakage of other data; in view of this, a new way of data security governance needs to be introduced. Summary of the invention

[0003] 1. Technical issues to be resolved

[0004] The technical problem to be solved by the present invention is how to provide a data encryption and decryption method based on data classification and grading to solve the security management problem of data classification and grading, the risk of cracking caused by the uniqueness of the key, the risk of key leakage caused by the key being in the hands of a few people, the problem of querying encrypted fields based on keywords in relational database queries, and the risk of key leakage in data transmission, thereby ensuring the security of data during storage and transmission.

[0005] (II) Technical solution

[0006] In order to solve the above technical problems, the present invention proposes a data encryption and decryption method based on data classification and grading, which includes: data classification and grading management service, query statement preprocessing service, security password service service, and data storage and data transmission service;

[0007] Data classification and grading management services:

[0008] The data classification and grading management service is to classify data according to multiple dimensions through classification methods, and then manage the classified data according to confidentiality levels to form a data classification and grading result set; at the same time, it determines whether the data objects and data fields of the data objects in the classified data are encrypted, triggers the expansion of data fields, adds the [field name]_mw field, and encrypts the data objects;

[0009] Query statement preparation service:

[0010] Preprocessing of query statements to process plain text data in INSERT, SELECT, UPDATE, DELETE statements and their combined or nested statements;

[0011] For INSERT statements, first traverse all the plaintext data fields to be inserted, and take the data object and data field to the data classification and grading result set to determine whether it is an encrypted field. If it is an encrypted field, get the message digest of the plaintext data, and then pass the data subject identifier, message digest, and plaintext data to the security password service for encryption. Modify the INSERT statement again, insert the encrypted field in the original statement into the message digest, add the mw field, and insert the encrypted ciphertext;

[0012] For SELECT, UPDATE, and DELETE statements, traverse the data objects and data fields involved. If the data classification and grading management service determines that it is an encrypted field, and the queried data item is a plaintext field, obtain the message digest of the plaintext field and replace the original plaintext with the message digest.

[0013] Secure Password Services:

[0014] The secure password service implements encryption and decryption of data objects and manages algorithms and keys in a pooled form. When using the secure password service for encryption and decryption, you need to provide the subject ID, message digest, confidentiality level, and plaintext / ciphertext. If the subject ID is not specified, the default subject ID is used.

[0015] Data storage and data transfer services:

[0016] Data storage refers to the storage form of structured data and unstructured data when using data classification and hierarchical management. For data objects that need to be encrypted, structured data stores the original fields in two columns, one column is a message digest of the original data, and the other column is the [original field name]_mw field, which stores the ciphertext data. At the same time, the main body and confidentiality level of the data are stored in the metadata. For unstructured data, the message digest, main body data and confidentiality level of the original data are stored in the metadata.

[0017] Data transmission services include data encryption transmission process and data decryption process;

[0018] In data encryption transmission, first encrypt the data with the data classification level, plaintext summary and subject identification, and then transmit the data according to the transmission channel corresponding to the classification level of the data; the transmission channel corresponding to the classification level is defined by the business, and the highest classification level is public, and internal data is transmitted through http and ftp network protocols. For secret data, it is transmitted through https and sftp. For confidential data, a digital envelope generated by the national secret algorithm is used for transmission in a private network. For top secret data, a digital envelope generated by biometrics + national secret algorithm is used for transmission in a private network.

[0019] The decryption process of the received data during data transmission is to obtain the data confidentiality level, plaintext summary and body from the metadata; there will be cross-level, cross-network and cross-domain transmission during data transmission. Under the condition of ensuring the absolute security of the data, after being authenticated by three super administrator U-shields kept by three different personnel, namely the system administrator, audit administrator and security administrator, a national secret security channel is established between the two local security password services for data synchronization, and the data will not be dropped during the synchronization process.

[0020] (III) Beneficial effects

[0021] The present invention proposes a data encryption and decryption method based on data classification and grading. The present invention provides a method for data encryption and decryption based on data classification and grading, which strengthens the security of data in storage and transmission. The key is managed by the system, eliminating the possibility of human leakage of the key. At the same time, data is managed by classification and grading, and different key groups and encryption algorithms are used for different classifications and grades to further ensure the security of the data. In addition to being used for data classification and grading, the method provided by the security password service in this method can be used for data security storage and secure transmission in various forms such as data middle platform, big data, and data lake. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 This is a schematic diagram of the data encryption and decryption system architecture based on data classification and grading of the present invention;

[0023] Figure 2 Encryption process for data;

[0024] Figure 3 Review the process for data;

[0025] Figure 4 Flow chart for data encryption transmission;

[0026] Figure 5 It is the process of decrypting received data during data transmission. DETAILED DESCRIPTION

[0027] In order to make the purpose, content and advantages of the present invention more clear, the specific implementation methods of the present invention are further described in detail below in conjunction with the drawings and examples.

[0028] The schematic diagram of the data encryption and decryption system architecture based on data classification and grading is as follows Figure 1 shown.

[0029] The present invention provides a data encryption and decryption method based on data classification and grading, comprising four parts: data classification and grading management, query statement preprocessing, security password service, data storage and data transmission.

[0030] (1) Data classification and grading management services

[0031] Data classification and grading management service is to classify data according to multiple dimensions such as technical processing, business application, privacy protection, etc. through line classification, surface classification, hybrid classification and other methods, and then manage the classified data according to the confidentiality level to form a data classification and grading result set. In addition to realizing data classification and grading functions, data classification and grading management also determines whether the data objects and data fields of the data objects in the classified data are encrypted, triggers "Start task for data security processing" to expand the data field, add the [field name]_mw field, and encrypt the data object. Figure 1 ① indicates that “data classification and grading management” needs to be done before the system starts running; ⑩ indicates the reference result after data classification and grading management, and the confidentiality level of the data is written into the result set.

[0032] Note: Different confidentiality levels are defined according to the data itself. Classified data is a relatively large concept, referring to the classified data itself. Data object refers to a specific object in the classified data. For the classification of structured data, it can be a table, and the data field represents the data attribute. For unstructured data, it can be a document, and the data field is the attribute of the document... A classified data contains multiple data objects. For example, an unstructured classification contains multiple documents. Figure 1 The "Data Classification and Grading Reference Result Set" defines different confidentiality levels for one or more data objects under the unstructured classification.

[0033] (2) Query statement preprocessing service

[0034] Preprocessing of query statements to realize the processing of plaintext data in simple statements such as INSERT, SELECT, UPDATE, DELETE and their combination or nested statements. For INSERT statements, first traverse all plaintext data fields to be inserted, and take the data objects and data fields to the data classification and grading result set to determine whether they are encrypted fields. If they are encrypted fields, take the message digest (md5, sha, or sm3 using the national secret algorithm) of the plaintext data, and then pass the data subject's identifier, message digest, and plaintext data to the security password service for encryption, re-modify the INSERT statement, insert the encrypted field in the original statement into the message digest, add the mw field (for example, the original field name _mw), and insert the encrypted ciphertext; for SELECT, UPDATE, and DELETE statements, traverse the data objects and data fields involved, and determine that it is an encrypted field through the data classification and grading management service. If the queried data item is a plaintext field, take the message digest (md5, sha, or sm3 using the national secret algorithm) of the plaintext field and replace the original plaintext with the message digest. Figure 1 ③ in it indicates providing query statement preprocessing function for business applications.

[0035] (3)Secure Password Service

[0036] The secure password service implements encryption and decryption of data objects, and manages algorithms and keys in a pooled form. When using the encryption and decryption functions of the secure password service, you need to provide the subject identifier, message digest, confidentiality level, and plaintext / ciphertext. If the subject identifier is not specified, the default subject identifier is used. The subject identifier is used to indicate which subject the data belongs to. The secure password service can specify the key pool size corresponding to each algorithm, and can also upload custom encryption and decryption algorithms. Figure 1 ⑥ and ⑨ in it indicate that the security cryptographic service provides encryption and decryption services for business applications and data classification and grading management respectively. Figure 1 In Get the key. Figure 1 ⑦ in the figure provides the function of viewing the key, which is used in the debugging stage.

[0037] 1) Algorithm Pool

[0038] The key fields of the algorithm pool are group id, algorithm id, algorithm and confidentiality level. The default group size (GROUP_SIZE) of the algorithm pool is 1024, and the group value range is between 1000 and 2024. Each group has 4 confidentiality levels, namely internal, secret, confidential, and top secret. The default algorithm pool size (ALGORITHM_POOL_SIZE) of each confidentiality level is 8. The algorithm pool contains a collection of all algorithms. The same algorithm is allowed to appear in the algorithm pool of the same confidentiality level. The subject identifier is converted into a large number according to the first algorithm, and the modulus of GROUP_SIZE is taken (the large number is divided by GROUP_SIZE, and the remainder is taken) to obtain the subject No. The subject No is added to 1000 to obtain the group id to which the subject identifier currently belongs; the encoding rule of the algorithm ID is group id + confidentiality level + algorithm No. The confidentiality levels are represented by 1, 2, 3, 4, and 5 from public, internal, secret, confidential, and top secret respectively. The value range of the algorithm No is from 0 to ALGORITHM_POOL_SIZE. The calculation method is to convert the message digest into a large number according to the first algorithm and then take the modulus of ALGORITHM_POOL_SIZE to obtain the algorithm No., such as Figure 1 middle Schematic diagram of the algorithm pool. Each subject has a different algorithm pool, which is lazy loaded, that is, generated and loaded when used. The algorithm pool used by each subject can be pre-specified and configured in the system, or a custom algorithm can be loaded into the secure password service.

[0039] 2) Key Pool

[0040] The key fields of the key pool are algorithm id, key id and key. The algorithm id comes from the algorithm pool. The default size of the key pool (CIPHER_POOL_SIZE) of each algorithm is 32. The key id is a number between 0 and CIPHER_POOL_SIZE. The key of the key pool corresponds to the algorithm. Each algorithm has a corresponding key pool, and the keys in the key pool are different. Figure 1 middle Key pool diagram.

[0041] 3) Data encryption and decryption

[0042] Obtain subject grouping (corresponding to) by subject identification, confidentiality level and message digest (plain text) Figure 1The group id of the algorithm pool), key number and algorithm. ① Obtain the group id through the subject flag: If there is no subject identifier, the default subject flag (DEFAULT_ENTITY) can be used. A large number is obtained by adding a fixed disturbance value (salt) to the subject flag to make a message digest. The modulus of the large number (the large number is divided by GROUP_SIZE and the remainder is taken) to obtain the group id. If the algorithm pool corresponding to the subject is empty, the algorithm pool and the key pool of the corresponding algorithm are generated according to the predetermined configuration strategy. ② Obtain the algorithm and key number through the (plaintext) message digest: add a fixed disturbance value (salt) to the message digest and then process it to get a large number. Take the modulus of the large number (dividing the large number by ALGORITHM_POOL_SIZE and taking the remainder) to get the algorithm No. Obtain the algorithm id through the group id, confidentiality level and algorithm No. ③ Obtain the key number through the (plaintext) message digest: add a fixed disturbance value (salt, different from the salt used in the algorithm) to the message digest and then process it to get a large number. Take the modulus of the large number (dividing the large number by CIPHER_POOL_SIZE and taking the remainder) to get the key id. Obtain the key through the algorithm id and key id. If it is encryption, use the obtained algorithm and key to encrypt the plaintext data; if it is decryption, use the obtained algorithm and key to decrypt the ciphertext data.

[0043] (4) Data storage

[0044] Data storage refers to the storage form of structured data and unstructured data (taking distributed files as an example, other video, audio, pictures, etc. are similar) when using data classification and hierarchical management. For data objects that need to be encrypted, the data storage of structured data and unstructured data is slightly different. ① Structured data stores the original field in two columns. One column is a message digest of the original data (md5, sha, or sm3 using the national encryption algorithm), and the other column is the [original field name]_mw field, which stores the ciphertext data. At the same time, the subject and confidentiality level of the data are stored in the metadata. See Figure 1 In Storage data for structured data, ② For unstructured data, the metadata stores the message digest (md5, sha, or sm3 using the national secret algorithm), main data, and confidentiality level of the original data, see above. Figure 1 middle shown.

[0045] (5) Process description

[0046] The process description includes data encryption process, data viewing process, data encryption transmission, and decryption of received data during data transmission.

[0047] 1) Data encryption process

[0048] Data encryption process Figure 2 shown.

[0049] After the data is classified and graded, the data security processing task is started to enter the data object or file encryption process. If the subject identifier is empty, the default subject identifier DEFAULT_ENTITY is taken. If the subject identifier is not empty, the algorithm id and the corresponding algorithm are obtained by calculating the subject mark, plaintext message digest, and confidentiality level; the key id is calculated by calculating the plaintext message digest according to the calculation strategy for obtaining the key id, and the key is obtained according to the algorithm id and key id. The algorithm and key are used to encrypt the data object or file, and the ciphertext and (plaintext) message digest are saved.

[0050] 2) Data viewing process

[0051] Data viewing process is as follows Figure 3 shown.

[0052] When you need to query or view data, you need to determine whether the user has the authority to view the data through the user level and data level. For structured data, you need to pre-process the query statement, specifically to query whether the data is encrypted and the encrypted data object in the data classification and grading service or the associated metadata. For encrypted data objects that appear in plain text in the query statement, they need to be replaced with message digests, and then the query is executed to obtain the query results. The decryption process for structured data and unstructured data is the same. The algorithm id and key id are calculated and obtained through the subject mark, confidentiality level, and plaintext message digest, and then the decryption algorithm and key are obtained. The decryption algorithm and key are used to decrypt the data and view the plaintext data.

[0053] 3) Data encryption transmission

[0054] Data encryption transmission flow chart as follows Figure 4 shown.

[0055] In data encryption transmission, the data is first encrypted with the data classification level, plaintext summary and subject identification, and then the data is transmitted according to the transmission channel corresponding to the data classification level. Figure 2 The encryption process is consistent. The transmission channel corresponding to the confidentiality level is generally defined by the business. In terms of technical implementation, the highest confidentiality level is public, and internal data can be transmitted through conventional network protocols, such as http, ftp, etc. Secret data is transmitted through https and sftp. For confidential data, digital envelopes generated by national secret algorithms (physical U shields) are transmitted on private networks. For top secret data, digital envelopes generated by biometrics (facial features, fingerprints, corneas, etc.) + national secret algorithms (physical U shields) are transmitted on private networks.

[0056] 4) Decryption of received data during data transmission

[0057] The process of decrypting received data during data transmission is as follows: Figure 5 shown.

[0058] The decryption process of received data during data transmission is to obtain the data classification level, plaintext summary and body from metadata. The specific decryption process is the same as Figure 3 The decryption process is consistent. In data transmission, there may be cross-level, cross-network, and cross-domain transmission. Under the condition of ensuring absolute data security, after three super administrator U shields kept by three different personnel (system administrator, audit administrator, and security administrator), a national secret security channel is established between two local security password services for data synchronization, and the data does not fall to the ground during the synchronization process.

[0059] The present invention provides a method for data encryption and decryption based on data classification and grading, which enhances the security of data in storage and transmission. The key is managed by the system, eliminating the possibility of human leakage of the key. At the same time, data is managed by classification and grading, and different key groups and encryption algorithms are used for different classifications and grades to further ensure the security of the data. In addition to being used for data classification and grading, the method provided by the security password service in this method can be used for data security storage and secure transmission in various forms such as data middle platform, big data, and data lake.

[0060] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A data encryption and decryption method based on data classification and grading, characterized in that: The method includes: data classification and management services, query statement preprocessing services, security password services, and data storage and data transmission services; Data classification and grading management services: The data classification and grading management service is to classify data according to multiple dimensions through classification methods, and then manage the classified data according to confidentiality levels to form a data classification and grading result set; at the same time, it determines whether the data objects and data fields of the data objects in the classified data are encrypted, triggers the expansion of data fields, adds the [field name]_mw field, and encrypts the data objects; Query statement preparation service: Preprocessing of query statements to process plain text data in INSERT, SELECT, UPDATE, DELETE statements and their combined or nested statements; For INSERT statements, first traverse all the plaintext data fields to be inserted, and take the data object and data field to the data classification and grading result set to determine whether it is an encrypted field. If it is an encrypted field, get the message digest of the plaintext data, and then pass the data subject identifier, message digest, and plaintext data to the security password service for encryption. Modify the INSERT statement again, insert the encrypted field in the original statement into the message digest, add the mw field, and insert the encrypted ciphertext; For SELECT, UPDATE, and DELETE statements, traverse the data objects and data fields involved. If the data classification and grading management service determines that it is an encrypted field, and the queried data item is a plaintext field, obtain the message digest of the plaintext field and replace the original plaintext with the message digest. Secure Password Services: The secure password service implements encryption and decryption of data objects and manages algorithms and keys in a pooled form. When using the secure password service for encryption and decryption, you need to provide the subject ID, message digest, confidentiality level, and plaintext / ciphertext. If the subject ID is not specified, the default subject ID is used. Data storage and data transfer services: Data storage refers to the storage form of structured data and unstructured data when using data classification and hierarchical management. For data objects that need to be encrypted, structured data stores the original fields in two columns, one column is a message digest of the original data, and the other column is the [original field name]_mw field, which stores the ciphertext data. At the same time, the main body and confidentiality level of the data are stored in the metadata. For unstructured data, the message digest, main body data and confidentiality level of the original data are stored in the metadata. Data transmission services include data encryption transmission process and data decryption process; In data encryption transmission, first encrypt the data with the data classification level, plaintext summary and subject identification, and then transmit the data according to the transmission channel corresponding to the classification level of the data; the transmission channel corresponding to the classification level is defined by the business. In terms of technical implementation, the classification levels of public and internal are transmitted through http and ftp network protocols, and secret data are transmitted through https and sftp. For confidential data, digital envelopes generated by national secret algorithms are transmitted on private networks. For top secret data, digital envelopes generated by biometrics + national secret algorithms are transmitted on private networks. The decryption process of the received data during data transmission is to obtain the data confidentiality level, plaintext summary and body from the metadata; there will be cross-level, cross-network and cross-domain transmission during data transmission. While ensuring the absolute security of the data, after being authenticated by three super administrator U-shields kept by three different personnel, namely the system administrator, audit administrator and security administrator, a national secret security channel is established between the two local security password services for data synchronization, and the data will not be dropped during the synchronization process.

2. The data encryption and decryption method based on data classification and grading as claimed in claim 1, characterized in that: The multiple dimensions include: technical processing, business application and privacy protection.

3. The data encryption and decryption method based on data classification and grading as claimed in claim 1, characterized in that: The classification methods include: line classification, surface classification and mixed classification.

4. The data encryption and decryption method based on data classification and grading as claimed in claim 1, characterized in that: The message digest of the plaintext data is obtained using md5, sha, or sm3 using the national encryption algorithm.

5. The data encryption and decryption method based on data classification and grading as claimed in claim 1, characterized in that: The secure password service can specify the key pool size corresponding to each algorithm, and can also upload custom encryption and decryption algorithms.

6. The data encryption and decryption method based on data classification and grading according to any one of claims 1 to 5, characterized in that: The key fields of the algorithm pool of the secure password service are: group id, algorithm id, algorithm and confidentiality level. The default group size GROUP_SIZE of the algorithm pool is 1024, and the group value range is between 1000 and 2024. Each group has 4 confidentiality levels, namely internal, secret, confidential, and top secret. The default algorithm pool size ALGORITHM_POOL_SIZE of each confidentiality level is 8. The algorithm pool contains a collection of all algorithms. The same algorithm is allowed to appear in the algorithm pool of the same confidentiality level; the subject identifier is converted into a large number according to the first algorithm, and the GROUP_SIZE is modulo to obtain the subject No. The subject No is added to 1000 to get the group ID to which the subject currently belongs; the encoding rule of the algorithm ID is group ID + confidentiality level + algorithm No. The confidentiality levels are represented by 1, 2, 3, 4, and 5 respectively from public, internal, secret, confidential, and top secret. The value range of the algorithm No is between 0 and ALGORITHM_POOL_SIZE. The calculation method is to convert the message digest into a large number according to the first algorithm and then take the modulus of ALGORITHM_POOL_SIZE to get the algorithm No. Each subject has a different algorithm pool, which adopts the lazy loading method, that is, it is generated and loaded when it is used; The key fields of the key pool of the secure cryptographic service are: algorithm id, key id and key; the algorithm id comes from the algorithm pool, the default size of the key pool CIPHER_POOL_SIZE of each algorithm is 32, the key id is a number between 0 and CIPHER_POOL_SIZE, the key of the key pool corresponds to the algorithm, each algorithm has a corresponding key pool, and the keys in the key pool are different.

7. The data encryption and decryption method based on data classification and grading as claimed in claim 6, characterized in that: The data encryption and decryption process of the secure password service includes: obtaining the subject's group ID, key number and algorithm through the subject identification, confidentiality level and message digest; specifically including: Get the group id through the subject flag: If there is no subject identifier, the default subject flag DEFAULT_ENTITY is used. A large number is obtained by adding a fixed disturbance value salt to the subject flag to make a message digest. The large number is modulo GROUP_SIZE to get the group id. If the algorithm pool corresponding to the subject is empty, the algorithm pool and the key pool of the corresponding algorithm are generated according to the predetermined configuration strategy; Obtain the algorithm and key number through the message digest: add the fixed disturbance value salt to the message digest and then process the message digest to get a large number. The large number is modulo ALGORITHM_POOL_SIZE to get the algorithm number. Get the algorithm id through the group id, confidentiality level and algorithm No; Get the key number through the message digest: add the fixed disturbance value salt to the message digest and then process it to get a large number. The large number is modulo CIPHER_POOL_SIZE to get the key id. Get the key through the algorithm id and key id. If it is encryption, use the obtained algorithm and key to encrypt the plaintext data; if it is decryption, use the obtained algorithm and key to decrypt the ciphertext data.

8. The data encryption and decryption method based on data classification and grading as claimed in claim 6, characterized in that: The data encryption process includes: after classifying and grading the data, the data security processing task is started to enter the data object or file encryption process. If the subject identifier is empty, the default subject identifier DEFAULT_ENTITY is taken. If the subject identifier is not empty, the algorithm id and the corresponding algorithm are obtained by calculating the subject mark, plaintext message digest, and confidentiality level; the key id is calculated according to the calculation strategy for obtaining the key id for the plaintext message digest, the key is obtained according to the algorithm id and key id, the algorithm and key are used to encrypt the data object or file, and the ciphertext and message digest are saved.

9. The data encryption and decryption method based on data classification and grading as claimed in claim 6, characterized in that: The data viewing process includes: when it is necessary to query or view data, it is necessary to determine whether the user has the authority to view the data through the user confidentiality level and data confidentiality level. For structured data, the query statement needs to be pre-processed, specifically, to query whether the data is encrypted and the encrypted data object in the data classification and grading service or the associated metadata. For the encrypted data object that appears in plain text in the query statement, it needs to be replaced with a message digest, and then the query is executed to obtain the query result; when decrypting structured data and unstructured data, the algorithm id and key id are calculated respectively through the subject mark, confidentiality level, and plaintext message digest, and then the decryption algorithm and key are obtained, and the decryption algorithm and key are used to decrypt the data and view the plaintext data.

10. The data encryption and decryption method based on data classification and grading as claimed in claim 6, characterized in that: In the data encryption transmission process, the national secret algorithm is implemented through a physical U-shield, and the biometric features include: facial features, fingerprints and cornea.

Images