Data encryption storage method, computer device and storage medium

Abstract

The application provides a data encryption storage method, a computer device and a storage medium. The method comprises the following steps: obtaining a source file, wherein the source file comprises a first key and first encrypted data encrypted by using the first key; and performing multiple times of encryption on the first key based on a random confusion algorithm, and saving the first encrypted data and encrypted data obtained in each time of the multiple times of encryption into a target file in a preset order. The application can assist data encryption storage, and effectively improve the security of encrypted data storage.

Description

Technical Field

[0001] This application relates to the field of data security technology, and in particular to a data encryption storage method, computer device and storage medium. Background Technology

[0002] Important data on the device or server side (e.g., customer accounts, passwords, etc.) is encrypted using a preliminary encryption algorithm (e.g., symmetric encryption algorithm, digital signature algorithm, etc.). The resulting encryption and / or decryption keys (e.g., public or private keys) often cannot be stored in a suitable location. If the keys and encrypted data are stored in plaintext code, they can be easily reverse-engineered, leading to serious privacy breaches. Summary of the Invention

[0003] In view of the above, it is necessary to provide a data encryption storage method, computer device and storage medium that can perform data encryption storage based on a random obfuscation algorithm, thereby improving the security of encrypted data storage.

[0004] The data encryption and storage method includes: obtaining a source file, the source file including: a first key and first encrypted data encrypted using the first key;

[0005] The first key is encrypted multiple times using a random obfuscation algorithm, including: encrypting the first key with a second key to obtain second encrypted data; dividing the second key into multiple subkey segments; and encrypting each subkey segment of the second key with a third key to obtain third encrypted data.

[0006] The first encrypted data and the encrypted data obtained in each of the multiple encryptions are stored in a target file in a preset order, including: constructing an obfuscation list, the obfuscation list including the third key after being transformed by preset rules and the byte length of the second encrypted data; and storing the first encrypted data, the second encrypted data, the third encrypted data, and the obfuscation list in the target file in the preset order.

[0007] Optionally, encrypting the first key using the second key includes:

[0008] A pseudo-random string is obtained based on a timestamp using a random function, and the pseudo-random string is used as the second key;

[0009] The first key is encrypted using the second key based on the associated authentication encryption algorithm.

[0010] Optionally, dividing the second key into multiple sub-keys includes:

[0011] The second key is divided into two sub-keys: a first sub-key and a second sub-key.

[0012] Optionally, each subkey segment of the second key is encrypted using a third key to obtain third encrypted data, including:

[0013] Set an initial index array, which includes {0,1,2,…,n}, where n = the byte length of each subkey segment - 1;

[0014] The initial index array is shuffled using a shuffling algorithm to obtain a random index array, which is then used as the third key.

[0015] The third key is used to perform forward obfuscation encryption on the front sub-key to obtain the encrypted front sub-key, and the third key is used to perform reverse obfuscation encryption on the back sub-key to obtain the encrypted back sub-key.

[0016] The encrypted front-end key and the encrypted back-end key are used as the third encrypted data.

[0017] Optionally, the forward obfuscation encryption includes: rearranging the data of the (i-1)th byte in the preceding subkey to the position of the number corresponding to i-1 in the forward-order random index array according to the forward order of the numbers in the random index array, where i represents an integer greater than or equal to 1 and less than or equal to n;

[0018] The reverse obfuscation encryption includes: rearranging the data of the (i-1)th byte in the subsequent subkey to the position of the number corresponding to i-1 in the reversed order of the numbers in the random index array.

[0019] Optionally, the obfuscation list includes:

[0020] Construct an initial list;

[0021] The length data of the third key and the second encrypted data are converted according to the preset rules, and the converted length data of the third key and the second encrypted data are stored in the initial list to obtain the obfuscation list, including:

[0022] In accordance with the order in the random index array, each number in the random index array is converted into binary and stored in the first k×(n+1) bits of the initial list according to the k-bit space length;

[0023] The byte length of the second encrypted data is converted into a binary value, and the binary value is stored according to the bit length of the remaining space in the initial list.

[0024] Optionally, the target file includes a location identifier, which includes the file format of the target file.

[0025] Optionally, storing the first encrypted data, the second encrypted data, the third encrypted data, and the obfuscation list into the target file in the preset order includes:

[0026] Finding and locating the target file based on the location identifier includes: finding a file containing the location identifier and using the file containing the location identifier as the target file;

[0027] The first encrypted data, the second encrypted data, the third encrypted data, and the obfuscation list are encapsulated into a target file in the preset order, wherein the preset order includes: the encrypted front-end key, the first encrypted data, the second encrypted data, the encrypted back-end key, and the obfuscation list.

[0028] The computer-readable storage medium stores at least one instruction, which, when executed by a processor, implements the data encryption storage method.

[0029] The computer device includes a memory and at least one processor. The memory stores at least one instruction, which, when executed by the at least one processor, implements the data encryption storage inspection method.

[0030] Compared with existing technologies, the data encryption storage method, computer device and storage medium described above can encrypt the first key multiple times based on a random obfuscation algorithm, and save the encrypted data generated in the multiple encryption processes in segments, in an orderly manner and at intervals, thereby improving the security of encrypted data storage and reducing the possibility of encrypted data being easily reverse-guessed and brute-forced. Attached Figure Description

[0031] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0032] Figure 1 This is a flowchart of the data encryption and storage method provided in the embodiments of this application.

[0033] Figure 2 This is an example diagram of the data encryption and storage method provided in the embodiments of this application.

[0034] Figure 3 This is a flowchart of multiple encryption provided in the embodiments of this application.

[0035] Figure 4 This application provides a flowchart of storing encrypted data into a target file.

[0036] Figure 5 This is an architectural diagram of the computer device provided in the embodiments of this application.

[0037] Explanation of main component symbols

[0038] Computer devices 3 processor 32 memory 31 Data Encryption Storage System 30

[0039] The following detailed description, in conjunction with the accompanying drawings, will further illustrate this application. Detailed Implementation

[0040] To better understand the above-mentioned objectives, features, and advantages of this application, the application will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be noted that, unless otherwise specified, the embodiments and features described herein can be combined with each other.

[0041] Numerous specific details are set forth in the following description to provide a thorough understanding of this application. The described embodiments are merely some, not all, of the embodiments described herein. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0042] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the application.

[0043] See Figure 1 The diagram shown is a flowchart of a preferred embodiment of the data encryption and storage method of this application.

[0044] In this embodiment, the data encryption and storage method can be applied to a computer device (e.g., Figure 5 For computer devices that require encrypted data storage, the data encryption storage function provided by the method of this application can be directly integrated into the computer device, or it can be run on the computer device in the form of a software development kit (SDK).

[0045] like Figure 1 As shown, the data encryption and storage method specifically includes the following steps. Depending on different needs, the order of the steps in this flowchart can be changed, and some steps can be omitted.

[0046] Step S1: The computer device obtains a source file, which includes a first key and first encrypted data encrypted using the first key.

[0047] In one embodiment, after important data (e.g., customer accounts, passwords, etc.) on a computer device (e.g., the device itself or the server) is encrypted using a preliminary encryption algorithm (e.g., symmetric encryption algorithm, digital signature algorithm, etc.), the resulting encryption and / or decryption keys (e.g., public or private keys) often cannot be stored in a suitable location. If the keys and encrypted data are stored in plaintext code, they are easily reverse-engineered, leading to serious privacy breaches.

[0048] This application embodiment can encrypt the above key multiple times based on a random obfuscation algorithm (the specific algorithm will be described in subsequent steps), and save the data of the multiple encryptions to the target file according to preset rules, thereby protecting the above key in an encrypted data format, realizing the isolation between the encryption algorithm and the corresponding key, improving the security of storing encrypted data, and preventing the encrypted data from being easily reverse-guessed and brute-forced.

[0049] In one embodiment, the computer device may save the source file in a pre-set location and may also obtain the source file by receiving user input.

[0050] like Figure 2 The diagram shown is an example of a data encryption and storage method provided in an embodiment of this application, wherein the source file includes a first key and first encrypted data. The sum of the lengths of the first key and the first encrypted data generally does not exceed 128 bytes.

[0051] In one embodiment, the first key includes a key generated by encrypting source data (e.g., customer account, password, etc.) using a symmetric encryption algorithm, digital signature algorithm, or the like. There is a correspondence between the first key and the first encrypted data, and the first key can be used to decrypt the first encrypted data.

[0052] In one embodiment, the computer device may also directly obtain the first key and the first encrypted data. For example, when the first key and the first encrypted data are not stored in a source file, the computer device may obtain the first key and the first encrypted data respectively.

[0053] Step S2: The computer device encrypts the first key multiple times based on a random obfuscation algorithm.

[0054] Specifically, such as Figure 3 The flowchart shown is a process for multiple encryption provided in an embodiment of this application, including the following steps S20 to S22. Depending on different needs, Figure 3 The order of the steps can be changed, and some steps can be omitted. Furthermore, other encryption algorithms may be included, and this application does not limit this.

[0055] Step S20: The computer device uses the second key to encrypt the first key to obtain the second encrypted data.

[0056] In one embodiment, encrypting the first key using the second key includes:

[0057] A pseudo-random string is obtained based on a timestamp using a random function, and the pseudo-random string is used as the second key;

[0058] The first key is encrypted using the second key based on the associated authentication encryption algorithm.

[0059] In one embodiment, the random function includes the rand function. The timestamp includes the total number of seconds from 00:00:00 on January 1, 1970 (GMT) to the current time. Based on the non-repeatable nature of the timestamp, a unique pseudo-random string can be generated using the random function and the timestamp; for example, a pseudo-random string of 16 bytes can be generated as the second key.

[0060] In one embodiment, the Authenticated Encryption with Associated Data (AEAD) algorithm can bind any unencrypted associated data (e.g., any data in the first key) to ciphertext (e.g., the second key), while binding the unencrypted associated data to the context in which the unencrypted associated data appears, thereby ensuring confidentiality and integrity during the data encryption process.

[0061] In one embodiment, the first key is encrypted using the second key, thus performing a random encryption of the first key. The second encrypted data has higher security compared to the first key.

[0062] Step S21: The computer device divides the second key into multiple sub-keys.

[0063] For ease of description below, let m represent the number of segments of the subkey, where m is a preset integer.

[0064] In one embodiment, dividing the second key into m subkeys includes:

[0065] Let m = 2, and divide the second key into two subkey segments, including: the first subkey segment and the second subkey segment.

[0066] In one embodiment, m can be set according to actual needs, or it can be set to other integers greater than 2.

[0067] In one embodiment, the byte length of each subkey may be equal or unequal.

[0068] For example, when the byte length of each subkey is equal, the byte length of the first subkey = the byte length of the second subkey = the byte length of the second subkey / m. For instance, the byte length of the first subkey = the byte length of the second subkey = 16 / 2 = 8, indicating that the first subkey and the second subkey are each 8 bytes. Figure 2 As shown, the front-end key and the back-end key each contain 8 small squares, and each small square represents 1 byte of data.

[0069] In one embodiment, the second key is divided into multiple subkeys, allowing different encryption methods to be used to encrypt each subkey in subsequent steps, thereby increasing the complexity of data encryption. Furthermore, when saving data, the data corresponding to each subkey can be saved separately, further enhancing data storage security.

[0070] Step S22: The computer device uses the third key to encrypt each segment of the second key's subkeys to obtain the third encrypted data.

[0071] In one embodiment, each subkey segment of the second key is encrypted using a third key to obtain third encrypted data, including the following (1)-(4):

[0072] (1) Set an initial subscript array, which includes {0,1,2,…,n}, where n = the byte length of each subkey segment - 1.

[0073] In one embodiment, since the byte length of each subkey segment is the same in this application embodiment, the number of numbers in the initial subscript array can be set to be equal to the byte length of each subkey segment. For example, if the byte length of each subkey segment is 8, then the initial subscript array can contain 8 numbers, n = 8 - 1 = 7. The initial subscript array can be {0, 1, 2, ..., 7}, or it can be other ordered numbers.

[0074] In one embodiment, the last number n of the initial subscript array can be related to k in a subsequent step. For example, when n = 7, it is 111 in binary, occupying a bit length of 3. Since 7 is the maximum value of the ordered numbers in the initial subscript array, the maximum space length occupied by each number in the initial subscript array after conversion to binary is 3 bits, meaning k = 3 can be set in this case. Figure 2 As shown, the front-end key and the back-end key each contain 8 small squares, and each small square represents 1 byte of data.

[0075] In other embodiments, when the byte lengths of each subkey are not the same, multiple initial subscript arrays can be set, wherein the number of numbers in any initial subscript array is the same as the byte length of the corresponding subkey.

[0076] (2) The initial index array is shuffled using a shuffling algorithm to obtain a random index array, and the random index array is used as the third key.

[0077] In one embodiment, the shuffling algorithm is used to randomly rearrange the numbers in the initial index array, wherein each number has an equal probability of falling into a certain position in the array after random rearrangement. This allows the numbers in the initial index array to be shuffled, and the resulting random index array to be used as the third key.

[0078] For example, the random index array {0,1,2,…,7} can be shuffled by the shuffling algorithm to obtain a random index array {7,3,5,1,6,0,2,4}.

[0079] (3) Use the third key to perform forward obfuscation encryption on the front subkey to obtain the encrypted front subkey, and use the third key to perform reverse obfuscation encryption on the back subkey to obtain the encrypted back subkey.

[0080] In one embodiment, the forward obfuscation encryption includes: rearranging the data of the (i-1)th byte in the preceding subkey to the position of the corresponding number in the forward-order random index array according to the forward order of the numbers in the random index array, where i represents an integer greater than or equal to 1 and less than or equal to n;

[0081] The reverse obfuscation encryption includes: rearranging the data of the (i-1)th byte in the subsequent subkey to the position of the number corresponding to i-1 in the reversed order of the numbers in the random index array.

[0082] For example, if the random index array is {7,3,5,1,6,0,2,4}, then the forward random index array is also {7,3,5,1,6,0,2,4}. In contrast, the reverse random index array represents the array obtained by reversing the forward random index array, and the reverse random index array is represented as {4,2,0,6,1,5,3,7}.

[0083] To further illustrate, if the front-end subkey comprises 8 bytes of numbers, where i = 1 represents the first byte of data and i - 1 = 0, then the forward obfuscation encryption includes: rearranging the first byte of data in the forward-order random index array {7,3,5,1,6,0,2,4} to the position of 0; and if i = 7 represents the seventh byte of data and i - 1 = 6, then the forward obfuscation encryption includes: rearranging the seventh byte of data in the front-end subkey to the position of 6 in the forward-order random index array {7,3,5,1,6,0,2,4}. Similarly, the forward obfuscation encryption can be performed on each byte of data in the front-end subkey to obtain the encrypted front-end subkey.

[0084] In one embodiment, the reverse-order random index array {4,2,0,6,1,5,3,7} can be used to perform reverse obfuscation encryption on the latter subkey. The process is similar to the process of performing forward obfuscation encryption on each byte of data of the former subkey, and will not be described in detail here.

[0085] (4) The encrypted front segment key and the encrypted back segment key are used as the third encrypted data.

[0086] In one embodiment, the random index array is obtained using the shuffling algorithm. Based on the random index array, the first subkey and the second subkey are obfuscated and encrypted in opposite directions, which can encrypt the second key, thereby achieving a second encryption of the first key and increasing the complexity of the data encryption algorithm.

[0087] Step S3: The computer device stores the first encrypted data and the encrypted data obtained in each of the multiple encryptions into the target file in a preset order.

[0088] Specifically, such as Figure 4 The diagram shown is a flowchart of storing encrypted data to a target file according to an embodiment of this application, including the following steps S30 to S31. Depending on different needs, Figure 4 The order of the steps can be changed, and some steps can be omitted. In addition, other storage methods may be included, and this application does not limit them.

[0089] Step S30: The computer device constructs an obfuscation list, which includes the third key after being transformed by preset rules and the byte length of the second encrypted data.

[0090] In one embodiment, the build obfuscation list includes:

[0091] Construct an initial list;

[0092] The length data of the third key and the second encrypted data are converted according to the preset rules, and the converted length data of the third key and the second encrypted data are stored in the initial list to obtain the obfuscation list, including:

[0093] In accordance with the order in the random index array, each number in the random index array is converted into binary and stored in the first k×(n+1) bits of the initial list according to the k-bit space length;

[0094] The byte length of the second encrypted data is converted into a binary value, and the binary value is stored according to the bit length of the remaining space in the initial list.

[0095] In one embodiment, the initial list can be an empty list, and the space size of the initial list can be preset. As described in step S5, the space size of the initial list is related to k and n, and also to the byte length of the second encrypted data.

[0096] For example, the initial list can be set to a space size of 4 bytes, which is 4 × 8 = 32 bits in bits.

[0097] The random index array contains integers from 0 to 7, with the largest number being 7 (n), and contains a total of 7 + 1 = 8 (n + 1) numbers. 0 is converted to binary as 0, 1 as 1, 2 as 10, and 3 as 011.

[0098] As shown in the above steps, starting from 3, the binary representation of 011 requires at least 3 bits of storage, and even converting 7 to binary 111 requires a maximum of 3 bits. Therefore, we can set k to 3 and use 3 bits of space to store each number converted to binary in the random index array. If a number converted to binary requires less than 3 bits, it can be padded with leading zeros. For example, 2 converted to binary is 10, so a leading zero can be added to update it to 010, occupying 3 bits of space.

[0099] For example Figure 2 As shown, after each number in the random index array is converted into binary and stored in the first k×(n+1)=3×8=24 bits of the initial list, the remaining space in the initial list is 32-24=8 bits.

[0100] In one embodiment, the sum of the lengths of the first key and the first encrypted data generally does not exceed 128 bytes, and the length of the second encrypted data also generally does not exceed 128 bytes. Therefore, when the length of the second encrypted data is 128 bytes, the converted binary value is 10000000, occupying 8 bits of space, which can be stored in the remaining space. Thus, the remaining space is sufficient to store the binary value.

[0101] In other embodiments, the sum of the lengths of the first key and the first encrypted data can exceed 128 bytes, and the length of the second encrypted data can also exceed 128 bytes. Therefore, based on the logical relationships in the above embodiments, the space size of the initial list, as well as k and n, can be set according to the length of the second encrypted data; this application does not limit this.

[0102] In one embodiment, by using the obfuscation list to store the third key after transformation according to the preset rules and the length data of the second encrypted data, the transformation and encryption of the third key can be achieved, and the length data of the second encrypted data can be stored separately from the second encrypted data in subsequent processes (e.g., Figure 2 As shown, this can improve the security of data storage.

[0103] Step S31: The computer device stores the first encrypted data, the second encrypted data, the third encrypted data, and the obfuscation list into a target file.

[0104] In one embodiment, the target file includes a location identifier, which includes the file format of the target file. The computer device can pre-set a target file for storing encrypted data, and the target file stores the file format. When encrypted data storage is required, the computer device can locate a file containing the location identifier based on the file format, use the file containing the location identifier as the target file, determine the storage location of the target file, and use the target file for encrypted data storage.

[0105] For example, the file format may include Magic format, and the location identifier may be the filename of the target file in Magic format, for example... Figure 2 As shown, it can be represented as Magic (4 bytes).

[0106] In one embodiment, storing the first encrypted data, the second encrypted data, the third encrypted data, and the obfuscation list to a target file includes:

[0107] Locating the target file according to the location identifier includes: finding a file containing the location identifier and using the file containing the location identifier as the target file;

[0108] The first encrypted data, the second encrypted data, the third encrypted data, and the obfuscation list are packaged into a target file in a preset order, wherein the preset order includes: the encrypted front-end key, the first encrypted data, the second encrypted data, the encrypted back-end key, and the obfuscation list.

[0109] For example Figure 2 As shown, the target file sequentially stores Magic (4 Bytes) (location identifier), the encrypted front-end key, the first encrypted data, the second encrypted data, the encrypted back-end key, and the obfuscation list.

[0110] In other embodiments, the preset order may be other orders, and this application does not limit this order.

[0111] In one embodiment, the data encryption storage method provided in this application encrypts the first key multiple times based on a random obfuscation algorithm, and saves the encrypted data generated during the multiple encryption processes in segments, in an orderly manner, and at intervals. This improves the security of encrypted data storage while ensuring data integrity, and reduces the possibility of encrypted data being easily reverse-guessed and brute-forced.

[0112] The above Figure 1 The data encryption and storage method of this application is described in detail below. Figure 5 The architecture of the hardware device for implementing the data encryption and storage method is described.

[0113] It should be understood that the embodiments described are for illustrative purposes only and are not limited to this structure in the scope of the patent application.

[0114] See Figure 5 The diagram shown is a structural schematic of a computer device provided in a preferred embodiment of this application.

[0115] In a preferred embodiment of this application, the computer device 3 includes a memory 31 and at least one processor 32. Those skilled in the art should understand that... Figure 5 The structure of the computer device shown does not constitute a limitation of the embodiments of this application. It can be a bus-type structure or a star-type structure. The computer device 3 may also include more or fewer other hardware or software than shown, or different component arrangements.

[0116] In some embodiments, the computer device 3 includes a terminal capable of automatically performing numerical calculations and / or information processing according to pre-set or stored instructions, the hardware of which includes, but is not limited to, microprocessors, application-specific integrated circuits, programmable gate arrays, digital processors, and embedded devices.

[0117] It should be noted that the computer device 3 described is merely an example. Other existing or future electronic products that are suitable for this application should also be included within the scope of protection of this application and are incorporated herein by reference.

[0118] In some embodiments, the memory 31 is used to store program code and various data. For example, the memory 31 can be used to store a data encryption storage system 30 installed in the computer device 3, and to enable high-speed and automatic access to programs or data during the operation of the computer device 3. The memory 31 includes read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), one-time programmable read-only memory (OTPROM), electrically-erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, disk storage, magnetic tape storage, or any other computer-readable storage medium capable of carrying or storing data.

[0119] In some embodiments, the at least one processor 32 may be composed of integrated circuits, such as a single-packaged integrated circuit or multiple integrated circuits packaged with the same or different functions, including combinations of one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and various control chips. The at least one processor 32 is the control unit of the computer device 3, connecting various components of the computer device 3 via various interfaces and lines. It executes programs or modules stored in the memory 31 and calls data stored in the memory 31 to perform various functions of the computer device 3 and process data, such as executing... Figure 1 The data encryption storage function shown.

[0120] In some embodiments, the data encryption storage system 30 operates in a computer device 3. The data encryption storage system 30 may include multiple functional modules composed of program code segments. The program code of each program segment in the data encryption storage system 30 may be stored in the memory 31 of the computer device 3 and executed by at least one processor 32 to achieve... Figure 1 The data encryption storage function shown.

[0121] In this embodiment, the data encryption storage system 30 can be divided into multiple functional modules according to its functions. A module, as referred to in this application, is a series of computer program segments that can be executed by at least one processor and perform a fixed function, and is stored in memory.

[0122] Although not shown, the computer device 3 may also include a power supply (such as a battery) to power the various components. Preferably, the power supply can be logically connected to the at least one processor 32 via a power management device, thereby enabling functions such as charging, discharging, and power consumption management. The power supply may also include one or more DC or AC power supplies, recharging devices, power failure testing circuits, power converters or inverters, power status indicators, and other arbitrary components. The computer device 3 may also include various sensors, Bluetooth modules, Wi-Fi modules, etc., which will not be described in detail here.

[0123] It should be understood that the embodiments described are for illustrative purposes only and are not limited to this structure in the scope of the patent application.

[0124] The integrated unit implemented as a software functional module described above can be stored in a computer-readable storage medium. This software functional module, stored in a storage medium, includes several instructions to cause a computer device (which may be a server, personal computer, etc.) or processor to execute portions of the methods described in the various embodiments of this application.

[0125] The memory 31 stores program code, and the at least one processor 32 can call the program code stored in the memory 31 to execute related functions. The program code stored in the memory 31 can be executed by the at least one processor 32 to realize the functions of each module and achieve the purpose of encrypted data storage.

[0126] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and other division methods may be used in actual implementation.

[0127] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0128] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or in the form of hardware plus software functional modules.

[0129] It will be apparent to those skilled in the art that this application is not limited to the details of the exemplary embodiments described above, and that this application can be implemented in other specific forms without departing from the spirit or essential characteristics of this application. Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of this application is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be embraced within this application. No reference numerals in the claims should be construed as limiting the scope of the claims. Furthermore, it is clear that the word "comprising" does not exclude other elements or, and the singular does not exclude the plural. Multiple elements or devices recited in the apparatus claims may also be implemented by a single element or device in software or hardware. The terms "first," "second," etc., are used to indicate names and do not indicate any particular order.

[0130] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application and are not intended to limit it. Although this application has been described in detail with reference to the above preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of this application without departing from the spirit and scope of the technical solutions of this application.

Claims

1. A method for encrypting and storing data, characterized in that, The method includes: Obtain a source file, the source file including: a first key and first encrypted data encrypted using the first key; The first key is encrypted multiple times using a random obfuscation algorithm, including: encrypting the first key with a second key to obtain second encrypted data; dividing the second key into multiple subkey segments; and encrypting each subkey segment of the second key with a third key to obtain third encrypted data. The first encrypted data and the encrypted data obtained in each of the multiple encryptions are stored in a target file in a preset order, including: constructing an obfuscation list, wherein the obfuscation list includes the third key after being transformed by preset rules and the byte length of the second encrypted data; and storing the first encrypted data, the second encrypted data, the third encrypted data, and the obfuscation list in the target file in the preset order. The step of dividing the second key into multiple sub-keys includes: dividing the second key into two sub-keys, including a first sub-key and a second sub-key; Encrypting each segment of the second key using a third key to obtain third encrypted data includes: setting an initial index array, the initial index array including {0,1,2,…,n}, where n = the byte length of each segment of the subkey - 1; shuffling the initial index array using a shuffling algorithm to obtain a random index array, and using the random index array as the third key; using the third key to perform forward obfuscation encryption on the first segment of the subkey to obtain an encrypted first segment of the subkey, and using the third key to perform reverse obfuscation encryption on the second segment of the subkey to obtain an encrypted second segment of the subkey; and using the encrypted first segment of the subkey and the encrypted second segment of the subkey as the third encrypted data.

2. The data encryption and storage method according to claim 1, characterized in that, The step of encrypting the first key using the second key includes: A pseudo-random string is obtained based on a timestamp using a random function, and the pseudo-random string is used as the second key; The first key is encrypted using the second key based on the associated authentication encryption algorithm.

3. The data encryption and storage method according to claim 1, characterized in that: The forward obfuscation encryption includes: rearranging the data of the (i-1)th byte in the previous subkey to the position of the corresponding number in the forward-order random index array according to the forward order of the numbers in the random index array, where i represents an integer greater than or equal to 1 and less than or equal to n; The reverse obfuscation encryption includes: rearranging the data of the (i-1)th byte in the subsequent subkey to the position of the number corresponding to i-1 in the reversed order of the numbers in the random index array.

4. The data encryption and storage method according to claim 1, characterized in that, The obfuscation list includes: Construct an initial list; The length data of the third key and the second encrypted data are converted according to the preset rules, and the converted length data of the third key and the second encrypted data are stored in the initial list to obtain the obfuscation list, including: In accordance with the order in the random index array, each number in the random index array is converted into binary and stored in the first k×(n+1) bits of the initial list according to the k-bit space length; The byte length of the second encrypted data is converted into a binary value, and the binary value is stored according to the bit length of the remaining space in the initial list.

5. The data encryption and storage method according to claim 1, characterized in that, The target file includes a location identifier, and the location identifier includes the file format of the target file.

6. The data encryption and storage method according to claim 5, characterized in that, The step of storing the first encrypted data, the second encrypted data, the third encrypted data, and the obfuscation list into the target file in the preset order includes: Finding and locating the target file based on the location identifier includes: finding a file containing the location identifier and using the file containing the location identifier as the target file; The first encrypted data, the second encrypted data, the third encrypted data, and the obfuscation list are encapsulated into a target file in the preset order, wherein the preset order includes: the encrypted front-end key, the first encrypted data, the second encrypted data, the encrypted back-end key, and the obfuscation list.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one instruction, which, when executed by a processor, implements the data encryption storage method as described in any one of claims 1 to 6.

8. A computer device, characterized in that, The computer device includes a memory and at least one processor, wherein the memory stores at least one instruction that, when executed by the at least one processor, implements the data encryption storage method as described in any one of claims 1 to 6.

Images