Data encryption method and system

Abstract

The present application provides a data encryption method and system, which relates to the technical field of data encryption. The method includes: a server selects a preset number of first-level encryption nodes from multiple first-level encryption nodes to obtain multiple first encryption nodes; the server uses a user public key input by a user to encrypt the data to be processed to obtain first encrypted data, and then sends the first encrypted data to each first encryption node; the first encryption node obtains a second device identifier and a second node public key of a second encryption node, and the second encryption node is any one of the multiple second-level encryption nodes connected to the first encryption node; the first encryption node embeds the second device identifier into the first encrypted data to obtain the first processed data; the first encryption node uses the second node public key to encrypt the first processed data to obtain the second encrypted data. The present application can perform encryption processing on data.

Description

Technical Field

[0001] The present application relates to the technical field of data encryption, and in particular to a data encryption method and system. Background Art

[0002] Data encryption is a key information security measure that effectively prevents unauthorized access and theft by encoding and converting data to make it difficult to understand and interpret during transmission or storage. While protecting privacy, preventing data leakage, and ensuring data integrity, encryption also provides necessary protection for modern information technology applications such as secure communications, online transactions, and cloud computing, helping organizations and individuals prevent various network attacks and improper use of data, and maintaining the security and trust of the digital environment.

[0003] For enterprises, data usually contains a large amount of sensitive information, including customer information, financial data, business secrets, research and development results, etc. The leakage of this information may lead to serious business losses, such as customer loss, competitive disadvantages, intellectual property risks, etc. Therefore, confidentiality is essential to maintaining the competitiveness and sound operation of enterprises. In addition, data leakage may also cause network security problems, such as malicious attacks and ransomware attacks. When the network security of an enterprise is threatened, data confidentiality can serve as an effective line of defense to reduce the risk of cyber attacks and ensure the stable and reliable operation of information systems.

[0004] Therefore, a method is needed to encrypt the data. Summary of the invention

[0005] The present application provides a data encryption method and system, which can encrypt data.

[0006] In a first aspect of the present application, a data encryption method is provided, which is applied to a data encryption processing system, wherein the data encryption processing system includes a server, a plurality of primary encryption nodes, and a plurality of secondary encryption nodes, and the method includes:

[0007] The server selects a preset number of first-level encryption nodes from the plurality of first-level encryption nodes connected thereto to obtain a plurality of first encryption nodes;

[0008] The server encrypts the data to be processed using a user public key input by the user to obtain first encrypted data, and then sends the first encrypted data to each of the first encryption nodes;

[0009] The first encryption node obtains a second device identifier and a second node public key of a second encryption node, where the second encryption node is any one of the plurality of secondary encryption nodes connected to the first encryption node;

[0010] The first encryption node embeds the second device identifier into the first encrypted data to obtain first processed data;

[0011] The first encryption node encrypts the first processed data using the second node public key to obtain second encrypted data.

[0012] By adopting the above technical solution, the server selects multiple first-level encryption nodes as the first encryption nodes to participate in encryption. This distributed encryption method increases the security of the entire system. Even if a first encryption node is attacked or cracked, causing the encryption node to be unable to encrypt, other encryption nodes can still provide encryption services. Through multi-level encryption, from user public key encryption to first-level encryption node encryption, the data undergoes multiple encryption operations. Each layer of encryption increases the security of the data, raises the threshold for cracking the data, and makes it more difficult for unauthorized users to obtain the original data. The first encryption node introduces dynamic identification information by obtaining the device identification of the second encryption node and embedding it into the first encrypted data. This helps to improve the uniqueness and traceability of the data, while increasing the difficulty for attackers to guess or simulate device identification.

[0013] Optionally, after the first encryption node encrypts the first processed data using the second node public key to obtain second encrypted data, the method further includes:

[0014] The first encryption node sends the second encrypted data, a first device identifier and a first node public key to the second encryption node, where the first device identifier is a device identifier of the first encryption node, and the first node public key is a node public key of the first encryption node;

[0015] The second encryption node embeds the first device identifier into the second encrypted data to obtain second processed data;

[0016] The second encryption node encrypts the second processed data using the first node public key to obtain alternative encrypted data.

[0017] By adopting the above technical solution, on the basis of user public key encryption and first encryption node encryption, a second encryption node is introduced to participate in encryption. The second encryption node plays a role of further encryption and processing in this process, which increases the security of data encryption. After the second encryption node embeds the first device identifier into the second encrypted data, the specific identifier of the original data is retained, which is helpful for further data tracking and management. The second encryption node encrypts by using the first node public key, and encrypts by using the second node public key in combination with the first encryption node, so that both the first encryption node and the second encryption node participate in the encryption process, and the subsequent decryption process also needs to be involved, which increases the complexity of the attack.

[0018] Optionally, before the server uses the user public key to encrypt the data to be processed to obtain the first encrypted data, the method further includes:

[0019] The server obtains the data to be encrypted according to the encryption request of the user;

[0020] The server replaces the target original character with a target replacement character according to a preset corresponding rule to obtain the data to be processed, the target replacement character is any one of multiple replacement characters, the target original character is any one of multiple original characters contained in the data to be encrypted, and the preset corresponding rule is the correspondence rule between the replacement character and the original character.

[0021] By adopting the above technical solution, the security of data can be increased by performing character replacement processing on the encrypted data before encryption. This pre-processing operation may help to confuse the data, making it difficult for attackers to understand the structure and content of the original data, thereby improving the confidentiality of the data.

[0022] Optionally, the first encryption node embeds the second device identifier into the first encrypted data to obtain first processed data, specifically including:

[0023] The first encryption node generates a random positive integer, the value of the random positive integer is less than the length value of the first encrypted data;

[0024] The first encryption node determines an embedding position of the second device identifier according to the random positive integer, and the value of the embedding position is the same as the value of the random positive integer;

[0025] The first encryption node inserts the data of the second device identification into the embedded position of the first encrypted data to obtain the first processed data.

[0026] By adopting the above technical solution, a dynamic embedding position selection is achieved by generating a random positive integer and using it as the embedding position, which increases the difficulty for attackers to guess or simulate the embedding position and improves the security of the encryption process. Embedding the second device identifier helps to maintain the uniqueness and traceability of the data. The insertion position of the device identifier is dynamically generated. The dynamic embedding position can resist statistical analysis because the embedding position is not fixed. Attackers cannot discover patterns or rules by analyzing fixed embedding positions, which increases the complexity of the attack.

[0027] Optionally, after the second encryption node encrypts the second encrypted data using the user public key to obtain the candidate encrypted data, the method further includes:

[0028] The server sends a decryption instruction to the first encryption node according to the decryption request of the user;

[0029] The first encryption node decrypts the candidate encrypted data using the first node private key corresponding to the first node public key according to the decryption instruction to obtain the second processed data;

[0030] The first encryption node extracts the identifier of the second processed data to determine whether the first device identifier can be extracted; if it is determined that the first device identifier can be extracted, the first device identifier is deleted from the first processed data to obtain the second encrypted data.

[0031] By adopting the above technical solution, a secure decryption process is achieved by using the first node private key corresponding to the first node's public key in the process of the server sending a decryption instruction. Only the first encryption node with the corresponding private key can decrypt the alternative encrypted data, ensuring the security of the decryption operation. The first encryption node extracts and judges the decrypted second processed data to determine whether the first device identifier can be extracted. This step ensures that while decrypting, it is possible to know whether the first device identifier is included in the data before decryption, that is, to determine whether the data is the data processed by the first encryption node during the encryption process. By performing identifier extraction and judgment during the decryption process, unauthorized access can be prevented while performing the decryption operation. Only under certain conditions (such as being able to extract the device identifier) ​​is the subsequent decryption steps allowed to proceed, increasing the security of the decryption process.

[0032] Optionally, the first encryption node sends the second encrypted data to the second encryption node;

[0033] The second encryption node uses the second node private key corresponding to the second node public key to decrypt the second encrypted data to obtain the second processed data;

[0034] The second encryption node extracts the identifier of the second processed data to determine whether the second device identifier can be extracted, and if it is determined that the second device identifier can be extracted, deletes the second device identifier from the second processed data to obtain the first encrypted data;

[0035] The second encryption node sends the first encrypted data to the server;

[0036] The server uses the user private key corresponding to the user public key to decrypt the first encrypted data to obtain the data to be processed.

[0037] By adopting the above technical solution, the security of the decryption operation is achieved by using the key of the second node at the second encryption node to decrypt the second encrypted data. Only the second encryption node with the corresponding private key can decrypt the data, ensuring the security of decryption. The second encryption node extracts and judges the identifier of the second processed data after decryption to determine whether the second device identifier can be extracted. This step ensures that while decrypting, it is possible to know whether the second device identifier is included in the data before decryption, that is, to determine whether the data is the data processed by the second encryption node during the encryption process. By performing identifier extraction and judgment during the decryption process, unauthorized access can be prevented while performing the decryption operation. Only under specific conditions (such as being able to extract the device identifier) ​​is the subsequent decryption steps allowed to proceed, increasing the security of the decryption process.

[0038] Optionally, the server replaces the target replacement character with the target original character according to the preset corresponding rule to obtain the data to be encrypted.

[0039] By adopting the above technical solution, the recovery process from the data to be processed to the original data to be encrypted is realized.

[0040] Optionally, before the server obtains the user public key input by the user, the method further includes:

[0041] The server obtains biometric data of the user input by the user, where the biometric data is based on biometric recognition technology and is used to ensure that only the user can obtain information data for accessing or completing a preset operation;

[0042] The server generates a user private key according to the biometric data based on a preset method, and then uses an asymmetric encryption algorithm to generate a user public key according to the user private key.

[0043] By adopting the above technical solution, the user private key is generated based on biometric data, which can ensure that the generation of the private key is related to the user's identity. This increases the security of the private key and reduces the risk of unauthorized access or theft of the private key. By using biometric data to generate private keys and public keys, it can be ensured that the user's identity is unique. Even when the same preset method is used to generate private keys and public keys, the key pairs of different users are different due to the uniqueness of biometric data.

[0044] In a second aspect of the present application, a data encryption system is provided, including a server, a plurality of primary encryption nodes, and a plurality of secondary encryption nodes, wherein:

[0045] The server is used to select a preset number of first-level encryption nodes from the plurality of first-level encryption nodes connected thereto to obtain a plurality of first encryption nodes;

[0046] The server is used to encrypt the data to be processed using a user public key input by a user to obtain first encrypted data, and then send the first encrypted data to each of the first encryption nodes;

[0047] The first encryption node is used to obtain a second device identifier and a second node public key of a second encryption node, where the second encryption node is any one of the plurality of secondary encryption nodes connected to the first encryption node;

[0048] The first encryption node is used to embed the second device identifier into the first encrypted data to obtain first processed data;

[0049] The first encryption node is used to encrypt the first processed data using the second node public key to obtain second encrypted data.

[0050] Optionally, the first encryption node is used to send the second encrypted data, a first device identifier and a first node public key to the second encryption node, the first device identifier is a device identifier of the first encryption node, and the first node public key is a node public key of the first encryption node;

[0051] The second encryption node is used to embed the first device identifier into the second encrypted data to obtain second processed data;

[0052] The second encryption node is used to encrypt the second processed data using the first node public key to obtain alternative encrypted data.

[0053] Optionally, the server is used to obtain the data to be encrypted according to the encryption request of the user;

[0054] The server is used to replace the target original character with a target replacement character according to a preset corresponding rule to obtain the data to be processed, the target replacement character is any one of multiple replacement characters, the target original character is any one of multiple original characters contained in the data to be encrypted, and the preset corresponding rule is the correspondence rule between the replacement character and the original character.

[0055] Optionally, the first encryption node is used to generate a random positive integer, where the value of the random positive integer is less than the length value of the first encrypted data;

[0056] The first encryption node is used to determine an embedding position of the second device identifier according to the random positive integer, and the value of the embedding position is the same as the value of the random positive integer;

[0057] The first encryption node is used to insert the data of the second device identifier into the embedded position of the first encrypted data to obtain the first processed data.

[0058] Optionally, the server is used to send a decryption instruction to the first encryption node according to the decryption request of the user;

[0059] The first encryption node is configured to decrypt the candidate encrypted data according to the decryption instruction using the first node private key corresponding to the first node public key to obtain the second processed data;

[0060] The first encryption node is used to extract the identifier of the second processed data and determine whether the first device identifier can be extracted. If it is determined that the first device identifier can be extracted, the first device identifier is deleted from the first processed data to obtain the second encrypted data.

[0061] Optionally, the first encryption node is used to send the second encrypted data to the second encryption node;

[0062] The second encryption node is used to decrypt the second encrypted data using the second node private key corresponding to the second node public key to obtain the second processed data;

[0063] The second encryption node is used to extract the identifier of the second processed data, determine whether the second device identifier can be extracted, and if it is determined that the second device identifier can be extracted, delete the second device identifier from the second processed data to obtain the first encrypted data;

[0064] The second encryption node is used to send the first encrypted data to the server;

[0065] The server is used to decrypt the first encrypted data using the user private key corresponding to the user public key to obtain the data to be processed.

[0066] Optionally, the server is used to replace the target replacement character with the target original character according to the preset corresponding rule to obtain the data to be encrypted.

[0067] Optionally, the server is used to obtain biometric data of the user input by the user, where the biometric data is based on biometric recognition technology and is used to ensure that only the user can obtain information data for accessing or completing a preset operation;

[0068] The server is used to generate a user private key according to the biometric data based on a preset method, and then use an asymmetric encryption algorithm to generate a user public key according to the user private key.

[0069] In summary, one or more technical solutions provided in the embodiments of the present application have at least the following technical effects or advantages:

[0070] 1. The server selects multiple first-level encryption nodes as the first encryption nodes to participate in encryption. This distributed encryption method increases the security of the entire system. Even if a first encryption node is attacked or cracked, causing the encryption node to be unable to encrypt, other encryption nodes can still provide encryption services. Through multi-level encryption, from user public key encryption to first-level encryption node encryption, the data undergoes multiple encryption operations. Each layer of encryption increases the security of the data, raises the threshold for cracking the data, and makes it more difficult for unauthorized users to obtain the original data. The first encryption node introduces dynamic identification information by obtaining the device identification of the second encryption node and embedding it into the first encrypted data. This helps to improve the uniqueness and traceability of the data, while increasing the difficulty for attackers to guess or simulate device identification.

[0071] 2. Based on the user public key encryption and the first encryption node encryption, the second encryption node is introduced to participate in the encryption. The second encryption node plays a role in further encryption and processing in this process, which increases the security of data encryption. After the second encryption node embeds the first device identifier into the second encrypted data, the specific identifier of the original data is retained, which helps further data tracking and management. The second encryption node encrypts by using the first node public key, and encrypts by using the second node public key in combination with the first encryption node. In this way, both the first encryption node and the second encryption node participate in the encryption process, and the subsequent decryption process also needs to participate, which increases the complexity of the attack. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] Figure 1 It is a flowchart of a data encryption method disclosed in an embodiment of the present application;

[0073] Figure 2 It is a structural diagram of a data encryption system disclosed in an embodiment of the present application;

[0074] Figure 3 It is a flowchart of another data encryption method disclosed in an embodiment of the present application;

[0075] Explanation of the reference numerals: 201, server; 202, primary encryption node; 203, secondary encryption node; 204, first encryption node; 205, second encryption node. DETAILED DESCRIPTION

[0076] In order to enable technicians in this field to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments.

[0077] In the description of the embodiments of the present application, words such as "for example" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "for example" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "for example" or "for example" is intended to present related concepts in a specific way.

[0078] In the description of the embodiments of the present application, the meaning of the term "multiple" refers to two or more. For example, multiple systems refer to two or more systems, and multiple screen terminals refer to two or more screen terminals. In addition, the terms "first" and "second" are used for descriptive purposes only and cannot be understood as indicating or implying relative importance or implicitly indicating the indicated technical features. Thus, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. The terms "include", "comprise", "have" and their variations all mean "including but not limited to", unless otherwise specifically emphasized.

[0079] Data encryption is a key information security measure that effectively prevents unauthorized access and theft by encoding and converting data to make it difficult to understand and interpret during transmission or storage. While protecting privacy, preventing data leakage, and ensuring data integrity, encryption also provides necessary protection for modern information technology applications such as secure communications, online transactions, and cloud computing, helping organizations and individuals prevent various network attacks and improper use of data, and maintaining the security and trust of the digital environment.

[0080] For enterprises, data usually contains a large amount of sensitive information, including customer information, financial data, business secrets, research and development results, etc. The leakage of this information may lead to serious business losses, such as customer loss, competitive disadvantages, intellectual property risks, etc. Therefore, confidentiality is essential to maintaining the competitiveness and sound operation of enterprises. In addition, data leakage may also cause network security problems, such as malicious attacks and ransomware attacks. When the network security of an enterprise is threatened, data confidentiality can serve as an effective line of defense to reduce the risk of cyber attacks and ensure the stable and reliable operation of information systems.

[0081] Therefore, a method is needed to encrypt the data.

[0082] This embodiment discloses a data encryption method. Figure 1 , including the following steps S110-S180:

[0083] A data encryption method disclosed in the embodiment of the present application is applied to a data encryption processing system, referring to Figure 2 The data encryption processing system includes a server 201, multiple first-level encryption nodes 202, and multiple second-level encryption nodes 203, wherein the server 201 is connected to multiple first-level encryption nodes 202, and each first-level encryption node 202 is connected to multiple second-level encryption nodes 203. The server 201, the first-level encryption node 202, and the second-level encryption node 203 include but are not limited to electronic devices such as mobile phones, tablet computers, wearable devices, PCs (Personal Computers), etc., and can also be a background server 201 running a data encryption method. The server 201 can be implemented as an independent server 201 or a server 201 cluster composed of multiple servers 201.

[0084] S110 , the server 201 selects a preset number of first-level encryption nodes 202 from the connected multiple first-level encryption nodes 202 to obtain multiple first encryption nodes 204 .

[0085] When the user needs to encrypt the data to be encrypted, firstly, a preset number of the first-level encryption nodes 202 are selected from the connected multiple first-level encryption nodes 202 and set as the first encryption nodes 204. The data to be encrypted can be various types of data that the user needs to encrypt, including code data, text data, or image data. The preset number can be a value greater than 1, but needs to be less than the number of encryption nodes.

[0086] Then the server 201 obtains the user's biometric data through a pre-selected biometric technology (such as fingerprint, facial recognition, etc.). These biometric data are information data based on biometric technology, which are used to ensure that only the user can obtain access or complete preset operations, including identity recognition, etc. Using a preset method, the server 201 converts the biometric data into the user's private key. This process may involve a specific biometric data processing algorithm to ensure that the generated private key has sufficient security and uniqueness. For example, the hash value of the biometric data can be calculated to obtain a unique user private key. Using an asymmetric encryption algorithm, such as RSA, Elliptic Curve Cryptography (ECC), etc., the server 201 uses the private key generated by the user's biometric data to generate a corresponding public key. Asymmetric encryption algorithms usually involve a pair of keys, one of which is used for encryption (public key) and the other is used for decryption (private key). This ensures that only the user with the corresponding user private key can decrypt the data encrypted by the user's public key.

[0087] Generating a user's private key based on biometric data ensures that the private key is generated in accordance with the user's identity. This increases the security of the private key and reduces the risk of unauthorized access or theft of the private key. By using biometric data to generate private and public keys, the user's identity can be ensured to be unique. Even when the same preset method is used to generate private and public keys, the key pairs of different users are different due to the uniqueness of biometric data.

[0088] At the same time, the data to be encrypted also needs to be preprocessed. The server 201 receives the encryption request from the user and obtains the data to be encrypted from the user request. This can be any data that the user wants to transmit or store, such as code data, text data, or image data.

[0089] The server 201 replaces characters in the encrypted data according to preset rules. The preset corresponding rules include character replacement rules, that is, the corresponding relationship between the target replacement character and the target original character is defined. This can be a custom replacement rule, for example, replacing 4 with A, replacing j with ￥, etc. For each original character in the data to be processed, the corresponding target replacement character is selected for replacement according to the preset rules. In this way, the data to be processed after character replacement is generated. After the replacement operation, the data obtained is called the data to be processed. This step is to confuse the original data before data encryption to increase the security of the data.

[0090] By performing character replacement on the data to be encrypted before encryption, the security of the data can be increased. This pre-processing operation may help to confuse the data, making it difficult for attackers to understand the structure and content of the original data, thereby improving the confidentiality of the data.

[0091] S120 , the server 201 uses the user public key input by the user to encrypt the data to be processed to obtain first encrypted data, and then sends the first encrypted data to each first encryption node 204 .

[0092] The server 201 selects an asymmetric encryption algorithm suitable for a specific purpose. Common asymmetric encryption algorithms include RSA, ECC, etc. Security, performance, and applicable scenarios need to be considered when selecting an algorithm. The server 201 uses the user public key provided by the user to encrypt the data to be processed. The encryption process is to use the user public key to convert the data, generate a ciphertext, and obtain the first encryption node 204. In this way, only the user with the corresponding user private key can decrypt and obtain the original data. After the server 201 encrypts the data to be processed to obtain the first encrypted data, it copies the first encrypted data into multiple copies and sends them to multiple first encryption nodes 204 respectively.

[0093] S130 , the first encryption node 204 obtains the second device identification and the second node public key of the second encryption node 205 .

[0094] Reference Figure 2 Each primary encryption node 202 is connected to the server 201, and each primary encryption node 202 is connected to multiple secondary encryption nodes 203. Therefore, the server 201 is connected to multiple primary encryption nodes 202, and each primary encryption node 202 is connected to the corresponding secondary encryption node 203, so that the server 201 can communicate with multiple secondary encryption nodes 203.

[0095] After receiving the first encrypted data, the first encryption node 204 sends a request to the second encryption node 205 to obtain the device identification and node public key of the second encryption node 205. Among them, the second encryption node 205 is any one of the multiple secondary encryption nodes 203. In a data encryption processing system, each primary encryption node 202 and secondary encryption node 203 has a unique node public key and node private key, wherein the node public key is used to encrypt data, and the node private key is used to decrypt the data encrypted by the node public key. Similarly, in a data encryption processing system, each primary encryption node 202 and secondary encryption node 203 has its own unique device identification, and the device identification is information used to uniquely identify and identify the device. It is a unique identifier, usually associated with a specific hardware device or virtual entity. The device identification can be a combination of letters and numbers, or an address character, etc.

[0096] The second encryption node 205 sends its own second device identification and second node public key to the first encryption node 204 , so that the first encryption node 204 obtains the second device identification and second node public key of the second encryption node 205 .

[0097] S140, the first encryption node 204 embeds the second device identifier into the first encrypted data to obtain first processed data.

[0098] The first encryption node 204 uses a suitable random number generation algorithm to generate a random positive integer, ensuring that its value is less than the length value of the first encrypted data. This can be achieved by calculating the length value of the first encrypted data and then generating a random integer between 0 and the length value. Using the generated random positive integer, the first encryption node 204 determines the embedding position. This position can be an index value in the first encrypted data, indicating the position at which the second device identifier is embedded. Ensure that the value of the embedding position is the same as the generated random positive integer. At the determined embedding position, the first encryption node 204 inserts the data of the second device identifier into the first encrypted data. This operation can be completed by inserting the binary data or string data of the second device identifier at a specific position of the first encrypted data. After insertion, the length of the first encrypted data will become the original length plus the length of the second device identifier. After completing the embedding operation, the obtained data is the first processed data. This data contains the second device identifier, while the other parts remain unchanged.

[0099] S150, the first encryption node 204 uses the second node public key to encrypt the first processed data to obtain second encrypted data.

[0100] The first encryption node 204 uses the public key of the second encryption node 205 to encrypt the first processed data, which can use an asymmetric encryption algorithm, such as RSA. After the encryption is completed, the obtained data is the second encrypted data, which is the result of encryption by the second node public key of the second encryption node 205 and can only be decrypted by the second node private key of the second encryption node 205. It should be noted that the encryption algorithm used by the server 201 and the encryption algorithm used by the first encryption node 204 can be the same or different, but different devices need to fix an algorithm because the algorithm used for decryption needs to be the same as the algorithm used for decryption.

[0101] By adopting the above technical solution, the server 201 selects multiple first-level encryption nodes 202 as the first encryption nodes 204 to participate in encryption. This distributed encryption method increases the security of the entire system. Even if a first encryption node 204 is attacked or cracked, causing the encryption node to be unable to encrypt, other encryption nodes can still provide encryption services. Through multi-level encryption, from user public key encryption to first-level encryption node 202 encryption, the data undergoes multiple encryption operations. Each layer of encryption increases the security of the data, raises the threshold for cracking the data, and makes it more difficult for unauthorized users to obtain the original data. The first encryption node 204 introduces dynamic identification information by obtaining the device identification of the second encryption node 205 and embedding it into the first encrypted data. This helps to improve the uniqueness and traceability of the data, while increasing the difficulty for attackers to guess or simulate device identification.

[0102] S160 , the first encryption node 204 sends the second encrypted data, the first device identifier, and the first node public key to the second encryption node 205 .

[0103] After the first-level encryption node 202 completes encryption, the degree of data encryption is already high, but it can be further encrypted by the second-level encryption node 203 to improve the security of the data. Each first encryption node 204 that has completed encryption randomly selects a second-level encryption node 203 from the multiple second-level encryption nodes 203 connected to it as the second encryption node 205. Then the first encryption node 204 sends the encrypted second encrypted data, its own first device identification and the first node public key to the second encryption node 205.

[0104] S170, the second encryption node 205 embeds the first device identifier into the second encrypted data to obtain second processed data.

[0105] The second encryption node 205 uses a suitable random number generation algorithm to generate a random positive integer, ensuring that its value is less than the length value of the second encrypted data. This can be achieved by calculating the length value of the second encrypted data and then generating a random integer between 0 and the length value. Using the generated random positive integer, the second encryption node 205 determines the embedding position. This position can be an index value in the second encrypted data, indicating the position at which the first device identifier is embedded. Ensure that the value of the embedding position is the same as the generated random positive integer. At the determined embedding position, the second encryption node 205 inserts the data of the first device identifier into the second encrypted data. This operation can be completed by inserting the binary data or string data of the first device identifier at a specific position of the second encrypted data. After insertion, the length of the second encrypted data will become the original length plus the length of the first device identifier. After completing the embedding operation, the obtained data is the second processed data. This data contains the first device identifier, while the other parts remain unchanged.

[0106] By generating a random positive integer and using it as the embedding position, dynamic embedding position selection is achieved, which increases the difficulty for attackers to guess or simulate the embedding position and improves the security of the encryption process. Embedding the second device identifier helps maintain the uniqueness and traceability of the data. The insertion position of the device identifier is dynamically generated. The dynamic embedding position can resist statistical analysis because the embedding position is not fixed. Attackers cannot discover patterns or rules by analyzing fixed embedding positions, which increases the complexity of the attack.

[0107] S180, the second encryption node 205 uses the first node public key to encrypt the second processed data to obtain candidate encrypted data.

[0108] The second encryption node 205 uses the public key of the first encryption node 204 to encrypt the second processed data, which can use an asymmetric encryption algorithm, such as RSA. After the encryption is completed, the obtained data is the first candidate data, which is the result of encryption by the first node public key of the first encryption node 204 and can only be decrypted by the first node private key of the first encryption node 204. It should be noted that the encryption algorithm used by the server 201 and the encryption algorithm used by the first encryption node 204, as well as the encryption algorithm used by the second encryption node 205 can be the same or different, but different devices need to fix an algorithm because the algorithm used for decryption needs to be the same as the algorithm used for decryption.

[0109] On the basis of user public key encryption and first encryption node 204 encryption, the second encryption node 205 is introduced to participate in the encryption. The second encryption node 205 plays a role of further encryption and processing in this process, which increases the security of data encryption. After the second encryption node 205 embeds the first device identifier into the second encrypted data, the specific identifier of the original data is retained, which is helpful for further data tracking and management. The second encryption node 205 encrypts by using the first node public key, and encrypts by using the second node public key in combination with the first encryption node 204, so that the first encryption node 204 and the second encryption node 205 both participate in the encryption process, and the subsequent decryption process also needs to be involved, which increases the complexity of the attack.

[0110] Reference Figure 3 , the server 201 replaces characters in the encrypted data according to the preset corresponding rules to obtain the data to be processed. Then the server 201 encrypts the data to be processed using the user's public key to obtain the first encrypted data. The server 201 then selects a preset number of first encryption nodes 204 from the multiple first-level encryption nodes 202, and sends the first encrypted data to the multiple first encryption nodes 204 respectively, so that each first encryption node 204 receives a first encrypted data, and then there are multiple first encrypted data.

[0111] Then, each first encryption node 204 selects a secondary encryption node 203 from the connected multiple secondary encryption nodes 203 as the second encryption node 205. The first encryption node 204 embeds the second device identifier of the second encryption node 205 into the first processed data. Figure 3 , including the second device identifier a, the second device identifier b and the second device identifier c. Each first encryption node 204 then uses the second node public key corresponding to the second encryption node 205 to encrypt the first processed data to obtain the second encrypted data. At this time, each first encryption node 204 will generate a second encrypted data, and different first encryption nodes 204 use different second node public keys. Figure 3 , including the second node public key a, the second node public key b and the second node public key c, and then obtain multiple different second encrypted data, including the second encrypted data a, the second encrypted data b and the second encrypted data c.

[0112] The second encryption nodes 205 then send their respective first device identifiers, first node public keys, and the generated second encrypted data to the corresponding second encryption nodes 205. Each second encryption node 205 embeds the received first device identifier according to the received second encrypted data, referring to Figure 3 , since the first device identifiers of different first encryption nodes 204 are different, including first device identifier a, first device identifier b and first device identifier c. The first device identifier a is respectively embedded in the second encrypted data a to obtain the second processed data a, the first device identifier b is embedded in the second encrypted data b to obtain the second processed data b, and the first device identifier c is embedded in the second encrypted data c to obtain the second processed data c. Finally, each second encryption node 205 uses the received first node public key to encrypt the second processed data to obtain the alternative encrypted data. Figure 3 , because there are different first node public keys, including first node public key a, first node public key b and first node public key c. Then the first node public key a is used to encrypt the second processed data a to obtain the alternative encrypted data a, the first node public key b is used to encrypt the second processed data b to obtain the alternative encrypted data b, and the first node public key c is used to encrypt the second processed data c to obtain the alternative encrypted data c. In this way, multiple groups of different alternative encrypted data are generated, and any first encryption node 204 and second encryption node 205 cannot decrypt the alternative encrypted data generated by other first encryption nodes 204 and second encryption nodes 205. However, if the correct decryption path is used, different alternative encrypted data can be decrypted to obtain the original data to be encrypted. And for a single backup data, it must be decrypted by the server 201, the first encryption node 204 and the second encryption node 205 involved in the encryption. If one of the three is missing, it cannot be decrypted.

[0113] If the user needs to decrypt the alternative encrypted data, a decryption request is initiated, and the server 201 sends a decryption instruction to the first encryption node 204. After receiving the decryption instruction, the first encryption node 204 uses the first node private key corresponding to the first node public key to decrypt the alternative encrypted data to obtain the second processed data. This step requires the use of the same asymmetric encryption algorithm as the encryption process, and only the private key of the first node can decrypt the data encrypted by its public key. Then the first encryption node 204 performs an identification extraction operation on the second processed data, and performs identification reverse extraction according to the embedding rules used in the data encryption process. How many bits of the device identification code are embedded in how many positions of the encrypted data, then how many bits of the device identification code are extracted from how many positions of the processed data. For example, a 32-bit device identification code is embedded at the 1650th position of the encrypted data. Then the 32-bit device identification code is extracted from the 1650th position of the processed data.

[0114] According to the extraction result, the first encryption node 204 determines whether the first device identifier can be successfully extracted. The first device identifier is the device identifier of the first encryption node 204. Therefore, it is only necessary to compare the extracted device identifier code with the local device identifier code to determine whether the two are consistent to determine whether the first device identifier can be successfully extracted. If the first device identifier is successfully extracted, it means that the first device identifier exists in the second processed data. If it fails, it means that the identifier cannot be extracted. If it is determined that the first device identifier can be extracted, the first encryption node 204 deletes the first device identifier from the first processed data to obtain the second encrypted data. Finally, the first encryption node 204 returns the obtained second encrypted data to the second encryption node 205.

[0115] By using the first node private key corresponding to the first node's public key in the process of sending the decryption instruction by the server 201, a secure decryption process is achieved. Only the first encryption node 204 with the corresponding private key can decrypt the alternative encrypted data, ensuring the security of the decryption operation. The first encryption node 204 extracts and judges the decrypted second processed data to determine whether the first device identifier can be extracted. This step ensures that while decrypting, it is possible to know whether the first device identifier is included in the data before decryption, that is, to determine whether the data is the data processed by the first encryption node 204 during the encryption process. By performing identifier extraction and judgment during the decryption process, unauthorized access can be prevented while performing the decryption operation. Only under certain conditions (such as being able to extract the device identifier) ​​is the subsequent decryption steps allowed to proceed, which increases the security of the decryption process.

[0116] The second encryption node 205 uses the second node private key corresponding to the second node public key to decrypt the second encrypted data to obtain the second processed data. This step requires the use of the same asymmetric encryption algorithm as the encryption process, and only the private key of the second node can decrypt the data encrypted by its public key. Then the second encryption node 205 performs the operation of identity extraction on the second processed data, and performs identity reverse extraction according to the embedding rule used in the data encryption process. According to the extraction result, the second encryption node 205 determines whether the second device identity can be successfully extracted. The second device identity is the device identity of the second encryption node 205 itself, so it only needs to compare the extracted device identity code with the local device identity code to determine whether the two are consistent to determine whether the second device identity can be successfully extracted. If the second device identity is successfully extracted, it means that the second device identity exists in the second processed data. If it fails, it means that the identity cannot be extracted. If it is determined that the second device identity can be extracted, the second encryption node 205 deletes the second device identity from the second processed data to obtain the first encrypted data. Finally, the second encryption node 205 returns the obtained first encrypted data to the server 201, which can be further processed by the server 201.

[0117] By using the second node's key to decrypt the second encrypted data at the second encryption node 205, the security of the decryption operation is achieved. Only the second encryption node 205 with the corresponding private key can decrypt the data, ensuring the security of the decryption. The second encryption node 205 extracts and judges the decrypted second processed data to determine whether the second device identifier can be extracted. This step ensures that while decrypting, it is possible to know whether the second device identifier is included in the data before decryption, that is, to determine whether the data is the data processed by the second encryption node 205 during the encryption process. By performing identifier extraction and judgment during the decryption process, unauthorized access can be prevented while performing the decryption operation. Only under certain conditions (such as being able to extract the device identifier) ​​is the subsequent decryption steps allowed to proceed, increasing the security of the decryption process.

[0118] After receiving the first encrypted data, the server 201 uses the user's private key to decrypt the data. Since the first encrypted data is obtained by encrypting the user's public key, the data can only be decrypted if the user has the corresponding private key. After completing the decryption operation, the data obtained by the server 201 is the data to be processed. Finally, the server 201 searches for the corresponding target original character for each target replacement character in the data to be processed according to the preset corresponding rules and replaces it. For example, the target original character a corresponds to the target replacement character 7, then all 7s in the data to be processed are replaced with a. After the replacement is completed, the initial data to be encrypted can be obtained.

[0119] This embodiment also discloses a data encryption system. Figure 2 , including a server 201, a plurality of first-level encryption nodes 202, and a plurality of second-level encryption nodes 203, wherein:

[0120] The server 201 is used to select a preset number of first-level encryption nodes 202 from the connected plurality of first-level encryption nodes 202 to obtain a plurality of first encryption nodes 204;

[0121] The server 201 is used to encrypt the data to be processed using the user public key input by the user to obtain first encrypted data, and then send the first encrypted data to each first encryption node 204;

[0122] The first encryption node 204 is used to obtain a second device identifier and a second node public key of a second encryption node 205, where the second encryption node 205 is any one of the multiple secondary encryption nodes 203 connected to the first encryption node 204;

[0123] The first encryption node 204 is used to embed the second device identifier into the first encrypted data to obtain the first processed data;

[0124] The first encryption node 204 is used to encrypt the first processed data using the second node public key to obtain second encrypted data.

[0125] In a possible implementation, the first encryption node 204 is used to send the second encrypted data, the first device identifier and the first node public key to the second encryption node 205, the first device identifier is the device identifier of the first encryption node 204, and the first node public key is the node public key of the first encryption node 204;

[0126] The second encryption node 205 is used to embed the first device identifier into the second encrypted data to obtain second processed data;

[0127] The second encryption node 205 is used to encrypt the second processed data using the first node public key to obtain the candidate encrypted data.

[0128] In a possible implementation, the server 201 is used to obtain the data to be encrypted according to the encryption request of the user;

[0129] Server 201 is used to replace the target original character with the target replacement character according to the preset corresponding rule to obtain the data to be processed, the target replacement character is any one of the multiple replacement characters, the target original character is any one of the multiple original characters contained in the data to be encrypted, and the preset corresponding rule is the corresponding rule between the replacement character and the original character.

[0130] In a possible implementation, the first encryption node 204 is used to generate a random positive integer, the value of the random positive integer is less than the length value of the first encrypted data;

[0131] The first encryption node 204 is used to determine the embedding position of the second device identifier according to the random positive integer, and the value of the embedding position is the same as the value of the random positive integer;

[0132] The first encryption node 204 is used to insert the data of the second device identification into the embedded position of the first encrypted data to obtain first processed data.

[0133] In a possible implementation, the server 201 is used to send a decryption instruction to the first encryption node 204 according to a decryption request of the user;

[0134] The first encryption node 204 is used to decrypt the candidate encrypted data according to the decryption instruction using the first node private key corresponding to the first node public key to obtain second processed data;

[0135] The first encryption node 204 is used to extract the identifier of the second processed data and determine whether the first device identifier can be extracted. If it is determined that the first device identifier can be extracted, the first device identifier is deleted from the first processed data to obtain the second encrypted data.

[0136] In a possible implementation, the first encryption node 204 is used to send the second encrypted data to the second encryption node 205;

[0137] The second encryption node 205 is used to decrypt the second encrypted data using the second node private key corresponding to the second node public key to obtain second processed data;

[0138] The second encryption node 205 is used to extract the identifier of the second processed data and determine whether the second device identifier can be extracted. If it is determined that the second device identifier can be extracted, the second device identifier is deleted from the second processed data to obtain the first encrypted data.

[0139] The second encryption node 205 is used to send the first encrypted data to the server 201;

[0140] The server 201 is used to decrypt the first encrypted data using the user private key corresponding to the user public key to obtain data to be processed.

[0141] In a possible implementation, the server 201 is used to replace the target replacement character with the target original character according to a preset corresponding rule to obtain the data to be encrypted.

[0142] In a possible implementation, the server 201 is used to obtain biometric data of a user input by a user, where the biometric data is based on biometric recognition technology and is used to ensure that only the user can obtain information data for accessing or completing a preset operation;

[0143] The server 201 is used to generate a user private key according to the biometric data based on a preset method, and then use an asymmetric encryption algorithm to generate a user public key according to the user private key.

[0144] The above is only an exemplary embodiment of the present disclosure, and the scope of the present disclosure cannot be limited thereto. That is, any equivalent changes and modifications made according to the teachings of the present disclosure are still within the scope of the present disclosure. After considering the disclosure of the specification and the truth of practice, it will be easy for those skilled in the art to think of other embodiments of the present disclosure. This application is intended to cover any modification, use or adaptation of the present disclosure, which follows the general principles of the present disclosure and includes common knowledge or customary technical means in the technical field that are not recorded in the present disclosure. The description and examples are regarded as exemplary only, and the scope and spirit of the present disclosure are defined by the claims.

Claims

1. A data encryption processing method, characterized in that: Applied to a data encryption processing system, the data encryption processing system comprises a server (201), a plurality of first-level encryption nodes (202) and a plurality of second-level encryption nodes (203), the method comprising: The server (201) selects a preset number of first-level encryption nodes (202) from the connected plurality of first-level encryption nodes (202) to obtain a plurality of first encryption nodes (204); The server (201) encrypts the data to be processed using a user public key input by a user to obtain first encrypted data, and then sends the first encrypted data to each of the first encryption nodes (204); The first encryption node (204) obtains a second device identification and a second node public key of a second encryption node (205), wherein the second encryption node (205) is any one of the plurality of secondary encryption nodes (203) connected to the first encryption node (204); The first encryption node (204) embeds the second device identifier into the first encrypted data to obtain first processed data; The first encryption node (204) encrypts the first processed data using the second node public key to obtain second encrypted data.

2. A data encryption processing method according to claim 1, characterized in that: After the first encryption node (204) encrypts the first processed data using the second node public key to obtain second encrypted data, the method further includes: The first encryption node (204) sends the second encrypted data, a first device identifier and a first node public key to the second encryption node (205), wherein the first device identifier is a device identifier of the first encryption node (204), and the first node public key is a node public key of the first encryption node (204); The second encryption node (205) embeds the first device identifier into the second encrypted data to obtain second processed data; The second encryption node (205) uses the first node public key to encrypt the second processed data to obtain candidate encrypted data.

3. A data encryption processing method according to claim 1, characterized in that: Before the server (201) uses the user public key to encrypt the data to be processed to obtain the first encrypted data, the method further comprises: The server (201) obtains the data to be encrypted according to the encryption request of the user; The server (201) replaces the target original character with a target replacement character according to a preset corresponding rule to obtain the data to be processed, wherein the target replacement character is any one of a plurality of replacement characters, and the target original character is any one of a plurality of original characters included in the data to be encrypted, and the preset corresponding rule is a corresponding rule between the replacement character and the original character.

4. A data encryption processing method according to claim 1, characterized in that: The first encryption node (204) embeds the second device identifier into the first encrypted data to obtain first processed data, specifically including: The first encryption node (204) generates a random positive integer, the value of which is smaller than the length of the first encrypted data; The first encryption node (204) determines the embedding position of the second device identifier according to the random positive integer, the value of the embedding position being the same as the value of the random positive integer; The first encryption node (204) inserts the data of the second device identification into the embedded position of the first encrypted data to obtain the first processed data.

5. A data encryption processing method according to claim 2, characterized in that: After the second encryption node (205) encrypts the second processed data using the first node public key to obtain candidate encrypted data, the method further includes: The server (201) sends a decryption instruction to the first encryption node (204) according to the decryption request of the user; The first encryption node (204) decrypts the candidate encrypted data according to the decryption instruction using the first node private key corresponding to the first node public key to obtain the second processed data; The first encryption node (204) extracts the identifier of the second processed data to determine whether the first device identifier can be extracted. If it is determined that the first device identifier can be extracted, the first device identifier is deleted from the first processed data to obtain the second encrypted data.

6. A data encryption processing method according to claim 2, characterized in that: The method further comprises: The first encryption node (204) sends the second encrypted data to the second encryption node (205); The second encryption node (205) uses the second node private key corresponding to the second node public key to decrypt the second encrypted data to obtain the second processed data; The second encryption node (205) extracts the identifier of the second processed data, determines whether the second device identifier can be extracted, and if it is determined that the second device identifier can be extracted, deletes the second device identifier from the second processed data to obtain the first encrypted data; The second encryption node (205) sends the first encrypted data to the server (201); The server (201) uses the user private key corresponding to the user public key to decrypt the first encrypted data to obtain the data to be processed.

7. A data encryption processing method according to claim 3, characterized in that: The method further comprises: The server (201) replaces the target replacement character with the target original character according to the preset corresponding rule to obtain the data to be encrypted.

8. A data encryption processing method according to claim 6, characterized in that: Before the server (201) obtains the user public key input by the user, the method further comprises: The server (201) obtains biometric data of the user input by the user, wherein the biometric data is based on biometric recognition technology and is used to ensure that only the user can obtain information data for accessing or completing a preset operation; The server (201) generates a user private key according to the biometric data based on a preset method, and then uses an asymmetric encryption algorithm to generate a user public key according to the user private key.

9. A data encryption processing system, characterized in that: The system comprises a server (201), a plurality of first-level encryption nodes (202) and a plurality of second-level encryption nodes (203), wherein: The server (201) is used to select a preset number of first-level encryption nodes (202) from the connected plurality of first-level encryption nodes (202) to obtain a plurality of first encryption nodes (204); The server (201) is used to encrypt the data to be processed using a user public key input by a user to obtain first encrypted data, and then send the first encrypted data to each of the first encryption nodes (204); The first encryption node (204) is used to obtain a second device identification and a second node public key of a second encryption node (205), wherein the second encryption node (205) is any one of the plurality of second-level encryption nodes (203) connected to the first encryption node (204); The first encryption node (204) is used to embed the second device identifier into the first encrypted data to obtain first processed data; The first encryption node (204) is used to encrypt the first processed data using the second node public key to obtain second encrypted data.

10. A data encryption processing system according to claim 9, characterized in that: The first encryption node (204) is used to send the second encrypted data, a first device identifier and a first node public key to the second encryption node (205), the first device identifier is a device identifier of the first encryption node (204), and the first node public key is a node public key of the first encryption node (204); The second encryption node (205) is used to embed the first device identifier into the second encrypted data to obtain second processed data; The second encryption node (205) is used to encrypt the second processed data using the first node public key to obtain alternative encrypted data.

Images