Data security defense method and system based on data encryption

Abstract

The invention belongs to the technical field of information security, and particularly discloses a data security defense method and system based on data encryption, and the method comprises the steps: carrying out the segmentation conversion processing and hash value calculation of a to-be-protected target data set, carrying out the synchronous iteration shift processing of a hash value, obtaining a plurality of secret key strings, and carrying out the protection of the to-be-protected target data set; the method comprises the following steps of: segmenting and converting serial number conversion data, encrypting the segmented and converted serial number conversion data by using each key string to obtain segmented encrypted data, storing each segmented encrypted data associated hash value into a database, receiving access request data of an access end, extracting an access verification code for mapping conversion, and performing permission verification based on the hash value to obtain the access request data of the access end. If the permission verification is not passed, data access is cut off to ensure data security, and if the permission verification is passed, data reverse processing is performed by using the hash value and the segmented encrypted data to obtain a target data set to be fed back to the access end, so that efficient and reliable data security protection management can be realized, and the security protection performance of the data is effectively improved.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology, and specifically relates to a data security defense method and system based on data encryption. Background Art

[0002] With the continuous development of information technology, information security issues have become increasingly important. Data management methods without protection or with weak protection are prone to data theft and data leakage. Existing data management methods mostly store and manage plaintext data in the database, and then implement database access verification based on the identity information verification of the access end. Plaintext data stored in the database can be viewed and retrieved after the identity information verification passes. This data protection management method has low data security protection performance and lacks an effective data access protection and control mechanism. It is easy to cause the leakage of all plaintext data in the database due to identity information leakage. Summary of the invention

[0003] The purpose of the present invention is to provide a data security defense method and system based on data encryption to solve the above-mentioned problems existing in the prior art.

[0004] In order to achieve the above object, the present invention adopts the following technical solutions:

[0005] In a first aspect, a data security defense method based on data encryption is provided, comprising:

[0006] Obtain the target data set to be protected, and perform sequential segmentation processing on the target data set to obtain a number of segmented data, perform hash calculation on the target data set to obtain a hash value;

[0007] Assigning each segment data a unique segment number according to the segment sequence, and performing data conversion processing on the corresponding segment data using the unique segment number to obtain corresponding segment conversion data, and combining the segment conversion data with the corresponding unique segment number to obtain number conversion data;

[0008] Perform synchronous iterative shift processing on each bit of the hash value, obtain a key string after each iterative shift, obtain several key strings after several iterative shifts, and assign a unique iteration number to each key string according to the iteration order;

[0009] Associating each key string with the corresponding number conversion data according to the unique iteration number and the unique segment number, and encrypting the associated number conversion data using the key string to obtain the corresponding segment encrypted data;

[0010] Each segmented encrypted data is marked with a unique iteration number corresponding to the data and stored in the database, and a hash value is stored in the database, and a data association is established between the hash value and each segmented encrypted data marked with a unique iteration number;

[0011] Receive access request data from the access end, and extract the access verification code from the access request data;

[0012] Perform mapping conversion processing on the access verification code to obtain the corresponding mapping verification code, and perform permission verification on the mapping verification code based on the hash value in the database;

[0013] When the mapping verification code permission check fails, the access end is cut off from the access. Otherwise, the encrypted data of each segment associated with the hash value is retrieved from the database, and each bit of the hash value is synchronously iterated and shifted to obtain several key strings, and each key string is assigned a unique iteration number according to the iteration order;

[0014] Decrypt the corresponding segmented encrypted data using each key string according to the unique iteration number to obtain each number conversion data;

[0015] Extracting a unique segment number and corresponding segment conversion data from the number conversion data, and performing reverse data conversion processing on the corresponding segment conversion data using the unique segment number to obtain segment data corresponding to each unique segment number;

[0016] The segmented data are combined according to the unique segment numbers corresponding to the segmented data to obtain a target data set, and the target data set is sent to the access end.

[0017] In one possible design, before receiving the access request data from the access terminal, the method further includes:

[0018] Extracting a plurality of key-value pairs based on the hash value, wherein the keys in the key-value pairs represent the corresponding number of bits of the hash value, and the values ​​in the key-value pairs represent the numerical values ​​of the corresponding number of bits of the hash value;

[0019] A mapping verification code is composed of several key-value pairs, and the mapping verification code is subjected to mapping conversion processing to obtain a corresponding access verification code, which is encrypted and sent to the corresponding access end.

[0020] In a possible design, the permission verification of the mapping verification code based on the hash value in the database includes:

[0021] Extract several key-value pairs from the mapping verification code and retrieve the hash value from the database;

[0022] Determine the number of digits corresponding to the hash value according to the key in the key-value pair, and compare the value in the key-value pair with the number of digits corresponding to the hash value. If the two are consistent, the corresponding key-value pair is verified;

[0023] When all key-value pairs are verified, it is determined that the mapping verification code permission check has passed, otherwise, it is determined that the mapping verification code permission check has failed.

[0024] In a possible design, the target data set is sequentially segmented to obtain a plurality of segmented data, including:

[0025] Construct a sliding window and set the window size and window moving step of the sliding window;

[0026] Based on the window size and the window moving step, the target data set is sequentially segmented using a sliding window to obtain a number of segmented data, and there is data overlap between two adjacent segmented data.

[0027] In a possible design, the use of the unique segment number to perform data conversion processing on the corresponding segment data to obtain the corresponding segment conversion data includes:

[0028] Determine each bit of data in the segmented data;

[0029] Subtracting the unique segment number from each bit of the segment data respectively obtains data as conversion data for each bit of the segment data;

[0030] Each bit of the segmented data is replaced by the conversion data of each bit of the segmented data to obtain segmented conversion data corresponding to the segmented data.

[0031] In a possible design, each bit of the hash value is subjected to synchronous iterative shift processing, and a key string is obtained after each iterative shift. After several iterative shifts, several key strings are obtained, including:

[0032] Each bit of the hash value is synchronously and iteratively cyclically shifted left or right. Each iteration cyclically shifts left or right by a set number of bits. After each cyclic left shift or cyclic right shift, a key string is obtained. After several iterations, several key strings are obtained.

[0033] In a possible design, the use of a key string to encrypt the associated number conversion data to obtain corresponding segmented encrypted data includes:

[0034] The AES encryption algorithm is used to encrypt the associated number conversion data using the corresponding key string to obtain the corresponding segmented encrypted data.

[0035] In a possible design, the mapping conversion process is performed on the access verification code to obtain the corresponding mapping verification code, including:

[0036] Substituting the access verification code into a preset mapping conversion table, performing mapping conversion processing on each character of the access verification code to obtain a mapping character for each character in the access verification code, wherein the mapping conversion table includes a number of characters and mapping characters associated with each character;

[0037] Each character of the access verification code is replaced by a mapping character of each character in the access verification code to obtain a mapping verification code corresponding to the access verification code.

[0038] In a second aspect, a data security defense system based on data encryption is provided, comprising a data splitting unit, a data conversion unit, an iterative shifting unit, a data encryption unit, a data storage unit, an access receiving unit, a permission verification unit, a defense parsing unit, a data decryption unit, a reverse conversion unit and a data combination unit, wherein:

[0039] A data splitting unit is used to obtain a target data set to be protected, and sequentially segment the target data set to obtain a number of segmented data, and perform hash calculation on the target data set to obtain a hash value;

[0040] A data conversion unit, used to assign a unique segment number to each segment data according to the segment sequence, and use the unique segment number to perform data conversion processing on the corresponding segment data to obtain corresponding segment conversion data, and combine the segment conversion data with the corresponding unique segment number to obtain number conversion data;

[0041] An iterative shift unit is used to perform synchronous iterative shift processing on each bit of the hash value, and obtain a key string after each iterative shift. After several iterative shifts, several key strings are obtained, and each key string is assigned a unique iteration number according to the iteration order;

[0042] A data encryption unit, used to associate each key string with the corresponding number conversion data according to the unique iteration number and the unique segment number, and encrypt the associated number conversion data using the key string to obtain the corresponding segment encrypted data;

[0043] The data storage unit is used to store each segmented encrypted data into a database after marking the corresponding unique iteration number, and store the hash value into the database, and establish a data association between the hash value and each segmented encrypted data marked with the unique iteration number;

[0044] An access receiving unit, used to receive access request data from an access terminal and extract an access verification code from the access request data;

[0045] The permission verification unit is used to perform mapping conversion processing on the access verification code to obtain a corresponding mapping verification code, and perform permission verification on the mapping verification code based on the hash value in the database;

[0046] The defense parsing unit is used to cut off the access of the access terminal when the mapping verification code authority check fails. Otherwise, the encrypted data of each segment associated with the hash value is retrieved from the database, and each bit of the hash value is synchronously iterated and shifted to obtain a number of key strings, and each key string is assigned a unique iteration number according to the iteration order;

[0047] A data decryption unit, used to decrypt the corresponding segmented encrypted data using each key string according to the unique iteration number to obtain each number conversion data;

[0048] A reverse conversion unit, used to extract a unique segment number and corresponding segment conversion data from the number conversion data, and perform reverse data conversion processing on the corresponding segment conversion data using the unique segment number to obtain segment data corresponding to each unique segment number;

[0049] The data combining unit is used to combine the segmented data according to the unique segmented numbers corresponding to the segmented data to obtain a target data set, and send the target data set to the access end.

[0050] In a third aspect, a data security defense system based on data encryption is provided, comprising:

[0051] A memory for storing instructions;

[0052] A processor is used to read the instructions stored in the memory and execute any one of the methods described in the first aspect according to the instructions.

[0053] In a fourth aspect, a computer-readable storage medium is provided, wherein instructions are stored on the computer-readable storage medium, and when the instructions are executed on a computer, the computer executes any one of the methods described in the first aspect. In addition, a computer program product is provided, and when the computer program product is executed on a computer, the computer executes any one of the methods described in the first aspect.

[0054] Beneficial effect: The present invention performs segmented conversion processing and hash value calculation on the target data set to be protected, performs synchronous iterative shift processing on the hash value, obtains several key strings, and uses each key string to encrypt the number conversion data after segmented conversion to obtain segmented encrypted data, and then stores the associated hash value of each segmented encrypted data in the database, and then receives the access request data of the access end, extracts the access verification code for mapping conversion processing, and performs permission verification based on the hash value. If the permission verification fails, data access is cut off to ensure data security. If the permission verification passes, the hash value and each segmented encrypted data are used to perform data reverse processing to obtain the target data set and feed it back to the access end, so as to realize efficient and reliable data security protection management. The present invention can effectively improve the security protection performance of data through corresponding data conversion, key acquisition, group encryption and access verification design, ensure high reliability management and safe access utilization of data, and effectively prevent data leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0056] Figure 1 This is a schematic diagram of the steps of the method in Example 1 of the present invention;

[0057] Figure 2 This is a schematic diagram of the structure of the system in Example 2 of the present invention;

[0058] Figure 3 Schematic diagram of the system structure in Example 3 of the present invention. DETAILED DESCRIPTION

[0059] It should be noted that the description of these embodiments is used to help understand the present invention, but does not constitute a limitation of the present invention. The specific structures and functional details disclosed herein are only used to describe the exemplary embodiments of the present invention. However, the present invention can be embodied in many alternative forms, and it should not be understood that the present invention is limited to the embodiments set forth herein.

[0060] It should be understood that, unless otherwise clearly specified and limited, the term "connection" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the embodiments can be understood according to specific circumstances.

[0061] In the following description, certain details are provided to facilitate a complete understanding of the example embodiments. However, it will be appreciated by those of ordinary skill in the art that the example embodiments may be implemented without these certain details. For example, devices may be shown in block diagrams to avoid obscuring the examples with unnecessary details. In other embodiments, well-known processes, structures, and techniques may not be shown in unnecessary detail to avoid obscuring the embodiments.

[0062] Embodiment 1:

[0063] This embodiment provides a data security defense method based on data encryption, which can be applied to corresponding data management servers, such as Figure 1 As shown, the method comprises the following steps:

[0064] S1. Obtain the target data set to be protected, and sequentially segment the target data set to obtain a number of segmented data, perform hash calculation on the target data set to obtain a hash value.

[0065] In the specific implementation, the server first obtains the target data set to be protected, and then performs sequential segmentation processing on the target data set to be protected. The sequential segmentation processing process includes: constructing a sliding window, and setting the window size and window moving step of the sliding window; based on the window size and window moving step, the sliding window is used to perform sequential segmentation processing on the target data set to obtain a number of segmented data, and there is data overlap between two adjacent segmented data. For example, if the target data set is 123456789, the window size of the sliding window is 3, and the moving step is 2, then the sliding window is used for sequential segmentation processing, and the segmented data are 123, 345, 567 and 789 respectively, and so on. By making the data overlap between two adjacent segmented data, it is convenient to quickly connect and reorganize the data according to the overlapping data when the segmented data is reorganized later. At the same time, the server also performs hash calculation on the target data set, such as using the MD5 algorithm to perform hash calculation on the target data set to obtain the corresponding 128-bit hash value.

[0066] S2. assign a unique segment number to each segment data according to the segment sequence, and use the unique segment number to perform data conversion processing on the corresponding segment data to obtain corresponding segment conversion data, and combine the segment conversion data with the corresponding unique segment number to obtain number conversion data.

[0067] In specific implementation, the server assigns each segmented data a unique segment number, such as 1, 2, 3, etc., in sequence according to the order of segmentation, and then uses the unique segment number to perform data conversion processing on the corresponding segmented data to obtain the corresponding segmented conversion data. The process includes: subtracting the unique segment number from each bit of the segmented data to obtain the data obtained as the conversion data of each bit of the segmented data. Then replace each bit of the segmented data with the conversion data of each bit of the segmented data to obtain the segmented conversion data corresponding to the segmented data. For example, if the segmented data is 123 and the unique segment number is 1, the conversion data of each bit of the segmented data are 1-1=0, 2-1=1 and 3-1=2 respectively, and the segmented conversion data corresponding to the segmented data is 012, and so on. Next, the server combines the segment conversion data with the corresponding unique segment number to obtain number conversion data. For example, the segment conversion data is 012, and the corresponding unique segment number is 1. The combination of the two can put the unique segment number 1 before the segment conversion data to obtain number conversion data 1012, and so on.

[0068] S3. Perform synchronous iterative shift processing on each bit of the hash value, obtain a key string after each iterative shift, obtain several key strings after several iterative shifts, and assign each key string a unique iteration number according to the iteration order.

[0069] In specific implementation, the server can perform cyclic left shift or cyclic right shift processing on each bit of the hash value synchronously and iteratively, and each iteration performs cyclic left shift or cyclic right shift by a set number of bits. After each iteration, a key string is obtained after cyclic left shift or cyclic right shift, and several key strings are obtained after several iterations. The server assigns a unique iteration number to each key string according to the iteration order of the iterative shift, such as 1, 2, 3...etc.

[0070] S4. Associate each key string with the corresponding number conversion data according to the unique iteration number and the unique segment number, and use the key string to encrypt the associated number conversion data to obtain the corresponding segment encrypted data.

[0071] In specific implementation, the server associates each key string with the corresponding number conversion data according to the unique iteration number and the unique segment number, including associating the key string with the number conversion data that matches the unique iteration number and the unique segment number. For example, if the unique iteration number of a key string is 1 and the unique segment number of a number conversion data is also 1, the two match, and the key string is associated with the number conversion data, and so on. Then, the AES encryption algorithm is used to encrypt the associated number conversion data using the corresponding key string to obtain the corresponding segment encrypted data.

[0072] S5. Each segmented encrypted data is marked with a unique iteration number corresponding to the data and stored in the database, and the hash value is stored in the database, and a data association is established between the hash value and each segmented encrypted data marked with a unique iteration number.

[0073] In specific implementation, the server marks each segmented encrypted data with the corresponding unique iteration number and stores it in the database, and also stores the hash value in the database, and establishes a data association between the hash value and the segmented encrypted data marked with the unique iteration number, so that each segmented encrypted data can be retrieved from the database according to the hash value later.

[0074] S6. Receive access request data from the access end, and extract the access verification code from the access request data.

[0075] In specific implementation, before receiving the access request data from the access terminal, the server can extract several key-value pairs based on the hash value, where the key in the key-value pair represents the corresponding digit of the hash value, and the value in the key-value pair represents the numerical value of the corresponding digit of the hash value. For example, if the key-value pair is 10-9, the key is 10, which represents the 10th digit in the hash value, and the value is 9, which represents the 10th digit in the hash value is 9, and so on; then, a mapping verification code is composed using several key-value pairs, and the mapping verification code is mapped and converted to obtain the corresponding access verification code, such as substituting the mapping verification code into a preset mapping conversion table, and mapping and converting each character of the mapping verification code to obtain the corresponding access verification code, and finally encrypting the access verification code and sending it to the corresponding access terminal. In the data access stage of the access terminal, after receiving the access request data from the access terminal, the server extracts the access verification code from the access request data.

[0076] S7. Perform mapping conversion processing on the access verification code to obtain a corresponding mapping verification code, and perform permission verification on the mapping verification code based on the hash value in the database.

[0077] In specific implementation, the server may substitute the access verification code into a preset mapping conversion table, perform mapping conversion processing on each character of the access verification code, and obtain the mapping characters of each character in the access verification code, wherein the mapping conversion table includes a number of characters and the mapping characters corresponding to each character. Then, the mapping characters of each character in the access verification code are used to replace each character of the access verification code, and the mapping verification code corresponding to the access verification code is obtained.

[0078] After obtaining the mapping verification code corresponding to the access verification code, the server can extract several key-value pairs from the mapping verification code and retrieve the hash value from the database; then determine the numerical value of the corresponding number of digits of the hash value based on the key in the key-value pair, and compare the value in the key-value pair with the numerical value of the corresponding number of digits of the hash value. If the two are consistent, the corresponding key-value pair is verified and passed; when all key-value pairs are verified and passed, the mapping verification code permission check is determined to have passed, otherwise, the mapping verification code permission check is determined to have failed.

[0079] S8. When the mapping verification code authority check fails, the access of the access end is cut off. Otherwise, the segmented encrypted data associated with the hash value is retrieved from the database, and each bit of the hash value is synchronously iterated and shifted to obtain several key strings, and each key string is assigned a unique iteration number according to the iteration order.

[0080] In specific implementation, when it is determined that the mapping verification code permission check fails, the server immediately cuts off the data access of the access terminal to ensure the data security in the database and achieve effective data access defense. When it is determined that the mapping verification code permission check passes, the server retrieves the encrypted data of each segment associated with the hash value from the database, and performs synchronous iterative shift processing on each bit of the hash value to obtain several key strings, and each key string is assigned a unique iteration number according to the iteration order.

[0081] S9. Decrypt the corresponding segmented encrypted data using each key string according to the unique iteration number to obtain each number conversion data.

[0082] In specific implementation, the server matches the unique iteration number of each key string with the unique iteration number of the segmented encrypted data mark in the database, pairs the key string with the same unique iteration number with the corresponding segmented encrypted data, and then uses the AES algorithm to decrypt the paired segmented encrypted data based on each key string to obtain the number conversion data.

[0083] S10. Extracting unique segment numbers and corresponding segment conversion data from the number conversion data, and performing reverse data conversion processing on the corresponding segment conversion data using the unique segment numbers to obtain segment data corresponding to each unique segment number.

[0084] In specific implementation, the server extracts the unique segment number and the corresponding segment conversion data from the number conversion data, and uses the unique segment number to perform reverse data conversion processing on the corresponding segment conversion data, that is, each bit of the segment conversion data is added to the unique segment number respectively to obtain the segment data corresponding to each unique segment number.

[0085] S11. Combine the segmented data according to the unique segmented numbers corresponding to the segmented data to obtain a target data set, and send the target data set to the access end.

[0086] In specific implementation, the server sequentially combines each segmented data according to the unique segment number corresponding to each segmented data, and removes the overlapping data between two adjacent segmented data during the combination process, so as to quickly and accurately obtain the target data set, and then send the target data set to the access terminal for use.

[0087] The method of this embodiment is to achieve efficient and reliable data security protection management. Through corresponding data conversion, key acquisition, group encryption and access verification design, it can effectively improve the security protection performance of data, ensure high-reliability management and secure access to data, and effectively prevent data leakage.

[0088] Embodiment 2:

[0089] This embodiment provides a data security defense system based on data encryption. Figure 2 As shown, it includes a data splitting unit, a data conversion unit, an iterative shifting unit, a data encryption unit, a data storage unit, an access receiving unit, a permission checking unit, a defense parsing unit, a data decryption unit, a reverse conversion unit and a data combining unit, wherein:

[0090] A data splitting unit is used to obtain a target data set to be protected, and sequentially segment the target data set to obtain a number of segmented data, and perform hash calculation on the target data set to obtain a hash value;

[0091] A data conversion unit, used to assign a unique segment number to each segment data according to the segment sequence, and use the unique segment number to perform data conversion processing on the corresponding segment data to obtain corresponding segment conversion data, and combine the segment conversion data with the corresponding unique segment number to obtain number conversion data;

[0092] An iterative shift unit is used to perform synchronous iterative shift processing on each bit of the hash value, and obtain a key string after each iterative shift. After several iterative shifts, several key strings are obtained, and each key string is assigned a unique iteration number according to the iteration order;

[0093] A data encryption unit, used to associate each key string with the corresponding number conversion data according to the unique iteration number and the unique segment number, and encrypt the associated number conversion data using the key string to obtain the corresponding segment encrypted data;

[0094] The data storage unit is used to store each segmented encrypted data into a database after marking the corresponding unique iteration number, and store the hash value into the database, and establish a data association between the hash value and each segmented encrypted data marked with the unique iteration number;

[0095] An access receiving unit, used to receive access request data from an access terminal and extract an access verification code from the access request data;

[0096] The permission verification unit is used to perform mapping conversion processing on the access verification code to obtain a corresponding mapping verification code, and perform permission verification on the mapping verification code based on the hash value in the database;

[0097] The defense parsing unit is used to cut off the access of the access terminal when the mapping verification code authority check fails. Otherwise, the encrypted data of each segment associated with the hash value is retrieved from the database, and each bit of the hash value is synchronously iterated and shifted to obtain a number of key strings, and each key string is assigned a unique iteration number according to the iteration order;

[0098] A data decryption unit, used to decrypt the corresponding segmented encrypted data using each key string according to the unique iteration number to obtain each number conversion data;

[0099] A reverse conversion unit, used to extract a unique segment number and corresponding segment conversion data from the number conversion data, and perform reverse data conversion processing on the corresponding segment conversion data using the unique segment number to obtain segment data corresponding to each unique segment number;

[0100] The data combining unit is used to combine the segmented data according to the unique segmented numbers corresponding to the segmented data to obtain a target data set, and send the target data set to the access end.

[0101] Embodiment 3:

[0102] This embodiment provides a data security defense system based on data encryption. Figure 3 As shown, at the hardware level, it includes:

[0103] Data interface, used to establish data connection between the processor and the external data terminal;

[0104] A memory for storing instructions;

[0105] The processor is used to read the instructions stored in the memory and execute the data security defense method based on data encryption in Example 1 according to the instructions.

[0106] Optionally, the system further includes an internal bus, through which the processor, the memory and the data interface can be interconnected, and the internal bus can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc.

[0107] The memory may include, but is not limited to, random access memory (RAM), read only memory (ROM), flash memory, first input first output (FIFO) and / or first in last out (FILO) memory, etc. The processor may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0108] Embodiment 4:

[0109] This embodiment provides a computer-readable storage medium, on which instructions are stored, and when the instructions are executed on a computer, the computer executes the data security defense method based on data encryption in Embodiment 1. The computer-readable storage medium refers to a carrier for storing data, which may include but is not limited to a floppy disk, an optical disk, a hard disk, a flash memory, a USB flash drive, and / or a memory stick, etc., and the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.

[0110] This embodiment also provides a computer program product, which, when running on a computer, executes the data security defense method based on data encryption in Embodiment 1. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device.

[0111] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A data security defense method based on data encryption, characterized in that: include: Obtain the target data set to be protected, and perform sequential segmentation processing on the target data set to obtain a number of segmented data, perform hash calculation on the target data set to obtain a hash value; Assigning each segment data a unique segment number according to the segment sequence, and performing data conversion processing on the corresponding segment data using the unique segment number to obtain corresponding segment conversion data, and combining the segment conversion data with the corresponding unique segment number to obtain number conversion data; Perform synchronous iterative shift processing on each bit of the hash value, obtain a key string after each iterative shift, obtain several key strings after several iterative shifts, and assign a unique iteration number to each key string according to the iteration order; Associating each key string with the corresponding number conversion data according to the unique iteration number and the unique segment number, and encrypting the associated number conversion data using the key string to obtain the corresponding segment encrypted data; Each segmented encrypted data is marked with a unique iteration number corresponding to the data and stored in the database, and a hash value is stored in the database, and a data association is established between the hash value and each segmented encrypted data marked with a unique iteration number; Receive access request data from the access end, and extract the access verification code from the access request data; Perform mapping conversion processing on the access verification code to obtain the corresponding mapping verification code, and perform permission verification on the mapping verification code based on the hash value in the database; When the mapping verification code permission check fails, the access end is cut off from the access. Otherwise, the encrypted data of each segment associated with the hash value is retrieved from the database, and each bit of the hash value is synchronously iterated and shifted to obtain several key strings, and each key string is assigned a unique iteration number according to the iteration order; Decrypt the corresponding segmented encrypted data using each key string according to the unique iteration number to obtain each number conversion data; Extracting a unique segment number and corresponding segment conversion data from the number conversion data, and performing reverse data conversion processing on the corresponding segment conversion data using the unique segment number to obtain segment data corresponding to each unique segment number; The segmented data are combined according to the unique segment numbers corresponding to the segmented data to obtain a target data set, and the target data set is sent to the access end.

2. A data security defense method based on data encryption according to claim 1, characterized in that: Before receiving the access request data from the access terminal, the method further includes: Extracting a plurality of key-value pairs based on the hash value, wherein the keys in the key-value pairs represent the corresponding number of bits of the hash value, and the values ​​in the key-value pairs represent the numerical values ​​of the corresponding number of bits of the hash value; A mapping verification code is composed of several key-value pairs, and the mapping verification code is subjected to mapping conversion processing to obtain a corresponding access verification code, which is encrypted and sent to the corresponding access end.

3. A data security defense method based on data encryption according to claim 2, characterized in that: The performing permission verification on the mapping verification code based on the hash value in the database includes: Extract several key-value pairs from the mapping verification code and retrieve the hash value from the database; Determine the number of digits corresponding to the hash value according to the key in the key-value pair, and compare the value in the key-value pair with the number of digits corresponding to the hash value. If the two are consistent, the corresponding key-value pair is verified; When all key-value pairs are verified, it is determined that the mapping verification code permission check has passed, otherwise, it is determined that the mapping verification code permission check has failed.

4. The data security defense method based on data encryption according to claim 1 is characterized in that: The target data set is sequentially segmented to obtain a number of segmented data, including: Construct a sliding window and set the window size and window moving step of the sliding window; Based on the window size and the window moving step, the target data set is sequentially segmented using a sliding window to obtain a number of segmented data, and there is data overlap between two adjacent segmented data.

5. The data security defense method based on data encryption according to claim 1 is characterized in that: The method of performing data conversion processing on the corresponding segment data using the unique segment number to obtain the corresponding segment conversion data includes: Determine each bit of data in the segmented data; Subtracting the unique segment number from each bit of the segment data respectively obtains data as conversion data for each bit of the segment data; Each bit of the segmented data is replaced by the conversion data of each bit of the segmented data to obtain segmented conversion data corresponding to the segmented data.

6. A data security defense method based on data encryption according to claim 1, characterized in that: The data of each bit of the hash value is synchronously iterated and shifted, and a key string is obtained after each iterative shift. After several iterative shifts, several key strings are obtained, including: Each bit of the hash value is synchronously and iteratively cyclically shifted left or right. Each iteration cyclically shifts left or right by a set number of bits. After each cyclic left shift or cyclic right shift, a key string is obtained. After several iterations, several key strings are obtained.

7. The data security defense method based on data encryption according to claim 1 is characterized in that: The method of encrypting the associated number conversion data using the key string to obtain corresponding segmented encrypted data includes: The AES encryption algorithm is used to encrypt the associated number conversion data using the corresponding key string to obtain the corresponding segmented encrypted data.

8. The data security defense method based on data encryption according to claim 1 is characterized in that: The mapping and conversion process of the access verification code to obtain the corresponding mapping verification code includes: Substituting the access verification code into a preset mapping conversion table, performing mapping conversion processing on each character of the access verification code to obtain a mapping character for each character in the access verification code, wherein the mapping conversion table includes a number of characters and mapping characters associated with each character; Each character of the access verification code is replaced by a mapping character of each character in the access verification code to obtain a mapping verification code corresponding to the access verification code.

9. A data security defense system based on data encryption, characterized in that: It includes a data splitting unit, a data conversion unit, an iterative shifting unit, a data encryption unit, a data storage unit, an access receiving unit, a permission verification unit, a defense parsing unit, a data decryption unit, a reverse conversion unit and a data combination unit, wherein: A data splitting unit is used to obtain a target data set to be protected, and sequentially segment the target data set to obtain a number of segmented data, and perform hash calculation on the target data set to obtain a hash value; A data conversion unit, used to assign a unique segment number to each segment data according to the segment sequence, and use the unique segment number to perform data conversion processing on the corresponding segment data to obtain corresponding segment conversion data, and combine the segment conversion data with the corresponding unique segment number to obtain number conversion data; An iterative shift unit is used to perform synchronous iterative shift processing on each bit of the hash value, and obtain a key string after each iterative shift. After several iterative shifts, several key strings are obtained, and each key string is assigned a unique iteration number according to the iteration order; A data encryption unit, used to associate each key string with the corresponding number conversion data according to the unique iteration number and the unique segment number, and encrypt the associated number conversion data using the key string to obtain the corresponding segment encrypted data; The data storage unit is used to store each segmented encrypted data into a database after marking the corresponding unique iteration number, and store the hash value into the database, and establish a data association between the hash value and each segmented encrypted data marked with the unique iteration number; An access receiving unit, used to receive access request data from an access terminal and extract an access verification code from the access request data; The permission verification unit is used to perform mapping conversion processing on the access verification code to obtain a corresponding mapping verification code, and perform permission verification on the mapping verification code based on the hash value in the database; The defense parsing unit is used to cut off the access of the access terminal when the mapping verification code authority check fails. Otherwise, the encrypted data of each segment associated with the hash value is retrieved from the database, and each bit of the hash value is synchronously iterated and shifted to obtain a number of key strings, and each key string is assigned a unique iteration number according to the iteration order; A data decryption unit, used to decrypt the corresponding segmented encrypted data using each key string according to the unique iteration number to obtain each number conversion data; A reverse conversion unit, used to extract a unique segment number and corresponding segment conversion data from the number conversion data, and perform reverse data conversion processing on the corresponding segment conversion data using the unique segment number to obtain segment data corresponding to each unique segment number; The data combining unit is used to combine the segmented data according to the unique segmented numbers corresponding to the segmented data to obtain a target data set, and send the target data set to the access end.

10. A data security defense system based on data encryption, characterized in that: include: A memory for storing instructions; A processor is used to read the instructions stored in the memory and execute the data security defense method based on data encryption as described in any one of claims 1-8 according to the instructions.

Images