Data encryption method and device, equipment, storage medium and computer program product

Abstract

The invention discloses a data encryption method, device and equipment, a storage medium and a computer program product, and relates to the technical field of data processing, and the data encryption method comprises the steps that an encryption master key and an encryption auxiliary key are generated based on a preset data encryption rule; determining first encrypted data corresponding to the first data type and second encrypted data corresponding to the second data type in the to-be-encrypted data service; encrypting the first encrypted data through the encryption main key, and encrypting the second encrypted data through the encryption auxiliary key; and when the encryption is completed, obtaining a data encryption result corresponding to the to-be-encrypted data service. By means of the technical scheme, the technical problem that when a data analysis system in the prior art carries out batch processing and operation on data in a data warehouse, decryption, operation and re-encryption are often needed after the data analysis system is disassembled one by one, and consequently the execution efficiency is reduced is solved.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a data encryption method, device, equipment, storage medium and computer program product. Background Art

[0002] With the rapid development of information technology, data encryption has received more and more attention. Encryption technology has also become very mature. To ensure data security, many current application systems will encrypt and store the entire table of the database or all fields including values, making it impossible for the encrypted data to be directly used in calculations. For data analysis systems with high data security requirements, since they cannot directly use the encrypted summary or single data in the data warehouse for batch processing and calculation, when batch processing and calculation of data in the data warehouse is required, the data has to be disassembled and decrypted, calculated, and encrypted one by one, resulting in reduced execution efficiency.

[0003] The above contents are only used to assist in understanding the technical solution of the present invention and do not constitute an admission that the above contents are prior art. Summary of the invention

[0004] The main purpose of this application is to provide a data encryption method, device, equipment, storage medium and computer program product, which aims to solve the technical problem that when the data analysis system in the prior art performs batch processing and calculation on the data in the data warehouse, it is often necessary to disassemble the data and decrypt, calculate and encrypt it one by one, resulting in reduced execution efficiency.

[0005] To achieve the above purpose, the present application proposes a data encryption method, which includes:

[0006] Generate an encryption master key and an encryption sub-key based on preset data encryption rules;

[0007] Determine first encrypted data corresponding to a first data type and second encrypted data corresponding to a second data type in the data service to be encrypted;

[0008] encrypting the first encrypted data using the encryption master key, and encrypting the second encrypted data using the encryption sub-key;

[0009] When the encryption is completed, the data encryption result corresponding to the data service to be encrypted is obtained.

[0010] In one embodiment, the step of generating the encryption master key and the encryption sub-key based on the preset data encryption rule includes:

[0011] Based on the preset data encryption rules, the user input plain text is encrypted by a first encryption algorithm to obtain an encryption master key;

[0012] Get the master key generation string from the preset application configuration file;

[0013] Encrypting the encrypted master key and the master key generation string by a second encryption algorithm to obtain a master key encryption result;

[0014] An encrypted secondary key is generated based on the primary key encryption result.

[0015] In one embodiment, the step of generating an encryption secondary key based on the primary key encryption result includes:

[0016] Decrypting the master key encryption result based on the master key generation string using a target decryption algorithm corresponding to the second encryption algorithm to obtain the encrypted master key;

[0017] Obtaining a secondary key generation string from the preset application configuration file;

[0018] Encrypting the encryption master key and the secondary key generation string by a third encryption algorithm to obtain a secondary key encryption result;

[0019] The sub-key encryption result is encrypted using the first encryption algorithm to generate an encrypted sub-key.

[0020] In one embodiment, after the step of obtaining the data encryption result corresponding to the data service to be encrypted when the encryption is completed, the method further includes:

[0021] Upon receiving a data query request, determining a data query interface;

[0022] Determine the target data index of the data to be queried in the preset data mart according to the data query interface;

[0023] Determine, according to the target data index, a target hierarchical data table in the preset data mart storing the encrypted data packet corresponding to the data to be queried;

[0024] Acquire the encrypted data packet from the target level data table;

[0025] The encrypted data packet is decrypted by a preset decryption function to obtain the data to be queried.

[0026] In one embodiment, the data service to be encrypted includes: a salary data service; the step of determining the first encrypted data corresponding to the first data type in the data service to be encrypted, and the second encrypted data corresponding to the second data type, includes:

[0027] Determine the first encrypted data corresponding to the first data type in the salary data service as user work number data and user salary data, and determine the second encrypted data corresponding to the second data type as amount field data in the non-salary data;

[0028] The step of encrypting the first encrypted data by using the encryption master key and encrypting the second encrypted data by using the encryption secondary key comprises:

[0029] The user work number data and the user salary data are encrypted by the encryption master key, and the amount field data is encrypted by the encryption sub-key.

[0030] In one embodiment, after the step of obtaining the data encryption result corresponding to the data service to be encrypted when the encryption is completed, the method further includes:

[0031] The encrypted user ID data, encrypted user salary data and encrypted amount field data in the data encryption result are stored in the STG layer;

[0032] Upon receiving a salary query request, the encrypted user work number data, the encrypted user salary data, and the encrypted amount field data in the STG layer are transmitted to the ETL layer;

[0033] Preprocessing the encrypted user work number data, the encrypted user salary data, and the encrypted amount field data in the ETL layer to obtain processed salary data, and sending the processed salary data to the data mart layer;

[0034] The processed salary data in the data mart layer is decrypted to obtain and output the decrypted salary data.

[0035] In addition, to achieve the above purpose, the present application also proposes a data encryption device, the device comprising:

[0036] A key generation module, used to generate an encryption master key and an encryption sub-key based on a preset data encryption rule;

[0037] An encrypted data determination module, used to determine first encrypted data corresponding to a first data type in a data service to be encrypted, and second encrypted data corresponding to a second data type;

[0038] a data encryption module, configured to encrypt the first encrypted data using the encryption master key, and to encrypt the second encrypted data using the encryption sub-key;

[0039] The encryption result acquisition module is used to obtain the data encryption result corresponding to the data service to be encrypted when the encryption is completed.

[0040] In addition, to achieve the above-mentioned purpose, the present application also proposes a data encryption device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the data encryption method described above.

[0041] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the data encryption method described above are implemented.

[0042] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the steps of the data encryption method described above are implemented.

[0043] The present application provides a data encryption method, which discloses generating an encryption master key and an encryption sub-key based on preset data encryption rules; determining first encrypted data corresponding to a first data type in a data service to be encrypted, and second encrypted data corresponding to a second data type; encrypting the first encrypted data by using the encryption master key, and encrypting the second encrypted data by using the encryption sub-key; when the encryption is completed, obtaining a data encryption result corresponding to the data service to be encrypted; because the present invention encrypts the first encrypted data in the data service to be encrypted by using the encryption master key, and encrypts the second encrypted data in the data service to be encrypted by using the encryption sub-key to obtain the data encryption result corresponding to the data service to be encrypted, thereby solving the technical problem that the data analysis system in the prior art often needs to disassemble the data in the data warehouse and decrypt, calculate, and encrypt it one by one when performing batch processing and calculation on the data, resulting in reduced execution efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0045] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0046] Figure 1A schematic diagram of a process flow provided for the first embodiment of the data encryption method of the present application;

[0047] Figure 2 A flowchart of the second embodiment of the data encryption method of the present application is provided;

[0048] Figure 3 A schematic diagram of the process of generating an encryption master key in the data encryption method of this application;

[0049] Figure 4 A schematic diagram of the process of generating an encryption secondary key in the data encryption method of this application;

[0050] Figure 5 A flowchart of the third embodiment of the data encryption method of the present application is provided;

[0051] Figure 6 This is a diagram showing the encryption and decryption process in the data encryption method of this application;

[0052] Figure 7 This is a schematic diagram of the module structure of the data encryption device according to an embodiment of the present application;

[0053] Figure 8 This is a schematic diagram of the device structure of the hardware operating environment involved in the data encryption method in the embodiment of the present application.

[0054] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0055] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0056] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0057] The main solution of the embodiment of the present application is: generate an encryption master key and an encryption sub-key based on preset data encryption rules; determine the first encrypted data corresponding to the first data type in the data service to be encrypted, and the second encrypted data corresponding to the second data type; encrypt the first encrypted data by the encryption master key, and encrypt the second encrypted data by the encryption sub-key; when the encryption is completed, obtain the data encryption result corresponding to the data service to be encrypted.

[0058] Due to the high data security requirements in the existing data analysis systems, it is impossible to directly use the encrypted summary or single data in the data warehouse for batch processing and calculation. It is often necessary to batch process and calculate the data in the data warehouse, and the data has to be disassembled and decrypted, calculated, and encrypted one by one, which greatly reduces the execution efficiency.

[0059] The present application provides a solution, which encrypts the first encrypted data in the data service to be encrypted by using an encryption master key, and encrypts the second encrypted data in the data service to be encrypted by using an encryption sub-key, so as to obtain the data encryption result corresponding to the data service to be encrypted, thereby solving the technical problem that the data analysis system in the prior art often needs to disassemble the data in the data warehouse and decrypt, calculate and encrypt it one by one when performing batch processing and calculation on the data, resulting in reduced execution efficiency.

[0060] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device capable of realizing the above functions, a data encryption device, etc. The following takes a data encryption device as an example (hereinafter referred to as the device) to illustrate this embodiment and the following embodiments.

[0061] Based on this, the present application embodiment provides a data encryption method, referring to Figure 1 , Figure 1 This is a flow chart of the first embodiment of the data encryption method of the present application.

[0062] In this embodiment, the data encryption method includes steps S10 to S40:

[0063] Step S10: Generate an encryption master key and an encryption sub-key based on preset data encryption rules.

[0064] It should be noted that the above-mentioned preset data encryption rule can be a rule for encrypting data by setting the key as the encryption master key and the encryption sub-key. Among them, the encryption master key can be a key used to encrypt the final summary amount generated by the detailed data that has been processed and calculated in the data warehouse; the encryption sub-key can be a key used to encrypt the non-numeric key fields in the detailed data in the data warehouse, among which the numeric fields in the detailed data are still kept in plain text for easy calculation, which does not affect the association between tables and can meet the requirements of batch processing and calculation.

[0065] Step S20: Determine first encrypted data corresponding to the first data type and second encrypted data corresponding to the second data type in the data service to be encrypted.

[0066] It should be understood that the above-mentioned data service to be encrypted can be any application service that requires data encryption, such as salary data service, commission data service, etc., and this embodiment does not limit this.

[0067] It should be noted that the first data type may be a type of amount data in the data service to be encrypted; correspondingly, the first encrypted data may be amount data in the data service to be encrypted.

[0068] It can be understood that the second data type may be a non-numeric data type in the detailed data in the data service to be encrypted; correspondingly, the second encrypted data may be non-numeric data in the data service to be encrypted.

[0069] Step S30: Encrypt the first encrypted data using the encryption master key, and encrypt the second encrypted data using the encryption sub-key.

[0070] Step S40: When the encryption is completed, the data encryption result corresponding to the data service to be encrypted is obtained.

[0071] In the specific implementation, first, an encryption master key for encrypting the summary amount in the detail data and an encryption sub-key for encrypting the non-numeric data in the detail data can be generated. Then, the first encrypted data corresponding to the amount data type in the detail data of the data service to be encrypted and the second encrypted data corresponding to the non-numeric data type in the detail data can be determined. Finally, the final summary amount generated by the processed and calculated detail data can be encrypted by the encryption master key, and the non-numeric key fields in the detail data can be encrypted by the encryption sub-key. After the encryption is completed, the final data encryption result is obtained.

[0072] It should be noted that this solution can directly use the encrypted data in the data warehouse to participate in batch processing and calculation, thereby reducing the process of disassembly, decryption, calculation, and re-encryption, greatly improving the system's computing efficiency and reducing the system's waiting time for response results. In addition, encrypted data does not need to be decrypted before it can be directly used in calculations, thereby preventing the risk of sensitive data leakage after decryption and improving system security.

[0073] Furthermore, after step S40, it also includes: when receiving a data query request, determining a data query interface; determining a target data index of the data to be queried in a preset data mart according to the data query interface; determining a target hierarchical data table in the preset data mart that stores an encrypted data packet corresponding to the data to be queried according to the target data index; obtaining the encrypted data packet from the target hierarchical data table; and decrypting the encrypted data packet by a preset decryption function to obtain the data to be queried.

[0074] It should be noted that the data query request may be a request for instructing the device to perform a data query. The data query interface may be an interface for querying corresponding data in a data warehouse. In this embodiment, after receiving the data query request, the device may parse the data query request to obtain the data query interface for this time.

[0075] It is understandable that the above target data index can be an index corresponding to the location where the data to be queried is stored in the preset data mart, wherein the data mart is an extended form of a data warehouse, and is a small data warehouse designed and built specifically for a specific user group. In practical applications, a corresponding index value can be assigned to all the data stored in the preset data mart, and the index value can be mapped and stored with the data interface, and a mapping relationship table can be established. After determining the data query interface corresponding to the data to be queried, the target data index of the data to be queried in the preset data mart can be queried from the mapping relationship table according to the data query interface.

[0076] It should be noted that the above-mentioned target hierarchical data table can be a data table for storing data in a data mart. In this embodiment, a plurality of hierarchical data tables can be established in the preset data mart according to the data categories and data weights corresponding to all data, and a corresponding index value can be set for each hierarchical data table, so that after determining the target data index of the data to be queried in the preset data mart, the corresponding target hierarchical data table can be determined according to the target data index, and the encrypted data packet corresponding to the data to be queried can be obtained by querying in the target hierarchical data table, and then the encrypted data packet can be decrypted by a preset decryption function to obtain the decrypted data to be queried. Among them, this embodiment does not limit the category and decryption method of the preset decryption function.

[0077] The present embodiment provides a data encryption method, which discloses generating an encryption master key and an encryption sub-key based on preset data encryption rules; determining first encrypted data corresponding to a first data type in a data service to be encrypted, and second encrypted data corresponding to a second data type; encrypting the first encrypted data by using the encryption master key, and encrypting the second encrypted data by using the encryption sub-key; when the encryption is completed, obtaining a data encryption result corresponding to the data service to be encrypted; because the present embodiment encrypts the first encrypted data in the data service to be encrypted by using the encryption master key, and encrypts the second encrypted data in the data service to be encrypted by using the encryption sub-key to obtain the data encryption result corresponding to the data service to be encrypted, thereby solving the technical problem in the prior art that when the data analysis system performs batch processing and calculation on the data in the data warehouse, it often needs to disassemble the data and decrypt, calculate, and encrypt each data item one by one, resulting in reduced execution efficiency.

[0078] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the above-mentioned embodiment 1 can be referred to the above introduction, and will not be repeated in the following. Figure 2 , Figure 2 A flowchart of the second embodiment of the data encryption method of the present application is provided.

[0079] In this embodiment, step S10 includes steps S101 to S104:

[0080] Step S101: Based on preset data encryption rules, the user input plain text is encrypted using a first encryption algorithm to obtain an encryption master key.

[0081] It should be noted that the first encryption algorithm may be an algorithm for encrypting plain text input by a user, such as the MD5 algorithm (Message-Digest Algorithm 5), which is not limited in this embodiment.

[0082] Step S102: Obtain a master key generation string from a preset application configuration file.

[0083] It should be noted that the above-mentioned preset application configuration file can be a file used to store configuration information of the data service to be encrypted, wherein the preset application configuration file in this embodiment can store database configuration, cache class configuration, file system link, password, and a character string for generating a key, etc. This embodiment does not impose any restrictions on this.

[0084] It is understandable that the master key generation string may be a string for generating a master key stored in a preset application configuration file, wherein the master key generation string may be a random string generated by a randomization tool.

[0085] Step S103: Encrypt the encrypted master key and the master key generation string using a second encryption algorithm to obtain a master key encryption result.

[0086] It should be understood that the second encryption algorithm may be an algorithm for encrypting the master key and the string, such as an AES (Advanced Encryption Standard) encryption algorithm, which is not limited in this embodiment. The master key encryption result may be a string obtained by encrypting the encrypted master key and the master key generation string, or other forms of encryption results.

[0087] Step S104: Generate an encryption sub-key based on the master key encryption result.

[0088] In the specific implementation, refer to Figure 3 , Figure 3 The following is a flow chart of generating the encryption master key in the data encryption method of this application. Figure 3 As shown in the figure, the user can log in to the key management system in the encrypted data service and enter the plaintext key in the interface displayed in the encryption management system. At this time, the system can transcode the plaintext key entered by the user through the MD5 algorithm to obtain the master key. Then, the device can read the master key generation string (i.e., the master key generation string) used to generate the master key in the preset application configuration file from the system. Figure 3 The application configuration file string 1) in the master key is encrypted by the AES encryption algorithm to obtain the master key encryption result, and the master key encryption result is stored in the ECS encryption file.

[0089] Further, the step S104 includes: decrypting the master key encryption result based on the master key generation string by the target decryption algorithm corresponding to the second encryption algorithm to obtain the encrypted master key; obtaining the secondary key generation string from the preset application configuration file; encrypting the encrypted master key and the secondary key generation string by a third encryption algorithm to obtain a secondary key encryption result; encrypting the secondary key encryption result by the first encryption algorithm to generate an encrypted secondary key.

[0090] It should be noted that the above-mentioned target decryption algorithm may be an algorithm for decrypting data encrypted by the second encryption algorithm. In the present embodiment, if the second encryption algorithm is the AES encryption algorithm, the corresponding target decryption algorithm is the AES decryption algorithm.

[0091] It is understandable that the secondary key generation string can be a string used to generate an encrypted secondary key in a preset application configuration file. The third encryption algorithm can be an algorithm used to encrypt the encrypted master key and the secondary key generation string, such as the SM4 encryption algorithm, which is not limited in this embodiment.

[0092] In the specific implementation, refer to Figure 4 , Figure 4 The following is a flow chart of generating a secondary encryption key in the data encryption method of this application. Figure 4 As shown, after the application is started, the encryption result of the encrypted master key and the master key generation string can be decrypted by the AES decryption algorithm to obtain the master key, and then the secondary secret key generation string used to generate the encrypted secondary key can be read from the preset application configuration file (i.e. Figure 4The application configuration file string 2 in the master key and the secondary key can be encrypted by the SM4 encryption algorithm to obtain the encrypted ciphertext, that is, the secondary key encryption result. Finally, the secondary key encryption result can be encrypted by the MD5 encryption algorithm to generate the secondary key, and the secondary key is stored in the encrypted file.

[0093] In this embodiment, it is disclosed that based on preset data encryption rules, the user input plain text is encrypted by a first encryption algorithm to obtain an encrypted master key; a master key generation string is obtained from a preset application configuration file; the encrypted master key and the master key generation string are encrypted by a second encryption algorithm to obtain a master key encryption result; an encrypted sub-key is generated based on the master key encryption result, so that the encrypted data in the data warehouse can be directly used for batch processing and calculation, thereby reducing the process of disassembly, decryption, calculation, and re-encryption, greatly improving the system operation efficiency, and reducing the system waiting time for response results.

[0094] Based on the first embodiment and / or the second embodiment of the present application, in the third embodiment of the present application, the same or similar contents as those in the above embodiments can be referred to the above introduction, and will not be described in detail later. Figure 5 , Figure 5 A flowchart of the third embodiment of the data encryption method of this application is provided.

[0095] In this embodiment, the data service to be encrypted includes: salary data service; the step S20 includes:

[0096] Step S201: determining the first encrypted data corresponding to the first data type in the salary data service as user employee number data and user salary data, and determining the second encrypted data corresponding to the second data type as amount field data in non-salary data.

[0097] It should be understood that the above-mentioned user employee number data may be data used to uniquely identify all employees in an enterprise.

[0098] Accordingly, the step S30 includes:

[0099] Step S301: Encrypt the user's employee number data and the user's salary data using the encryption master key, and encrypt the amount field data using the encryption sub-key.

[0100] In the specific implementation, the user's work number and the user's salary data in the salary data service can be encrypted by using the encryption master key, and the amount field data in the non-salary data in the salary data service can be encrypted by using the encryption secondary key, so that the key fields in the salary data service can be encrypted, ensuring the data security in the salary data service.

[0101] Furthermore, after step S40, the method further includes:

[0102] The encrypted user work number data, the encrypted user salary data and the encrypted amount field data in the data encryption result are stored in the STG layer; when a salary query request is received, the encrypted user work number data, the encrypted user salary data and the encrypted amount field data in the STG layer are transmitted to the ETL layer; the encrypted user work number data, the encrypted user salary data and the encrypted amount field data are pre-processed in the ETL layer to obtain processed salary data, and the processed salary data is sent to the data mart layer; the processed salary data in the data mart layer is decrypted to obtain and output the decrypted salary data.

[0103] It should be noted that the above-mentioned STG layer (Staging Layer) can be the layer in the data warehouse used to store raw data. The STG layer is mainly used as a temporary storage area before the data enters the data warehouse, and is used to receive raw data extracted from external systems; the ETL layer (Extract, Transform, Load Layer) can be the layer in the data warehouse responsible for data preprocessing; the data mart layer is the MID layer.

[0104] In the specific implementation, refer to Figure 6 , Figure 6 This is a diagram showing the encryption and decryption process in the data encryption method of this application. Figure 6 As shown, for the salary data service, the SAP salary data and the user's work number data can be encrypted by the master key according to the data encryption API, and then the encryption key fields in the non-salary data, personnel data mart and salary power can be encrypted by the master key and the secondary key, and finally the encryption result is obtained, which includes: encrypted user work number data, encrypted user salary data and encrypted amount field data. After that, the encrypted user work number data, encrypted user salary data and encrypted amount field data can be input into the STG layer data table. After receiving the data query request, the device can send the requested query data from the STG layer data table to the ETL layer data table, and pre-process the encrypted data in the ETL layer data table to obtain the processed encrypted data, and then send the processed encrypted data to the MID layer data table. After that, the processed encrypted data can also be decrypted by a custom encryption / decryption function, and the decrypted data can be output to the user as a query result. In addition, the decrypted data can also be input into the RPT layer, that is, the data report layer, which can be calculated according to the report and analysis requirements.

[0105] In this embodiment, it is disclosed that the first encrypted data corresponding to the first data type in the salary data service is determined as the user work number data and the user salary data, and the second encrypted data corresponding to the second data type is determined as the amount field data in the non-salary data; the user work number data and the user salary data are encrypted by the encryption master key, and the amount field data is encrypted by the encryption secondary key, so that the data in the salary data service can be encrypted and stored, thereby improving the security of the salary data.

[0106] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the data encryption method of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0107] This application also provides a data encryption device, please refer to Figure 7 , the data encryption device comprises:

[0108] The key generation module 10 is used to generate an encryption master key and an encryption sub-key based on a preset data encryption rule;

[0109] The encrypted data determination module 20 is used to determine first encrypted data corresponding to a first data type in the data service to be encrypted, and second encrypted data corresponding to a second data type;

[0110] a data encryption module 30, configured to encrypt the first encrypted data using the encryption master key, and to encrypt the second encrypted data using the encryption sub-key;

[0111] The encryption result acquisition module 40 is used to obtain the data encryption result corresponding to the data service to be encrypted when the encryption is completed.

[0112] The data encryption device provided by the present application adopts the data encryption method in the above embodiment, which can solve the technical problem that the data analysis system in the prior art often needs to disassemble the data in the data warehouse and decrypt, calculate, and encrypt it one by one when processing and calculating the data in batches, resulting in reduced execution efficiency. Compared with the prior art, the beneficial effects of the data encryption device provided by the present application are the same as the beneficial effects of the data encryption method provided by the above embodiment, and the other technical features of the data encryption device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0113] The present application provides a data encryption device, which includes: at least one processor; and a memory that is communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the data encryption method in the above-mentioned embodiment one.

[0114] Reference below Figure 8 , which shows a schematic diagram of the structure of a data encryption device suitable for implementing an embodiment of the present application. The data encryption device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 8 The data encryption device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0115] like Figure 8 As shown, the data encryption device may include a processing device 1001 (e.g., a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the data encryption device are also stored. The processing device 1001, ROM1002, and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the data encryption device to communicate with other devices wirelessly or by wire to exchange data. Although the data encryption device with various systems is shown in the figure, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or have alternatively.

[0116] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0117] The data encryption device provided by the present application adopts the data encryption method in the above embodiment to solve the technical problem of data encryption. Compared with the prior art, the beneficial effects of the data encryption device provided by the present application are the same as the beneficial effects of the data encryption method provided by the above embodiment, and the other technical features in the data encryption device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0118] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0119] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0120] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the data encryption method in the above-mentioned embodiment.

[0121] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0122] The computer-readable storage medium may be included in the data encryption device; or may exist independently without being assembled into the data encryption device.

[0123] The above-mentioned computer-readable storage medium carries one or more programs. When the above-mentioned one or more programs are executed by the data encryption device, the data encryption device: generates an encryption master key and an encryption sub-key based on preset data encryption rules; determines the first encrypted data corresponding to the first data type in the data service to be encrypted, and the second encrypted data corresponding to the second data type; encrypts the first encrypted data by the encryption master key, and encrypts the second encrypted data by the encryption sub-key; when the encryption is completed, obtains the data encryption result corresponding to the data service to be encrypted.

[0124] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0125] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0126] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0127] The readable storage medium provided by the present application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned data encryption method, and can solve the technical problem that the data analysis system in the prior art often needs to disassemble the data in the data warehouse and decrypt, calculate, and encrypt it one by one when processing and calculating the data in batches, resulting in reduced execution efficiency. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the present application are the same as the beneficial effects of the data encryption method provided by the above-mentioned embodiment, which will not be repeated here.

[0128] The present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned data encryption method when executed by a processor.

[0129] The computer program product provided by the present application can solve the technical problem that the data analysis system in the prior art often needs to disassemble the data in the data warehouse and decrypt, calculate, and encrypt it one by one when processing and calculating the data in batches, resulting in reduced execution efficiency. Compared with the prior art, the beneficial effects of the computer program product provided by the present application are the same as the beneficial effects of the data encryption method provided by the above embodiment, which will not be repeated here.

[0130] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A data encryption method, characterized in that: The method includes: Generate an encryption master key and an encryption sub-key based on preset data encryption rules; Determine first encrypted data corresponding to a first data type and second encrypted data corresponding to a second data type in the data service to be encrypted; encrypting the first encrypted data using the encryption master key, and encrypting the second encrypted data using the encryption sub-key; When the encryption is completed, the data encryption result corresponding to the data service to be encrypted is obtained.

2. The method according to claim 1, characterized in that The step of generating the encryption master key and the encryption sub-key based on the preset data encryption rule includes: Based on the preset data encryption rules, the user input plain text is encrypted by a first encryption algorithm to obtain an encryption master key; Get the master key generation string from the preset application configuration file; Encrypting the encrypted master key and the master key generation string by a second encryption algorithm to obtain a master key encryption result; An encrypted secondary key is generated based on the primary key encryption result.

3. The method according to claim 2, characterized in that The step of generating an encryption secondary key based on the primary key encryption result comprises: Decrypting the master key encryption result based on the master key generation string using a target decryption algorithm corresponding to the second encryption algorithm to obtain the encrypted master key; Obtaining a secondary key generation string from the preset application configuration file; Encrypting the encryption master key and the secondary key generation string by a third encryption algorithm to obtain a secondary key encryption result; The sub-key encryption result is encrypted using the first encryption algorithm to generate an encrypted sub-key.

4. The method according to any one of claims 1 to 3, characterized in that After the step of obtaining the data encryption result corresponding to the data service to be encrypted when the encryption is completed, the method further includes: Upon receiving a data query request, determining a data query interface; Determine the target data index of the data to be queried in the preset data mart according to the data query interface; Determine, according to the target data index, a target hierarchical data table in the preset data mart storing the encrypted data packet corresponding to the data to be queried; Acquire the encrypted data packet from the target level data table; The encrypted data packet is decrypted by a preset decryption function to obtain the data to be queried.

5. The method according to any one of claims 1 to 3, characterized in that The data service to be encrypted includes: a salary data service; the step of determining the first encrypted data corresponding to the first data type in the data service to be encrypted, and the second encrypted data corresponding to the second data type, includes: Determine the first encrypted data corresponding to the first data type in the salary data service as user work number data and user salary data, and determine the second encrypted data corresponding to the second data type as amount field data in the non-salary data; The step of encrypting the first encrypted data by using the encryption master key and encrypting the second encrypted data by using the encryption secondary key comprises: The user work number data and the user salary data are encrypted by the encryption master key, and the amount field data is encrypted by the encryption sub-key.

6. The method according to claim 5, characterized in that After the step of obtaining the data encryption result corresponding to the data service to be encrypted when the encryption is completed, the method further includes: The encrypted user ID data, encrypted user salary data and encrypted amount field data in the data encryption result are stored in the STG layer; Upon receiving a salary query request, the encrypted user work number data, the encrypted user salary data, and the encrypted amount field data in the STG layer are transmitted to the ETL layer; Preprocessing the encrypted user work number data, the encrypted user salary data, and the encrypted amount field data in the ETL layer to obtain processed salary data, and sending the processed salary data to the data mart layer; The processed salary data in the data mart layer is decrypted to obtain and output the decrypted salary data.

7. A data encryption device, characterized in that: The device comprises: A key generation module, used to generate an encryption master key and an encryption sub-key based on a preset data encryption rule; An encrypted data determination module, used to determine first encrypted data corresponding to a first data type in a data service to be encrypted, and second encrypted data corresponding to a second data type; a data encryption module, configured to encrypt the first encrypted data using the encryption master key, and to encrypt the second encrypted data using the encryption sub-key; The encryption result acquisition module is used to obtain the data encryption result corresponding to the data service to be encrypted when the encryption is completed.

8. A data encryption device, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the data encryption method according to any one of claims 1 to 6.

9. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the data encryption method according to any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the data encryption method according to any one of claims 1 to 6 are implemented.

Images