Data encryption method and device, equipment and medium

Abstract

The invention relates to a data encryption method and device, equipment and a medium. The method comprises the steps that an equipment end receives a public key sent by a server; wherein the public key is contained in a public and private key pair generated by the server; the equipment side encrypts operation data generated in the operation process of the equipment side by using the public key to obtain encrypted data; and the equipment end uploads the encrypted data to the server, so that the server stores the encrypted data. According to the invention, the data security can be improved.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a data encryption method, device, equipment and medium. Background Art

[0002] With the development of cloud computing and artificial intelligence, how to use data safely and effectively is crucial for companies holding a large amount of digital assets. Homomorphic Encryption (HE) is to encrypt data, perform operations on the encrypted data, and then decrypt the data. In actual use, the data of many embedded devices needs to be transmitted from the device side to the server backend storage through the network, and the data is encrypted on the server. However, this method has security risks during data transmission and cannot safely and effectively encrypt sensitive data on the device side. Summary of the invention

[0003] In order to solve the above technical problems, the present disclosure provides a data encryption method, device, equipment and medium.

[0004] According to one aspect of the present disclosure, a data encryption method is provided, the method being applied to a device, the method comprising:

[0005] Receiving a public key sent by a server; wherein the public key is included in a public-private key pair generated by the server;

[0006] Using the public key to encrypt the operation data generated during the operation of the device end to obtain encrypted data;

[0007] The encrypted data is uploaded to the server so that the server stores the encrypted data.

[0008] According to another aspect of the present disclosure, a data encryption method is further provided, the method being applied to a server, the method comprising:

[0009] Generate a public-private key pair based on a homomorphic algorithm;

[0010] Sending the public key in the public-private key pair to the device end, so that the device end uses the public key to encrypt the operation data generated during the operation to obtain encrypted data;

[0011] The encrypted data sent by the device is received and stored.

[0012] According to another aspect of the present disclosure, a data encryption device is also provided, the device is applied to a device end, and the device includes:

[0013] A public key receiving module, used to receive a public key sent by a server; wherein the public key is included in the public-private key pair generated by the server;

[0014] A data encryption module, used to encrypt the operation data generated during the operation of the device end using the public key to obtain encrypted data;

[0015] The data uploading module is used to upload the encrypted data to the server so that the server stores the encrypted data.

[0016] According to another aspect of the present disclosure, a data encryption device is further provided, the device is applied to a server, and the device includes:

[0017] A public-private key pair generation module, used to generate a public-private key pair based on a homomorphic algorithm;

[0018] A public key sending module, used to send the public key in the public-private key pair to the device end, so that the device end uses the public key to encrypt the operation data generated during the operation to obtain encrypted data;

[0019] The data storage module is used to receive and store the encrypted data sent by the device.

[0020] According to another aspect of the present disclosure, an electronic device is provided, the electronic device comprising:

[0021] processor;

[0022] a memory for storing instructions executable by the processor;

[0023] The processor is used to read the executable instructions from the memory and execute the instructions to implement the above method.

[0024] According to another aspect of the present disclosure, a computer-readable storage medium is provided, wherein the storage medium stores a computer program, and the computer program is used to execute the above method.

[0025] The technical solution provided by the embodiments of the present disclosure has the following advantages compared with the prior art.

[0026] The technical solution provided by the embodiment of the present disclosure includes: the device side receives the public key sent by the server; wherein the public key is included in the public-private key pair generated by the server; the device side uses the public key to encrypt the operation data generated during the operation of the device side to obtain encrypted data; the device side uploads the encrypted data to the server, so that the server stores the encrypted data.

[0027] In actual use, the data of many embedded devices needs to be transmitted from the device side to the server through the network for storage. This technical solution implements the homomorphic encryption algorithm on the device side, which can use the public key to encrypt the running data, ensure the security of the running data on the device side from the source, and upload the encrypted data to the server for storage, thereby improving the security of the data. In subsequent data analysis, the homomorphic algorithm can be used to support joint computing of multiple parties and achieve data availability but invisibility. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0029] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0030] Figure 1 A flowchart of a data encryption method provided by an embodiment of the present disclosure;

[0031] Figure 2 A schematic diagram of a process for transmitting a public key provided in an embodiment of the present disclosure;

[0032] Figure 3 A flowchart of another data encryption method provided by an embodiment of the present disclosure;

[0033] Figure 4 An interactive schematic diagram of another data encryption method provided by an embodiment of the present disclosure;

[0034] Figure 5 A structural block diagram of a data encryption device provided by an embodiment of the present disclosure;

[0035] Figure 6 A structural block diagram of another data encryption device provided by an embodiment of the present disclosure;

[0036] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0037] In order to more clearly understand the above-mentioned objectives, features and advantages of the present disclosure, the scheme of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features in the embodiments can be combined with each other without conflict.

[0038] In the following description, many specific details are set forth to facilitate a full understanding of the present disclosure, but the present disclosure may also be implemented in other ways different from those described herein; it is obvious that the embodiments in the specification are only part of the embodiments of the present disclosure, rather than all of the embodiments.

[0039] In order to more safely and effectively encrypt sensitive data on a device, the present disclosure provides a data encryption method, apparatus, device and medium. For ease of understanding, the present disclosure is described below.

[0040] Figure 1 The flowchart of a data encryption method provided by the embodiment of the present disclosure can be executed by a data encryption device set at the device end, and the device can be implemented by software and / or hardware. The device end can interact with the server and transmit the data generated during its own operation to the server for storage; the device end can be, for example, a vehicle terminal, a computer end, a mobile phone end, etc., and can specifically be a security chip in the above device ends. Figure 1 As shown, the data encryption method applied to the device side may include the following steps.

[0041] S102, receiving a public key sent by a server; wherein the public key is included in a public-private key pair generated by the server.

[0042] In this embodiment, the server first generates a public-private key pair according to the homomorphic algorithm, and then sends the public key in the public-private key pair to the device end, so that the device end can subsequently use the public key to encrypt the operation data generated during the operation process.

[0043] Among them, the method of generating a public-private key pair according to the homomorphic algorithm can refer to the following method:

[0044] Generate a first prime number and a second prime number; specifically, two large prime numbers, namely the first prime number P and the second prime number Q, can be generated in a random manner.

[0045] Generate a third prime number corresponding to the first prime number P and a fourth prime number corresponding to the second prime number; illustratively, the third prime number is P-1 and the fourth prime number is Q-1. Determine the least common multiple of the third prime number and the fourth prime number as the private key in the public-private key pair, specifically: λ=lcm(P-1,Q-1), where λ represents the private key in the public-private key pair.

[0046] Generate a security condition based on the first string obtained by multiplying the first prime number and the second prime number; wherein the security condition includes: being smaller than the square of the first string and being mutually prime with the square of the first string; generate a second string that meets the security condition; determine the first string and the second string G as the public key (N, G) in the public-private key pair. In the specific example, the first string is calculated as N = P * Q; randomly generate a large number G, which is smaller than N2 And with N 2 are mutually prime numbers, and the large number G is the second string G that meets the security condition; the first string N and the second string G are determined as the public key (N, G) in the public-private key pair.

[0047] At this point, the public key (N, G) and private key λ obtained through the above embodiment form a public-private key pair. Then, the private key λ is managed and saved by the server; the public key (N, G) is encrypted by the server into encrypted public key data, so that the server can send the public key (N, G) to the device end in an encrypted manner, improving the security of public key transmission and preventing public key leakage.

[0048] In this embodiment, the device receives the public key sent by the server, and its specific implementation may include:

[0049] The device uses a pre-established secure channel to receive the encrypted public key data sent by the server; and uses the pre-generated session key to decrypt the encrypted public key data into a public key.

[0050] Reference Figure 2 In a possible embodiment shown, after the server generates a public key, a secure channel that complies with preset specifications is established; in a specific example, the server establishes a secure channel that complies with GP (Global Platform) specifications on the security chip on the device side and on the side where the public key is downloaded, such as using any of SCP02, SCP03 or SCP11 to establish a secure channel.

[0051] Encrypt the public key in the public-private key pair into encrypted public key data; use a secure channel to send the encrypted public key data to the device; the device uses the pre-generated session key to decrypt the encrypted public key data into a public key and store the public key. In actual applications, the server can use a secure channel to send the encrypted public key data to the security chip on the device, which temporarily generates a session key, uses the session key to decrypt the encrypted public key data into a public key, and stores the public key for subsequent use in encrypting data.

[0052] S104, using the public key to encrypt the operation data generated during the operation of the device end to obtain encrypted data.

[0053] During the operation of the device, data will inevitably be generated. Taking the vehicle terminal as an example, these operating data include real-time vehicle location, driving trajectory, engine start and shutdown time, engine speed, engine continuous working hours, battery voltage, gearbox gear information, etc. The data generated during the operation of the device is plain text operating data, and the operating data needs to be transmitted to the server through the network for storage. In this case, in order to protect the operating data from being leaked, this embodiment can use the public key on the device to encrypt the operating data, ensure the security of the operating data from the source, and transmit the encrypted data to the server for storage.

[0054] When this embodiment is implemented, the security chip on the device side can use the public key to encrypt the running data to obtain encrypted data. For example: the device side accesses the security chip, sends an APDU (Application Protocol Data Unit) instruction to the security chip to send the running data to the security chip, and the security chip uses the public key to encrypt the running data to obtain encrypted data. The advantage of encrypting through the security chip is that the semi-homomorphic encryption algorithm based on the security chip can be used to encrypt sensitive data on the device side, and the sensitive running data generated by the device side calls the security chip homomorphic encryption algorithm to encrypt the running data for protection. Later, encrypted data can be provided for data analysis, and encrypted data can be used for data statistics and analysis to protect the security of the original running data. Implementing the homomorphic encryption algorithm in the security chip can protect the secure storage of the public key from being leaked, and can also improve the computing performance of the algorithm.

[0055] According to the above embodiments, in the security chip of the device, the operation data generated during the operation of the device is encrypted using a public key, and the process of obtaining the encrypted data may include the following contents.

[0056] (1) In the security chip on the device side, the operation data generated during the operation of the device side is homomorphically encrypted using the first character string and the second character string in the public key to obtain the first encrypted data. Specifically, the original data in plain text is represented as M, which can be hexadecimal data, for example; the operation data generated during the operation of the device side is homomorphically encrypted using the first character string N and the second character string G in the public key according to the following formula: G M mod N 2 , that is, the square of G raised to the power of M modulo N, the result is the first encrypted data, denoted as C1, and the first encrypted data C1 can be 1024-bit hexadecimal data.

[0057] (2) The running data is homomorphically encrypted using the first string and the randomly generated first large number to obtain the second encrypted data. In this embodiment, the first large number may be randomly generated first, denoted as R; and then the running data is homomorphically encrypted using the first string N and the randomly generated first large number R according to the following formula: M mod N 2 , that is, the square of G raised to the power of M modulo N, the result is the second encrypted data, denoted as C2, and the second encrypted data C2 can be 1024-bit hexadecimal data.

[0058] (3) Perform homomorphic encryption on the first encrypted data, the second encrypted data, and the first string to obtain encrypted data. Specifically, the first encrypted data, the second encrypted data, and the first string may be homomorphically encrypted according to the following formula: C1·C2mod N 2 , that is, C1 multiplied by C2 modulo N squared, the result is the final encrypted data, denoted as C, and the encrypted data C can be 1024-bit hexadecimal data.

[0059] This embodiment uses a public key in the security chip on the device end to encrypt the operation data, thereby ensuring the security of the operation data from the source and improving the security of the encrypted data during the transmission process and the subsequent data analysis process by a third-party terminal.

[0060] S106, uploading the encrypted data to the server so that the server stores the encrypted data. In this embodiment, the device sends the encrypted data to the server, and the server stores the encrypted data.

[0061] Based on the above embodiments, the present disclosure provides another data encryption method, which is applied to a server, such as Figure 3 As shown, the data encryption method applied to the server includes the following steps S202-S206:

[0062] S202, generate a public-private key pair according to a homomorphic algorithm.

[0063] This embodiment includes: generating a first prime number P and a second prime number Q; generating a third prime number (such as P-1) corresponding to the first prime number P and a fourth prime number (such as Q-1) corresponding to the second prime number; determining the least common multiple of the third prime number and the fourth prime number as the private key λ in the public-private key pair, that is, λ=lcm(P-1,Q-1).

[0064] Generate a security condition based on a first string N obtained by multiplying a first prime number and a second prime number; wherein the security condition includes: being smaller than the square of the first string N and being a coprime number with the square of the first string N; generate a second string G that satisfies the security condition, wherein the second string G is smaller than N 2 And with N 2are coprime numbers.

[0065] The first character string N and the second character string G are determined as a public key (N, G) in a public-private key pair.

[0066] S204, sending the public key in the public-private key pair to the device end, so that the device end uses the public key to encrypt the operation data generated during the operation to obtain encrypted data.

[0067] An embodiment of sending the public key in the public-private key pair to the device includes:

[0068] Establish a secure channel that complies with preset specifications; specifically, it may include: the server establishes a secure channel that complies with GP specifications on the security chip on the device side and on the side where the public key is downloaded, such as using any of SCP02, SCP03 or SCP11 to establish a secure channel.

[0069] The public key in the public-private key pair is encrypted into encrypted public key data; the encrypted public key data is sent to the device end using a secure channel, so that the device end uses a pre-generated session key to decrypt the encrypted public key data into a public key.

[0070] S206, receiving and storing the encrypted data sent by the device.

[0071] In actual application scenarios, a third party often needs to use the operating data of the device for analysis. For example, when the device is a vehicle-mounted terminal, the third party may include an insurance company, a transportation department, etc. In the case of a third party, the method provided by the embodiment of the present disclosure may further include:

[0072] Send encrypted data to a third-party terminal so that the third-party terminal calls the server's encryption algorithm to analyze the encrypted data and obtain a data analysis result; receive the data analysis result sent by the third-party terminal, use the private key in the public-private key pair to decrypt the data analysis result to obtain a data decryption result; send the decryption result to the third-party terminal.

[0073] In this embodiment, the third-party terminal can initiate a data access request to the server, and the server provides encrypted data to the third-party terminal according to the data access request. At the same time, the server also provides external homomorphic addition, subtraction, multiplication, division and other encryption algorithm operation services. The third-party terminal calls the encryption algorithms such as homomorphic addition, subtraction, multiplication, and division from the server to analyze the encrypted data, obtain the data analysis results, and send the data analysis results to the server. The server uses its own private key to decrypt the data analysis results, obtain the data decryption results, and send the decryption results to the third-party terminal.

[0074] It can be seen that the process of the third-party terminal in this embodiment obtaining encrypted data, analyzing the encrypted data, and sending the data analysis results to the server are all completed in an encrypted state. The data in each process is countable but invisible to the third-party terminal, thereby improving the security of data transmission and data analysis and avoiding the leakage of sensitive data.

[0075] Reference Figure 4 This embodiment takes the automobile scenario as an example, and provides a data encryption method based on a server, a device and a third-party terminal, as shown below.

[0076] (1) The server generates a public-private key pair based on the homomorphic algorithm.

[0077] The server at the back end of the automobile manufacturer generates a homomorphic algorithm public-private key pair for each vehicle. Taking a 512-bit key as an example, the public-private key pair generation process includes: randomly generating a first prime number P and a second prime number Q with a length of 256 bits, and the first prime number P and the second prime number Q are represented as data of length 32 in hexadecimal; calculating N = P*Q, λ = lcm(P-1,Q-1); the result of P multiplying Q is recorded as N, N is 512-bit data, and is represented as data of length 64 in hexadecimal. λ is the least common multiple of the third prime number P-1 and the fourth prime number Q-1. The method for calculating the least common multiple is to first calculate the large number A of the multiplication operation of the third prime number P-1 and the fourth prime number Q-1, and then calculate the greatest common divisor of (P-1) and (Q-1) and record it as B. The large number A is divided by B to obtain the least common multiple λ, λ is 512-bit data, and is represented as data of length 64 in hexadecimal.

[0078] Randomly generate a second string G, G is less than N 2 And with N 2 They are mutually prime numbers, for example, G=N+1.

[0079] (N, G) is determined as the public key in the public-private key pair, which is downloaded to the security chip as the public key for encrypting data, and λ is the private key, which can be managed and saved by the data owner (ie, the server).

[0080] (2) The server uses a secure channel to send the encrypted public key data to the device.

[0081] Taking SCP02 as an example, a secure channel is established between the server at the back end of the car factory and the security chip at the device end. The process of establishing a secure channel can be found in the relevant GP specifications.

[0082] The server encrypts the public key (N, G) into encrypted public key data and transmits the encrypted public key data to the security chip.

[0083] (3) The device uses the session key to decrypt the encrypted public key data into the public key.

[0084] The security chip receives the encrypted public key data and decrypts it using the session key to obtain the public key (N, G). The security chip stores the public key (N, G) for subsequent encryption of data.

[0085] (4) The device uses the public key to encrypt the operation data generated during the operation of the device to obtain encrypted data.

[0086] The process of the security chip using the public key (N, G) to encrypt the running data is as follows:

[0087] The device accesses the security chip and sends an APDU instruction to send the running data M to the security chip, where M is hexadecimal data; the security chip randomly generates the first largest number R with a length of 512 bits.

[0088] Then, calculate G M mod N 2 , the square of G raised to the power of M modulo N, the result is 1024-bit hexadecimal data, which is the first encrypted data C1.

[0089] Calculate R N mod N 2 , R raised to the Nth power modulo the square of N, the result is 1024-bit hexadecimal data, which is the second encrypted data C2.

[0090] Calculate C1·C2mod N 2 , C1 multiplied by C2 modulo N squared, the result is 1024 bits of hexadecimal data, which is the encrypted data C.

[0091] (5) The device uploads the encrypted data to the server.

[0092] The security chip returns encrypted data C as a response to the APDU. The device uploads the encrypted data C to the server at the back end of the car factory through the network.

[0093] (6) The server stores encrypted data.

[0094] (7) The server sends encrypted data to the third-party terminal. The server at the back end of the car factory provides relevant encrypted data to third-party companies that need data analysis, such as insurance companies.

[0095] (8) The third-party terminal calls the encryption algorithm of the server to analyze the encrypted data and obtains the data analysis result. The third-party terminal calls the homomorphic addition, subtraction, multiplication, and division algorithm services provided by the server to perform data analysis and obtain the data analysis result, which is the encrypted data.

[0096] (9) The third-party terminal sends the data analysis results to the server.

[0097] (10) The server uses the private key in the public-private key pair to decrypt the data analysis result and obtain the data decryption result. The server at the back end of the car factory uses the private key of the vehicle homomorphic algorithm generated earlier to decrypt the data analysis result and obtain the data decryption result.

[0098] (11) The server sends the decryption result to the third-party terminal.

[0099] In summary, the data encryption method provided by the embodiment of the present disclosure includes: the device side receives the public key sent by the server; wherein the public key is included in the public-private key pair generated by the server; the device side uses the public key to encrypt the operation data generated during the operation of the device side to obtain encrypted data; the device side uploads the encrypted data to the server so that the server stores the encrypted data.

[0100] In actual use, the data of many embedded devices needs to be transmitted from the device side to the server through the network for storage. This technical solution implements the homomorphic encryption algorithm on the device side, which can use the public key to encrypt the running data, ensure the security of the running data on the device side from the source, and upload the encrypted data to the server for storage, thereby improving the security of the data. In subsequent data analysis, the homomorphic algorithm can be used to support joint computing of multiple parties and achieve data availability but invisibility.

[0101] Furthermore, implementing the homomorphic encryption algorithm through a secure chip on the device side can improve the performance of the algorithm and ensure the secure storage of public keys and the security of the algorithm.

[0102] Figure 5 This is a structural block diagram of a data encryption device provided in an embodiment of the present disclosure. The data encryption device can be applied to a device end to implement the above data encryption method. The device can be implemented using software and / or hardware. Figure 5 As shown, the data encryption device may include the following modules.

[0103] The public key receiving module 310 is used to receive the public key sent by the server; wherein the public key is included in the public-private key pair generated by the server;

[0104] The data encryption module 320 is used to encrypt the operation data generated during the operation of the device end using the public key to obtain encrypted data;

[0105] The data uploading module 330 is used to upload the encrypted data to the server so that the server stores the encrypted data.

[0106] Figure 6This is a structural block diagram of a data encryption device provided in an embodiment of the present disclosure. The data encryption device can be applied to a server to implement the above data encryption method. The device can be implemented using software and / or hardware. Figure 6 As shown, the data encryption device may include the following modules.

[0107] A public-private key pair generation module 410, used to generate a public-private key pair according to a homomorphic algorithm;

[0108] A public key sending module 420, configured to send the public key in the public-private key pair to the device end, so that the device end uses the public key to encrypt the operation data generated during the operation to obtain encrypted data;

[0109] The data storage module 430 is used to receive and store the encrypted data sent by the device.

[0110] The implementation principle and technical effects of the device provided in this embodiment are the same as those of the aforementioned method embodiment. For the sake of brief description, for matters not mentioned in the device embodiment, reference may be made to the corresponding contents in the aforementioned method embodiment.

[0111] Figure 7 The structure diagram of an electronic device provided by the embodiment of the present disclosure is shown in FIG. Figure 7 As shown, the electronic device 500 includes one or more processors 501 and a memory 502 .

[0112] The processor 501 may be a central processing unit (CPU) or other forms of processing units having data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device 500 to perform desired functions.

[0113] The memory 502 may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, a random access memory (RAM) and / or a cache memory (cache), etc. The non-volatile memory may include, for example, a read-only memory (ROM), a hard disk, a flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor 501 may run the program instructions to implement the data encryption method of the embodiment of the present disclosure described above and / or other desired functions. Various contents such as input signals, signal components, noise components, etc. may also be stored in the computer-readable storage medium.

[0114] In one example, the electronic device 500 may further include: an input device 503 and an output device 504 , and these components are interconnected via a bus system and / or other forms of connection mechanisms (not shown).

[0115] In addition, the input device 503 may also include, for example, a keyboard, a mouse, and the like.

[0116] The output device 504 can output various information to the outside, including the determined distance information, direction information, etc. The output device 504 can include, for example, a display, a speaker, a printer, a communication network and a remote output device connected thereto, and the like.

[0117] Of course, to simplify, Figure 7 Only some of the components related to the present disclosure in the electronic device 500 are shown, and components such as a bus, an input / output interface, etc. are omitted. In addition, according to specific application situations, the electronic device 500 may also include any other appropriate components.

[0118] Furthermore, this embodiment also provides a computer-readable storage medium, wherein the storage medium stores a computer program, and the computer program is used to execute the above data encryption method.

[0119] A computer program product of a data encryption method, device, electronic device, and medium provided in the embodiments of the present disclosure includes a computer-readable storage medium storing program code. The instructions included in the program code can be used to execute the methods described in the previous method embodiments. The specific implementation can be found in the method embodiments and will not be repeated here.

[0120] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0121] The above description is only a specific embodiment of the present disclosure, so that those skilled in the art can understand or implement the present disclosure. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure will not be limited to the embodiments described herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A data encryption method, characterized in that: The method is applied to a device, and includes: Receiving a public key sent by a server; wherein the public key is included in a public-private key pair generated by the server; Using the public key to encrypt the operation data generated during the operation of the device end to obtain encrypted data; The encrypted data is uploaded to the server so that the server stores the encrypted data.

2. The method according to claim 1, characterized in that The using the public key to encrypt the operation data generated during the operation of the device end to obtain the encrypted data includes: In the security chip of the device, the operation data generated during the operation of the device is homomorphically encrypted using the first character string and the second character string in the public key to obtain first encrypted data; Using the first character string and a randomly generated first large number to homomorphically encrypt the running data, to obtain second encrypted data; The first encrypted data, the second encrypted data, and the first character string are homomorphically encrypted to obtain encrypted data.

3. The method according to claim 1, characterized in that The receiving server sends a public key, including: Receive the encrypted public key data sent by the server using a pre-established secure channel; The encrypted public key data is decrypted into the public key using a pre-generated session key.

4. A data encryption method, characterized in that: The method is applied to a server, and the method comprises: Generate a public-private key pair based on a homomorphic algorithm; Sending the public key in the public-private key pair to the device end, so that the device end uses the public key to encrypt the operation data generated during the operation to obtain encrypted data; The encrypted data sent by the device is received and stored.

5. The method according to claim 4, characterized in that The generating of a public-private key pair according to a homomorphic algorithm includes: Generate a first prime number and a second prime number; generating a third prime number corresponding to the first prime number and a fourth prime number corresponding to the second prime number; Determine the least common multiple of the third prime number and the fourth prime number as the private key in the public-private key pair; Generate a security condition according to a first string obtained by multiplying the first prime number and the second prime number; wherein the security condition includes: being smaller than the square of the first string and being a coprime number with the square of the first string; generating a second character string satisfying the security condition; The first character string and the second character string are determined as public keys in the public-private key pair.

6. The method according to claim 4, characterized in that The sending the public key in the public-private key pair to the device end includes: Establish safe passages that meet preset specifications; Encrypting a public key in the public-private key pair into encrypted public key data; The encrypted public key data is sent to the device end using the secure channel, so that the device end uses a pre-generated session key to decrypt the encrypted public key data into the public key.

7. The method according to claim 4, characterized in that The method further comprises: Sending the encrypted data to a third-party terminal so that the third-party terminal calls the encryption algorithm of the server to analyze the encrypted data and obtain a data analysis result; Receiving the data analysis result sent by the third-party terminal, and decrypting the data analysis result using the private key in the public-private key pair to obtain a data decryption result; The decryption result is sent to the third-party terminal.

8. A data encryption device, characterized in that: The device is applied to a device end, and the device includes: A public key receiving module, used to receive a public key sent by a server; wherein the public key is included in the public-private key pair generated by the server; A data encryption module, used to encrypt the operation data generated during the operation of the device end using the public key to obtain encrypted data; The data uploading module is used to upload the encrypted data to the server so that the server stores the encrypted data.

9. A data encryption device, characterized in that: The device is applied to a server, and comprises: A public-private key pair generation module, used to generate a public-private key pair based on a homomorphic algorithm; A public key sending module, used to send the public key in the public-private key pair to the device end, so that the device end uses the public key to encrypt the operation data generated during the operation to obtain encrypted data; The data storage module is used to receive and store the encrypted data sent by the device.

10. An electronic device, characterized in that: The electronic device comprises: processor; a memory for storing instructions executable by the processor; The processor is used to read the executable instructions from the memory and execute the instructions to implement the method described in any one of claims 1 to 7.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed on a terminal device, the terminal device implements the method according to any one of claims 1 to 7.

Images