User data encryption method and device, storage medium and electronic equipment

Abstract

The invention discloses a user data encryption method and device, a storage medium and electronic equipment, and relates to the technical field of smart home. The user data encryption method comprises the following steps: acquiring a root key generated through a target key system; encrypting a user key according to the root key to obtain a user encrypted key, the user key being generated according to a random algorithm; and encrypting the user data according to the user encryption key. By adopting the technical scheme, the problem of key leakage caused by improper operation of an operator in the related technology is solved, so that the security of the key is improved in the encryption and decryption process, and the risk of key leakage is reduced.

Description

Technical Field

[0001] The present application relates to the field of smart home technology, and more specifically, to a method and device for encrypting user data, a storage medium, and an electronic device. Background Art

[0002] In the related art, it is usually necessary to obtain a key to encrypt and decrypt the user data of the target object. In this process, the key is often leaked due to improper operation of the operator.

[0003] In the related art, there is no effective solution to the problem of key leakage due to improper operation of the operator. Summary of the invention

[0004] The embodiments of the present application provide a method and device for encrypting user data, a storage medium, and an electronic device, so as to at least solve the problem of key leakage due to improper operation of the operator in the related art.

[0005] According to one aspect of an embodiment of the present application, a method for encrypting user data is provided, comprising: obtaining a root key generated by a target key system; encrypting a user key according to the root key to obtain a user encryption key, wherein the user key is generated according to a random algorithm; and encrypting the user data according to the user encryption key.

[0006] In an optional embodiment, the user data is encrypted according to the user encryption key, including: randomly generating a first initialization vector for the user data, and padding or truncating the user data according to a first preset standard when the length of the user data does not meet the first preset standard; performing encryption operations in a symmetric encryption algorithm on the padded or truncated user data according to the first initialization vector and the user encryption key.

[0007] In an optional embodiment, encrypting a user key according to the root key includes: randomly generating a second initialization vector for the user key, and padding or truncating the user key according to a first preset standard when the length of the user key does not meet the first preset standard; performing encryption operations in a symmetric encryption algorithm on the padded or truncated user key according to the second initialization vector and the root key.

[0008] In an optional embodiment, after encrypting the user data according to the user encryption key, the method further includes: when the encrypted user data needs to be decrypted, obtaining a first initialization vector, wherein the first initialization vector is generated according to the user data; and performing a decryption operation in a symmetric encryption algorithm on the encrypted user data according to the first initialization vector and the user encryption key.

[0009] In an optional embodiment, the user key is encrypted according to the root key to obtain the user encryption key, including: when the root key is generated by an asymmetric encryption algorithm, obtaining the root public key of the root key; when the byte sequence of the user key does not meet the second preset standard, encoding the byte sequence of the user key according to the second preset standard; and asymmetrically encrypting the encoded byte sequence of the user key according to the root public key.

[0010] In an optional embodiment, after encrypting the user key according to the root key to obtain the user encryption key, the method further includes: when it is necessary to encrypt the user data of the target object, prompting the target object to enter the user password of the target object; hashing the user password of the target object to obtain a first hash value; when the first hash value and the second hash value are the same, encrypting the user data according to the user encryption key, wherein the second hash value is generated by hashing the user password entered by the target object for the first time.

[0011] In an optional embodiment, after encrypting the user data according to the user encryption key, the method further includes: receiving a request from a device requester, wherein the request is used to request to obtain the encrypted user data; upon determining that the device requester obtains the request authority, determining a secure communication channel that allows transmission of the encrypted user data, wherein the secure communication channel is encrypted by an encryption protocol; and transmitting the encrypted user data to the device requester through the secure communication channel.

[0012] According to another aspect of the present invention, a user data encryption device is also provided, including: an acquisition module for acquiring a root key generated by a target key system; a first encryption module for encrypting a user key according to the root key to obtain a user encryption key, wherein the user key is generated according to a random algorithm; and a second encryption module for encrypting the user data according to the user encryption key.

[0013] According to another aspect of the embodiments of the present application, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the above-mentioned user data encryption method when running.

[0014] According to another aspect of an embodiment of the present application, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the user data encryption method through the computer program.

[0015] According to another aspect of the embodiments of the present application, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the above-mentioned user data encryption method is implemented.

[0016] In the embodiment of the present application, a root key generated by a target key system is obtained; in the key management system, a user key is generated for the target object through symmetric encryption; the user key is symmetrically encrypted using the root key to obtain a user encryption key; and the user data of the target object is encrypted according to the user encryption key. The above technical solution solves the problem of key leakage due to improper operation of the operator in the related technology, thereby improving the security of the key in the encryption and decryption process and reducing the risk of key leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0018] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0019] Figure 1 It is a hardware environment diagram of a method for encrypting user data in an embodiment of the present application;

[0020] Figure 2 is a flow chart of a method for encrypting user data according to an embodiment of the present application;

[0021] Figure 3 is a flowchart of a method for encrypting user data according to an optional embodiment of the present application;

[0022] Figure 4 It is a structural block diagram of a user data encryption device according to an embodiment of the present application. DETAILED DESCRIPTION

[0023] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0024] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0025] According to one aspect of an embodiment of the present application, a method for encrypting user data is provided. The method for encrypting user data is widely used in smart home, smart home, smart home device ecology, smart residential ecology and other whole-house intelligent digital control application scenarios. Optionally, in this embodiment, the above-mentioned method for encrypting user data can be applied to Figure 1 In the hardware environment shown in FIG. 1 , a first application system 102 and a second application system 104 are formed. Figure 1 As shown, the first application system 102 is connected to the second application system 104 via a network, and can be used to provide services (such as application services, etc.) for the first application system 102 or a client installed on the first application system 102. A database can be set on the first application system 102 or independently of the first application system 102 to provide data storage services for the first application system 102 and the second application system 104. Cloud computing and / or edge computing services can be configured on the first application system 102 or independently of the first application system 102 to provide data computing services for the first application system 102 and the second application system 104.

[0026] The network may include but is not limited to at least one of the following: wired network, wireless network. The wired network may include but is not limited to at least one of the following: wide area network, metropolitan area network, local area network, and the wireless network may include but is not limited to at least one of the following: WIFI (Wireless Fidelity), Bluetooth. The first application system 102 and the second application system 104 may not be limited to PC, mobile phone, tablet computer, smart air conditioner, smart range hood, smart refrigerator, smart oven, smart stove, smart washing machine, smart water heater, smart washing equipment, smart dishwasher, smart projection equipment, smart TV, smart clothes drying rack, smart curtain, smart audio and video, smart socket, smart audio, smart speaker, smart fresh air equipment, smart kitchen and bathroom equipment, smart bathroom equipment, smart sweeping robot, smart window cleaning robot, smart mopping robot, smart air purification equipment, smart steamer, smart microwave oven, smart kitchen treasure, smart purifier, smart water dispenser, system platform, etc.

[0027] In this embodiment, a method for encrypting user data is provided, which is applied to the first application system. Figure 2 : is a flowchart of a method for encrypting user data according to an embodiment of the present application, the process includes the following steps:

[0028] Step S202, obtaining a root key generated by the target key system;

[0029] Step S204, encrypting the user key according to the root key to obtain a user encryption key, wherein the user key is generated according to a random algorithm;

[0030] Step S206: encrypt the user data according to the user encryption key.

[0031] In the embodiment of the present application, a root key generated by a target key system is obtained; a user key is encrypted according to the root key to obtain a user encryption key, wherein the user key is generated according to a random algorithm; and the user data is encrypted according to the user encryption key. The above technical solution solves the problem of key leakage due to improper operation of the operator in the related technology, thereby improving the security of the key during the encryption and decryption process and reducing the risk of key leakage.

[0032] In an optional embodiment, the user data is encrypted according to the user encryption key, including: randomly generating a first initialization vector for the user data, and padding or truncating the user data according to a first preset standard when the length of the user data does not meet the first preset standard; performing encryption operations in a symmetric encryption algorithm on the padded or truncated user data according to the first initialization vector and the user encryption key.

[0033] In the symmetric encryption algorithm, a first initialization vector is randomly generated according to the data to be encrypted. At the same time, the symmetric encryption algorithm requires that the data length must be an integer multiple of the block size. If the data length does not meet this condition, padding or truncation is required. Padding usually refers to adding some specific characters or data at the end of the data until the total length meets the requirements, while truncation refers to removing the excess data. When the user data is properly padded or truncated according to the first preset standard and a random first initialization vector is generated, the encryption operation of the symmetric encryption algorithm can be performed on the user data through this first initialization vector and the user encryption key.

[0034] In an optional embodiment, encrypting a user key according to the root key includes: randomly generating a second initialization vector for the user key, and padding or truncating the user key according to a first preset standard when the length of the user key does not meet the first preset standard; performing encryption operations in a symmetric encryption algorithm on the padded or truncated user key according to the second initialization vector and the root key.

[0035] Optionally, assume that the user key is "userkey123456". Use the AES encryption algorithm in the symmetric encryption algorithm to encrypt the user key. The block size used by the AES encryption algorithm is 128 bits, i.e., 16 bytes. The user key has a total of 13 bytes, and the data length is less than 16 bytes, so the user key needs to be padded. In the AES encryption algorithm, a series of padding bytes are usually added to the end of the data to achieve padding. At the same time, a random 128-bit first initialization vector is generated according to the user key. The encryption operation in the AES encryption algorithm is performed on the user key through this first initialization vector and the root key.

[0036] In an optional embodiment, after encrypting the user data according to the user encryption key, the method further includes: when the encrypted user data needs to be decrypted, obtaining a first initialization vector, wherein the first initialization vector is generated according to the user data; and performing a decryption operation in a symmetric encryption algorithm on the encrypted user data according to the first initialization vector and the user encryption key.

[0037] In a symmetric encryption algorithm, encryption and decryption operations need to use the same key and initialization vector. Therefore, when the encrypted user data needs to be decrypted, a first initialization vector randomly generated according to the user data when the user data is encrypted is obtained. The encrypted user data is decrypted in the AES encryption algorithm using the first initialization vector and the user encryption key.

[0038] Optionally, assuming that the user data is "Secret Message", when performing the encryption operation of the AES encryption algorithm, a first initialization vector "abcdef1234567890" is randomly generated for the user data, and the encryption operation in the AES encryption algorithm is performed on the encrypted user data using the first initialization vector and the user encryption key to obtain the encrypted user data. When the encrypted user data needs to be decrypted, the same first initialization vector "abcdef1234567890" and the encrypted user key are used to decrypt the encrypted user data through the decryption operation in the AES encryption algorithm to obtain the user data "Secret Message" in plain text.

[0039] In an optional embodiment, the user key is encrypted according to the root key to obtain the user encryption key, including: when the root key is generated by an asymmetric encryption algorithm, obtaining the root public key of the root key; when the byte sequence of the user key does not meet the second preset standard, encoding the byte sequence of the user key according to the second preset standard; and asymmetrically encrypting the encoded byte sequence of the user key according to the root public key.

[0040] In the target key system, a root key pair is generated according to an asymmetric encryption algorithm, wherein the root key pair includes a root public key and a root private key. In this embodiment, only the root public key is used for encryption. In the key management system, a user key is generated according to a symmetric encryption algorithm. Assume that the generated user key is "UserKey123!". The user key is converted into a byte sequence, and it is checked whether the byte sequence of the user key meets the second preset standard, wherein the second preset standard in this embodiment refers to whether the byte sequence meets the Base64 encoding format. In the case that the byte sequence of the user key does not meet the second preset standard, the byte sequence of the user key is encoded according to the second preset standard, i.e., the Baase64 encoding format. Asymmetric encryption is performed on the user key that meets the second preset standard according to the public key.

[0041] In an optional embodiment, after encrypting the user key according to the root key to obtain the user encryption key, the method further includes: when it is necessary to encrypt the user data of the target object, prompting the target object to enter the user password of the target object; hashing the user password of the target object to obtain a first hash value; when the first hash value and the second hash value are the same, encrypting the user data according to the user encryption key, wherein the second hash value is generated by hashing the user password entered by the target object for the first time.

[0042] When the target object enters the user password for the first time, the user password is hashed and encrypted by a hash function such as SHA-256 to obtain the encrypted user password, which is the second hash value in this embodiment, and the second hash value is stored in the database. When the user data of the target object needs to be encrypted, the target object is prompted to enter the user password. After receiving the user password of the target object, the user password is hashed and encrypted using the SHA-256 hash function to obtain the encrypted user password, which is the first hash value in this embodiment. Compare the first hash value and the second hash value. If the two hash values ​​are the same, it means that the identity authentication of the target object is successful. At this time, the user data is encrypted according to the user encryption key.

[0043] Alternatively, assume that there is a banking application system. When the target object enters the user password for the first time during the process of registering an account, the payment password is hashed and encrypted through the SHA-256 hash function to obtain the encrypted user password, i.e., the second hash value, and the second hash value is stored in the database. After the target object performs a transfer operation, the account number for the transfer needs to be encrypted. At this time, the target object is prompted to enter the user password, and the user password is hashed and encrypted through the SHA-256 hash function to obtain the encrypted user password, i.e., the first hash value. The second hash value stored in the database is obtained, and the first hash value is compared with the second hash value. When the two hash values ​​are the same, the user data is encrypted according to the user encryption key.

[0044] In an optional embodiment, after encrypting the user data according to the user encryption key, the method further includes: receiving a request from a device requester, wherein the request is used to request to obtain the encrypted user data; upon determining that the device requester obtains the request authority, determining a secure communication channel that allows transmission of the encrypted user data, wherein the secure communication channel is encrypted by an encryption protocol; and transmitting the encrypted user data to the device requester through the secure communication channel.

[0045] A request is received from a device requester, the request being intended to obtain encrypted user data. Before responding to the request, it is necessary to verify whether the device requester has the appropriate authority to obtain the data, wherein the authority verification includes but is not limited to checking the authentication status, role, and authority level of the device requester. If it is determined that the device requester has the requested authority, a secure communication channel is determined that allows the transmission of encrypted user data, wherein the secure communication channel is encrypted by an encryption protocol. The encryption protocols used include but are not limited to the Hypertext Transfer Protocol (HTTPS), the Secure Sockets Layer / Transport Layer Security Protocol (SSL / TLS), and the Secure Shell Protocol (SSH). The encrypted user data is transmitted to the device requester through a secure communication channel.

[0046] In order to better understand the process of the above-mentioned user data encryption method, the encryption implementation method process of the above-mentioned user data is described below in combination with an optional embodiment, but it is not used to limit the technical solution of the embodiment of the present application.

[0047] Figure 3 is a flow chart of a method for encrypting user data according to an optional embodiment of the present invention. Figure 3 As shown, the specific steps include:

[0048] Obtain the root key generated by the target key system, and generate user keys for N target objects in the key management system. Use the root key to symmetric-encrypt each user key to obtain N user encryption keys. Store the N user encryption keys and their key IDs in the key management system. When the target object needs to encrypt its user data, it first needs to pass the identity authentication, and determine the corresponding key ID based on the identity authentication result of the target object. According to the key ID, retrieve the corresponding user encryption key from the key management system. Call the encryption function in the software development kit SDK, and encrypt the user data of the target object according to the retrieved user encryption key. Similarly, when the target object needs to decrypt its encrypted user data, it first needs to pass the identity authentication, and determine the corresponding key ID based on the identity authentication result of the target object. According to the key ID, retrieve the corresponding user encryption key from the key management system. Call the decryption function in the software development kit SDK, and decrypt the encrypted user data of the target object according to the retrieved user encryption key.

[0049] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, an operating terminal, or a network device, etc.) to execute the methods of each embodiment of the present application.

[0050] Figure 4 is a structural block diagram of a user data encryption device according to an embodiment of the present application; Figure 4 As shown, including:

[0051] An acquisition module 40, used to acquire a root key generated by a target key system;

[0052] A first encryption module 42, configured to encrypt a user key according to the root key to obtain a user encryption key, wherein the user key is generated according to a random algorithm;

[0053] The second encryption module 44 is used to encrypt the user data according to the user encryption key.

[0054] In the embodiment of the present application, a root key generated by a target key system is obtained; a user key is encrypted according to the root key to obtain a user encryption key, wherein the user key is generated according to a random algorithm; and the user data is encrypted according to the user encryption key. The above technical solution solves the problem of key leakage due to improper operation of the operator in the related technology, thereby improving the security of the key during the encryption and decryption process and reducing the risk of key leakage.

[0055] In an optional embodiment, the second encryption module 44 is also used to randomly generate a first initialization vector for the user data, and to pad or truncate the user data according to the first preset standard when the length of the user data does not meet the first preset standard; and to perform encryption operations in the symmetric encryption algorithm on the padded or truncated user data according to the first initialization vector and the user encryption key.

[0056] In an optional embodiment, the first encryption module 42 is also used to randomly generate a second initialization vector for the user key, and when the length of the user key does not meet the first preset standard, pad or truncate the user key according to the first preset standard; perform encryption operations in the symmetric encryption algorithm on the padded or truncated user key according to the second initialization vector and the root key.

[0057] In an optional embodiment, the second encryption module 44 is further used to obtain a first initialization vector when the encrypted user data needs to be decrypted, wherein the first initialization vector is generated based on the user data; and perform a decryption operation in a symmetric encryption algorithm on the encrypted user data based on the first initialization vector and the user encryption key.

[0058] In an optional embodiment, the first encryption module 42 is also used to obtain the root public key of the root key when the root key is generated by an asymmetric encryption algorithm; encode the byte sequence of the user key according to the second preset standard when the byte sequence of the user key does not meet the second preset standard; and asymmetrically encrypt the encoded byte sequence of the user key according to the root public key.

[0059] In an optional embodiment, the second encryption module 44 is also used to prompt the target object to enter the user password of the target object when it is necessary to encrypt the user data of the target object; hash the user password of the target object to obtain a first hash value; and when the first hash value and the second hash value are the same, encrypt the user data according to the user encryption key, wherein the second hash value is generated by hashing the user password entered by the target object for the first time.

[0060] In an optional embodiment, the second encryption module 44 is also used to receive a request from a device requester, wherein the request is used to request to obtain encrypted user data; when it is determined that the device requester obtains the request authority, determine a secure communication channel that allows transmission of the encrypted user data, wherein the secure communication channel is encrypted by an encryption protocol; and transmit the encrypted user data to the device requester through the secure communication channel.

[0061] An embodiment of the present application further provides a storage medium, which includes a stored program, wherein the program executes any of the above methods when it is run.

[0062] Optionally, in this embodiment, the storage medium may be configured to store program codes for executing the following steps:

[0063] S1, obtain the root key generated by the target key system;

[0064] S2, encrypting the user key according to the root key to obtain a user encryption key, wherein the user key is generated according to a random algorithm;

[0065] S3: Encrypt the user data according to the user encryption key.

[0066] An embodiment of the present application further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0067] Optionally, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0068] Optionally, in this embodiment, the processor may be configured to perform the following steps through a computer program:

[0069] S1, obtain the root key generated by the target key system;

[0070] S2, encrypting the user key according to the root key to obtain a user encryption key, wherein the user key is generated according to a random algorithm;

[0071] S3: Encrypt the user data according to the user encryption key.

[0072] Optionally, in this embodiment, the above-mentioned storage medium may include but is not limited to: a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and other media that can store program codes.

[0073] An embodiment of the present application further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the steps in any one of the above method embodiments are implemented.

[0074] An embodiment of the present application further provides another computer program product, including a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in any of the above method embodiments are implemented.

[0075] The embodiments of the present application also provide a computer program, which includes computer instructions, which are stored in a computer-readable storage medium; a processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the steps in any one of the above method embodiments.

[0076] Optionally, the specific examples in this embodiment may refer to the examples described in the above embodiments and optional implementation modes, and this embodiment will not be described in detail here.

[0077] Obviously, those skilled in the art should understand that the above modules or steps of the present application can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, and optionally, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order from that herein, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present application is not limited to any specific combination of hardware and software.

[0078] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for encrypting user data, characterized in that: include: Obtain the root key generated by the target key system; Encrypting a user key according to the root key to obtain a user encryption key, wherein the user key is generated according to a random algorithm; The user data is encrypted according to the user encryption key.

2. The method for encrypting user data according to claim 1, characterized in that: Encrypting the user data according to the user encryption key includes: randomly generating a first initialization vector for the user data, and padding or truncating the user data according to a first preset standard if the length of the user data does not meet a first preset standard; An encryption operation in a symmetric encryption algorithm is performed on the padded or truncated user data according to the first initialization vector and the user encryption key.

3. The method for encrypting user data according to claim 1, characterized in that: Encrypting the user key according to the root key includes: randomly generating a second initialization vector for the user key, and padding or truncating the user key according to the first preset standard if the length of the user key does not meet the first preset standard; Perform an encryption operation in a symmetric encryption algorithm on the padded or truncated user key according to the second initialization vector and the root key.

4. The method for encrypting user data according to claim 1, characterized in that: After encrypting the user data according to the user encryption key, the method further includes: In a case where the encrypted user data needs to be decrypted, obtaining a first initialization vector, wherein the first initialization vector is generated according to the user data; A decryption operation in a symmetric encryption algorithm is performed on the encrypted user data according to the first initialization vector and the user encryption key.

5. The method for encrypting user data according to claim 1, characterized in that: The user key is encrypted according to the root key to obtain the user encryption key, including: When the root key is generated by an asymmetric encryption algorithm, obtaining a root public key of the root key; When the byte sequence of the user key does not meet the second preset standard, encoding the byte sequence of the user key according to the second preset standard; The byte sequence of the encoded user key is asymmetrically encrypted according to the root public key.

6. The method for encrypting user data according to claim 1, characterized in that: After encrypting the user key according to the root key to obtain the user encryption key, the method further includes: In the case where the user data of the target object needs to be encrypted, prompting the target object to enter the user password of the target object; Hash-encrypt the user password of the target object to obtain a first hash value; In the case where the first Hash value and the second Hash value are the same, the user data is encrypted according to the user encryption key, wherein the second Hash value is generated by performing Hash encryption according to a user password input by the target object for the first time.

7. The method for encrypting user data according to claim 1, characterized in that: After encrypting the user data according to the user encryption key, the method further includes: Receiving a request from a device requester, wherein the request is for requesting to obtain encrypted user data; In the case where it is determined that the device requester obtains the request permission, a secure communication channel is determined that allows the transmission of the encrypted user data, wherein the secure communication channel is encrypted by an encryption protocol; and the encrypted user data is transmitted to the device requester through the secure communication channel.

8. A user data encryption device, characterized in that: include: An acquisition module, used for acquiring a root key generated by a target key system; A first encryption module, used to encrypt a user key according to the root key to obtain a user encryption key, wherein the user key is generated according to a random algorithm; The second encryption module is used to encrypt the user data according to the user encryption key.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored program, wherein the program executes the method described in any one of claims 1 to 7 when executed.

10. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to execute the method according to any one of claims 1 to 7 through the computer program.

Images