Data trusted management method and device based on data security

Abstract

The embodiment of the invention relates to a data trusted management method and device based on data security. The method comprises the following steps: receiving N groups of original keys sent by N key management platforms; a first data encryption key and N mapping relations are generated according to the N groups of original keys, so that the first data encryption key can be restored by adopting the M groups of original keys and the M mapping relations, and the complexity of the first data encryption key is higher than that of the original keys; and storing the first data encryption key and the N mapping relationships to a server. According to the technical scheme provided by the embodiment of the invention, the plurality of groups of original keys sent by the plurality of key management platforms are used for generating the data encryption key according to the preset mapping relationship, and the data encryption key can be recovered according to the mapping relationship without all the original keys; the technical problem that data cannot be decrypted due to the fact that an original key cannot be obtained due to reasons such as failure of a key management platform is solved.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of data security computing technology, and in particular to a data trust management method and device based on data security. Background Art

[0002] In existing multi-party data sharing platforms, the data encryption method is usually that after the main server (such as a platform, server, or database, etc.) obtains the data, it obtains the data encryption key from the key management platform (KMS), and uses the data encryption key to encrypt the data before storing it in the main server. When the data needs to be used, the main server initiates a request to the key management platform to obtain the data encryption key to decrypt the encrypted data, and then obtains the decrypted data and uses the data. The advantage of the above method is that the main server does not save the data encryption key, that is, the background administrator of the main server cannot directly use the data encryption key to decrypt the data.

[0003] The problem with the above method is that the acquisition of data encryption keys depends on the key management platform, which may fail due to business or other reasons. At this time, the main server cannot obtain the key used to decrypt the data, resulting in the inability to decrypt the data. Summary of the invention

[0004] Based on the above situation of the prior art, the purpose of the embodiments of the present invention is to provide a data trusted management method and device based on data security, which solves the technical problem in the prior art that the original key cannot be obtained due to failure of the key management platform and the like, and thus the data cannot be decrypted.

[0005] To achieve the above object, according to one aspect of the present invention, a data trust management method based on data security is provided, which is applied to a server, and the method comprises:

[0006] Receive N groups of original keys sent by N key management platforms;

[0007] Generate a first data encryption key and N mapping relationships based on the N groups of original keys, so that the first data encryption key can be restored by using M groups of original keys and M mapping relationships, and the complexity of the first data encryption key is higher than the complexity of the original key;

[0008] storing the first data encryption key and N mapping relationships to the server;

[0009] Among them, the mapping relationship includes a conversion relationship between the original key and the target information in the first data encryption key; the M groups of original keys correspond to the target information in the first data encryption key and are at least partially complementary to restore the first data encryption key, and the M groups of original keys are any M groups among the N groups of original keys; M≤N.

[0010] Further, the mapping relationship is configured such that each bit in the first data encryption key exists in at least M groups of the N groups of original keys.

[0011] Further, generating a first data encryption key according to the N groups of original keys includes:

[0012] Extracting a first portion from each of the N groups of original keys;

[0013] The N first parts are partially overlapped to generate a first data encryption key, and the N first parts are overlapped by adjusting the positions of the characters in the first parts or converting the information.

[0014] Furthermore, in the trusted execution environment of the server,

[0015] Generate a first data encryption key and N mapping relationships according to the N groups of original keys;

[0016] Using the first data encryption key to encrypt the original data;

[0017] The first data encryption key, N mapping relationships and the encrypted data are stored in the server.

[0018] Furthermore, the method further comprises:

[0019] Generate a first combination number, the first combination number including at least one of a local physical key of the server, a random number, and a superposition key generated according to a key algorithm;

[0020] Inserting the first combination number into the first data encryption key to encrypt the original data;

[0021] The first combination number is stored in the server.

[0022] Furthermore, the method further comprises:

[0023] Sending an original key request to N key management platforms, so that each of the key management platforms sends an original key according to the original key request;

[0024] Receive at least M groups of original keys sent by each key management platform;

[0025] Acquire M mapping relationships and encrypted data stored in the server, wherein the M mapping relationships correspond one-to-one to the M groups of original keys;

[0026] Restoring the first data encryption key using the M groups of original keys and the M mapping relationships;

[0027] The encrypted data is decrypted using the first data encryption key to obtain the original data.

[0028] Furthermore, the method further comprises:

[0029] Sending an original key request to N key management platforms, so that each of the key management platforms sends an original key according to the original key request;

[0030] Receive at least M groups of original keys sent by each key management platform;

[0031] Acquire M mapping relationships, encrypted data, and the first combination number stored in the server, wherein the M mapping relationships correspond one-to-one to the M groups of original keys;

[0032] Restoring the first data encryption key using the M groups of original keys, the M mapping relationships and the first combination number;

[0033] The encrypted data is decrypted using the first data encryption key to obtain the original data.

[0034] Furthermore, the method further comprises:

[0035] Obtaining a first hash value of the first data encryption key;

[0036] After restoring the first data encryption key using the M groups of original keys and the M mapping relationships, obtaining a second hash value of the restored first data encryption key;

[0037] verifying the restored first data encryption key according to the first hash value and the second hash value;

[0038] According to the verification result, the encrypted data is decrypted.

[0039] Further, according to the verification result, the encrypted data is decrypted, including:

[0040] If the verification passes, the encrypted data is decrypted using the restored first data encryption key;

[0041] If the verification fails, m groups of original keys and corresponding m mapping relationships are selected from at least M groups of original keys sent by each key management platform;

[0042] Restoring the first data encryption key using the m groups of original keys and the m mapping relationships;

[0043] Wherein, M=m, and the m groups of original keys are different from at least one of the M groups of original keys.

[0044] Furthermore, the original key request includes a user permission, so that each key management platform verifies the user permission and then sends the original key;

[0045] The user use permission indicates the data requesting user's right to use the encrypted data.

[0046] Furthermore, the method further comprises:

[0047] Generate an asymmetric encryption key, wherein the asymmetric encryption key includes a first public key and a first private key;

[0048] Signing the user use license with the first private key;

[0049] The first public key is sent to each key management platform, so that each key management platform verifies the user permission by using the first public key.

[0050] Furthermore, the method further comprises:

[0051] Sending an original key request to N key management platforms, wherein the original key request includes a user permission, so that a leader among the N key management platforms obtains confirmation information of the data requesting user based on the user permission request;

[0052] Receiving at least M groups of original keys sent by each key management platform, wherein the M groups of original keys are sent by each key management platform based on the confirmation information;

[0053] Among them, the N key management platforms adopt a clustering method to select a leader and multiple collaborators, and the leader obtains confirmation information and sends it to each collaborator.

[0054] According to another aspect of the present invention, a data trust management device based on data security is provided, which is applied to a server, and the device includes:

[0055] The original key receiving module is used to receive N groups of original keys sent by N key management platforms;

[0056] a data encryption key generation module, configured to generate a first data encryption key and N mapping relationships according to the N groups of original keys, so that the first data encryption key can be restored by using M groups of original keys and M mapping relationships, and the complexity of the first data encryption key is higher than the complexity of the original key;

[0057] A storage module, used for storing the first data encryption key and N mapping relationships to the server;

[0058] Among them, the mapping relationship includes a conversion relationship between the original key and the target information in the first data encryption key; the M groups of original keys correspond to the target information in the first data encryption key and are at least partially complementary to restore the first data encryption key, and the M groups of original keys are any M groups among the N groups of original keys; M≤N.

[0059] In summary, an embodiment of the present invention provides a data trust management method and device based on data security, the method comprising: receiving N groups of original keys sent by N key management platforms; generating a first data encryption key and N mapping relationships based on the N groups of original keys, so that the first data encryption key can be restored by using M groups of original keys and M mapping relationships, and the complexity of the first data encryption key is higher than the complexity of the original key; storing the first data encryption key and the N mapping relationships to the server. The technical solution provided by the embodiment of the present invention generates a data encryption key according to a predetermined mapping relationship from multiple groups of original keys sent by multiple key management platforms, and the data encryption key can be restored according to the mapping relationship without all the original keys, thereby solving the technical problem that the original key cannot be obtained due to failure of the key management platform and the data cannot be decrypted, thereby improving the data security and reliability in the multi-party data sharing platform scenario. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 is a flow chart of a data trust management method based on data security provided by an embodiment of the present invention;

[0061] Figure 2 It is a schematic block diagram of the server encrypting data when N=5 and M=3 according to the present invention;

[0062] Figure 3 It is a schematic block diagram of the server encrypting and decrypting data when N=5 and M=3 according to the present invention. DETAILED DESCRIPTION

[0063] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention is further described in detail below in conjunction with specific embodiments and with reference to the accompanying drawings. It should be understood that these descriptions are only exemplary and are not intended to limit the scope of the present invention. In addition, in the following description, the description of well-known structures and technologies is omitted to avoid unnecessary confusion of the concept of the present invention.

[0064] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in one or more embodiments of the present invention should be understood by people with ordinary skills in the field to which the present invention belongs. The words "first", "second" and similar words used in one or more embodiments of the present invention do not indicate any order, quantity or importance, but are only used to distinguish different components. "Include" or "comprise" and similar words mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect.

[0065] This solution can be applied to the target device (or server, central platform), which is used to manage encrypted data. The key of the key management platform in this solution is a highly complex key generated by the key management platform. In addition, the key management platform of this solution provides a key transmission interface to the target device, and transmits the key generated and managed by the key management platform through the interface. The key of multiple key management platforms is used to manage data on the target device. Compared with the solution in which the target device generates the key and stores it in the key management platform, the key generated by the key management platform in this solution is more complex and more secure. In addition, this solution makes little change to the key management platform and is easy to implement.

[0066] An embodiment of the present invention provides a data trust management method based on data security, which can be applied, for example, to a scenario of a multi-party data sharing system. The system includes at least a server and multiple key management platforms for providing original keys. Figure 1 The flowchart of the data trust management method based on data security provided by an embodiment of the present invention is shown in FIG. Figure 1 As shown, the method comprises the following steps:

[0067] S202: Receive N groups of original keys sent by N key management platforms. When the server obtains data to be encrypted and stored, it obtains N groups of original keys from the N key management platforms, where N is a natural number greater than or equal to 3, for example.

[0068] S204. Generate a first data encryption key and N mapping relationships based on N groups of original keys, so that the first data encryption key can be restored by using M groups of original keys and M mapping relationships, and the complexity of the first data encryption key is higher than the complexity of the original key. Among them, the mapping relationship refers to the conversion relationship between the original key and the target information in the first data encryption key. Generating N mapping relationships means, for each group of original keys in the N groups of original keys, generating a conversion relationship between the group of original keys and the target information in the first data encryption key. The M groups of original keys correspond to the target information in the first data encryption key that is at least partially complementary to restore the first data encryption key. The above-mentioned M groups of original keys are any M groups among the N groups of original keys; and satisfy M≤N. According to certain optional embodiments, the mapping relationship can be configured so that each bit in the generated first data encryption key exists in at least M groups of the N groups of original keys.

[0069] The first data encryption key may be generated according to N groups of original keys according to the following steps:

[0070] S2041. Extract the first part from each of the N groups of original keys.

[0071] S2042, performing partial overlap processing on the N first parts to generate a first data encryption key, and making the N first parts overlap by adjusting the positions of the characters in the first parts or converting the information.

[0072] S206: Store the first data encryption key and N mapping relationships to the server.

[0073] The technical solution provided by the embodiment of the present invention generates a data encryption key according to a predetermined mapping relationship by using multiple groups of original keys sent by multiple key management platforms, and enables the data encryption key to be restored according to the mapping relationship without requiring all the original keys. Even if some of the multiple key management platforms fail or stop serving, only the keys of some of the key management platforms are needed to be combined into a complete first data encryption key to decrypt the data. Figure 2 FIG. 1 shows a schematic block diagram of the server encrypting data when N=5 and M=3 according to the technical solution of the present invention. Figure 3 FIG. 4 is a schematic block diagram of the server decrypting data when N=5 and M=3 according to the technical solution of the present invention. Figure 2 and Figure 3As shown, the system includes a server and five key management platforms (key management platform 1, key management platform 2, key management platform 3, key management platform 4 and key management platform 5). According to the method provided in the embodiment of the present invention, the server receives five groups of original keys (original key A, original key B, original key C, original key D and original key E) sent by the five key management platforms, and generates a first data encryption key and five mapping relationships based on the five groups of original keys. The five mapping relationships are configured to use three of the five groups of original keys and the corresponding three mapping relationships, that is, the first data encryption key can be restored. For example, each of the five groups of original keys is a 4-digit number (or a combination of a 4-digit letter and a digit), then the five groups of original keys can be combined into a 5-digit number as the first data encryption key. Specifically, 3-digit numbers can be cut out of 5 groups of original keys respectively and then the mapping relationship conversion can be superimposed, so that there is partial repetition between each group of keys, so as to ensure that the 3-digit number can be derived using the other 4 keys, for example, 2 digits are repeated between original key A and original key B, 1 digit is repeated between original key A and original key C, 1 digit is repeated between original key A and original key D, and 2 digits are repeated between original key A and original key E. After the mapping relationship is superimposed on the original keys AE, they are 123, 234, 345, 145, and 125 respectively. The combined first data encryption key is 12345, and any three of the original keys can be combined into the first data encryption key 12345. The mapping relationship involved in the embodiment of the present invention is used to ensure that each digit or letter in the synthesized first data encryption key is reflected in 3 of the 5 original keys. In other words, the generated first data encryption key may be a direct series connection of the five original keys, and the mapping relationship may include a scheme for mutual conversion between the original key A and the original key E, which may be encrypted and stored, and restored when the original key is missing. For example, when the original key B and the original key D are missing, the original key B may be determined by combining the original key A with the first mapping relationship, and the original key D may be determined by combining the original key C with the second mapping relationship. In fact, the original key A, the original key C, and the original key E may be used to restore a part of the original key B or the original key D, respectively, to obtain the completed original key B or the original key D.

[0074] The method further comprises the steps of:

[0075] S208: Encrypt the original data using the first data encryption key, and store the first data encryption key, N mapping relationships, and the encrypted data to the server.

[0076] In order to improve data security, in the above steps, a first data encryption key and N mapping relationships are generated based on N groups of original keys, the original data is encrypted using the first data encryption key, and the first data encryption key, N mapping relationships and the encrypted data are stored in the server. In order to improve data security, all are executed in the server's trusted execution environment (TEE).

[0077] According to some optional embodiments, the number of random combinations can be increased during the above encryption process to increase the complexity of the data encryption key. In the case of increasing the number of random combinations for encryption processing, the random combination number must be involved in the decryption process to be realized, so that even if the original key in the key management platform is leaked, it will not lead to the leakage of the first data encryption key in the server. Increasing the number of random combinations during the encryption process can be based on the following steps:

[0078] S2081. Generate a first combination number, where the first combination number includes at least one of a local physical key of the server, a random number, and a superposition key generated according to a key algorithm.

[0079] S2082. Insert the first combination number into the first data encryption key to encrypt the original data.

[0080] S2083. Store the first combination number in the server.

[0081] When the encrypted data needs to be used, the server obtains M groups of original keys from all the original keys to decrypt the data. The data decryption includes the following steps:

[0082] S302: Send an original key request to N key management platforms, so that each of the key management platforms sends an original key according to the original key request. The original key request may include a user permission, so that each key management platform verifies the user permission and then sends the original key. The user permission indicates the data requesting user's right to use the encrypted data.

[0083] According to some optional embodiments, the key management platform may verify the user's use permission by using a private key signature and a public key signature verification method, including the following steps:

[0084] S3021: Generate an asymmetric encryption key, which includes a first public key and a first private key. A common encryption algorithm, such as RSA algorithm, can be selected to generate the asymmetric encryption key, which is not specifically limited in the present invention.

[0085] S3022. Sign the user's use license with the first private key.

[0086] S3023. Send the first public key to each key management platform, so that each key management platform verifies the user permission by using the first public key.

[0087] According to some optional embodiments, the key management platform can verify the user's permission to use the key, and after the key management platform receives the original key request from the server, multiple key management platforms adopt a clustering method to select a leader and multiple collaborators. The leader will initiate a confirmation request to the data requesting user who has the right to use the encrypted data. After receiving the user's confirmation, the leader will feedback the confirmation instruction to the collaborator, and the multiple key management platforms as collaborators will feedback the confirmation instruction. This method can be carried out through the following steps:

[0088] S3031. Send an original key request to N key management platforms, where the original key request includes a user permission, so that the leader of the N key management platforms obtains confirmation information of the data requesting user based on the user permission request.

[0089] S3032, receiving at least M groups of original keys sent by each key management platform, wherein the M groups of original keys are sent by each key management platform based on confirmation information. Among them, N key management platforms select a leader and multiple collaborators in a cluster manner, and the leader obtains the confirmation information and sends it to each collaborator.

[0090] S304. Receive at least M groups of original keys sent by each key management platform.

[0091] S306: Obtain M mapping relationships and encrypted data stored in the server, wherein the M mapping relationships correspond one-to-one to the M groups of original keys. When a first combination number is used in the encryption process, the first combination number stored in the server is also obtained to restore the first data encryption key using the first combination number.

[0092] S308: Use M groups of original keys and M mapping relationships to restore the first data encryption key, or use M groups of original keys, M mapping relationships and the first combination number to restore the first data encryption key.

[0093] According to some optional embodiments, in order to ensure the reliability of the restored first data encryption key, it is possible to verify whether the first data encryption key is correctly restored by means of data verification:

[0094] S3081. Obtain a first hash value of a first data encryption key. For example, the first hash value of the first data encryption key may be obtained when the first data encryption key is generated and stored in the server. When performing data verification, the stored first hash value is obtained.

[0095] S3082: After restoring the first data encryption key using the M groups of original keys and the M mapping relationships, obtain a second Hash value of the restored first data encryption key. After restoring the first data encryption key, obtain a second Hash value of the restored first data encryption key.

[0096] S3083. Verify the restored first data encryption key based on the first hash value and the second hash value. For example, the restored first data encryption key can be verified to be correct based on whether the first hash value is consistent with the second hash value. The generation of the first hash value and the second hash value can adopt common hash functions, such as MD5, SHA-1, SHA-256, etc., which are not specifically limited in the present invention.

[0097] S3084. Decrypt the encrypted data according to the verification result.

[0098] S310: Decrypt the encrypted data using the first data encryption key to obtain the original data. During the decryption process, if the restored first data encryption key is verified, the encrypted data is decrypted according to the verification result:

[0099] S3101, if the verification is successful, the encrypted data is decrypted using the restored first data encryption key. For example, if the first hash value is consistent with the second hash value, the verification is successful, which means that the first data encryption key restored using the M groups of original keys and the M mapping relationships is correct, and the encrypted data can be directly decrypted using the restored first data encryption key.

[0100] S3102, if the verification fails, select m groups of original keys and corresponding m mapping relationships from at least M groups of original keys sent by each key management platform; use the m groups of original keys and the m mapping relationships to restore the first data encryption key. Wherein, M=m, and the m groups of original keys are different from at least one of the M groups of original keys. For example, if the first hash value is inconsistent with the second hash value, the verification fails, which means that the first data encryption key restored by using the M groups of original keys and the M mapping relationships is incorrect, and the first data encryption key is restored by using the m groups of original keys and the m mapping relationships. For example, in an embodiment where N=5 and M=3, 3 groups of the 5 groups of original keys (original key A, original key B and original key C, where original key E is missing) are used to restore the first data encryption key. If the restored first data encryption key fails the verification, it is necessary to use the other 3 groups of the 5 groups of original keys (original key A, original key B and original key D, or original key A, original key C and original key D, or original key B, original key C and original key D) to restore the first data encryption key. The restored first data encryption key may also be verified using the above-mentioned hash value verification method.

[0101] An embodiment of the present invention further provides a data trust management device based on data security, which is applied to a server and includes:

[0102] The original key receiving module is used to receive N groups of original keys sent by N key management platforms.

[0103] A data encryption key generation module is used to generate a first data encryption key and N mapping relationships based on the N groups of original keys, so that the first data encryption key can be restored by using M groups of original keys and M mapping relationships, and the complexity of the first data encryption key is higher than the complexity of the original key. Wherein, the mapping relationship includes a conversion relationship between the original key and the target information in the first data encryption key; the M groups of original keys correspond to the target information in the first data encryption key and are at least partially complementary to restore the first data encryption key, and the M groups of original keys are any M groups among the N groups of original keys; M≤N.

[0104] A storage module is used to store the first data encryption key and N mapping relationships to the server.

[0105] In addition to the above methods and devices, an embodiment of the present invention may also be a computer program product, including computer program instructions, which, when executed by a processor, enable the processor to execute the steps in the data trust management method based on data security in any of the above embodiments.

[0106] The computer program product may be written in any combination of one or more programming languages ​​to write program code for performing the operations of the embodiments of the present invention, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0107] In addition, an embodiment of the present invention may also be a computer-readable storage medium having computer program instructions stored thereon, which, when executed by a processor, enables the processor to execute the steps of the data trust management method based on data security of various embodiments of the present invention.

[0108] Computer readable storage media can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can include, for example, but is not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0109] It should be understood that the processor in the embodiment of the present invention may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0110] In summary, an embodiment of the present invention relates to a data trust management method and device based on data security, the method comprising: receiving N groups of original keys sent by N key management platforms; generating a first data encryption key and N mapping relationships based on the N groups of original keys, so that the first data encryption key can be restored by using M groups of original keys and M mapping relationships, and the complexity of the first data encryption key is higher than the complexity of the original key; storing the first data encryption key and the N mapping relationships to the server. The technical solution provided by the embodiment of the present invention generates a data encryption key according to a predetermined mapping relationship from multiple groups of original keys sent by multiple key management platforms, and the data encryption key can be restored according to the mapping relationship without all the original keys, thereby solving the technical problem that the original key cannot be obtained due to failure of the key management platform and the data cannot be decrypted, thereby improving the data security and reliability in the multi-party data sharing platform scenario.

[0111] It should be understood that the discussion of any of the above embodiments is only exemplary and is not intended to imply that the scope of the present invention (including claims) is limited to these examples; under the idea of ​​the present invention, the technical features in the above embodiments or different embodiments may also be combined, the steps may be implemented in any order, and there are many other changes in different aspects of one or more embodiments of the present invention as described above, which are not provided in detail for the sake of simplicity. The above specific embodiments of the present invention are only used to illustrate or explain the principles of the present invention, and do not constitute a limitation of the present invention. Therefore, any modifications, equivalent substitutions, improvements, etc. made without departing from the spirit and scope of the present invention should be included in the scope of protection of the present invention. In addition, the claims attached to the present invention are intended to cover all changes and modifications that fall within the scope and boundaries of the attached claims, or the equivalent forms of such scope and boundaries.

Claims

1. A data trust management method based on data security, characterized in that: Applied to a server, the method comprises: Receive N groups of original keys sent by N key management platforms; Generate a first data encryption key and N mapping relationships based on the N groups of original keys, so that the first data encryption key can be restored by using M groups of original keys and M mapping relationships, and the complexity of the first data encryption key is higher than the complexity of the original key; storing the first data encryption key and N mapping relationships to the server; Among them, the mapping relationship includes a conversion relationship between the original key and the target information in the first data encryption key; the M groups of original keys correspond to the target information in the first data encryption key and are at least partially complementary to restore the first data encryption key, and the M groups of original keys are any M groups among the N groups of original keys; M≤N.

2. The method according to claim 1, characterized in that The mapping relationship is configured such that each bit in the first data encryption key exists in at least M groups of the N groups of original keys.

3. The method according to claim 1, characterized in that Generating a first data encryption key according to the N groups of original keys includes: Extracting a first portion from each of the N groups of original keys; The N first parts are partially overlapped to generate a first data encryption key, and the N first parts are overlapped by adjusting the positions of the characters in the first parts or converting the information.

4. The method according to any one of claims 1 to 3, characterized in that: In the server's trusted execution environment, Generate a first data encryption key and N mapping relationships according to the N groups of original keys; Using the first data encryption key to encrypt the original data; The first data encryption key, N mapping relationships and the encrypted data are stored in the server.

5. The method according to claim 4, characterized in that The method further comprises: Generate a first combination number, the first combination number including at least one of a local physical key of the server, a random number, and a superposition key generated according to a key algorithm; Inserting the first combination number into the first data encryption key to encrypt the original data; The first combination number is stored in the server.

6. The method according to claim 4, characterized in that The method further comprises: Sending an original key request to N key management platforms, so that each of the key management platforms sends an original key according to the original key request; Receive at least M groups of original keys sent by each key management platform; Acquire M mapping relationships and encrypted data stored in the server, wherein the M mapping relationships correspond one-to-one to the M groups of original keys; Restoring the first data encryption key using the M groups of original keys and the M mapping relationships; The encrypted data is decrypted using the first data encryption key to obtain the original data.

7. The method according to claim 5, characterized in that The method further comprises: Sending an original key request to N key management platforms, so that each of the key management platforms sends an original key according to the original key request; Receive at least M groups of original keys sent by each key management platform; Acquire M mapping relationships, encrypted data, and the first combination number stored in the server, wherein the M mapping relationships correspond one-to-one to the M groups of original keys; Restoring the first data encryption key using the M groups of original keys, the M mapping relationships and the first combination number; The encrypted data is decrypted using the first data encryption key to obtain the original data.

8. The method according to claim 6 or 7, characterized in that: The method further comprises: Obtaining a first hash value of the first data encryption key; After restoring the first data encryption key using the M groups of original keys and the M mapping relationships, obtaining a second hash value of the restored first data encryption key; verifying the restored first data encryption key according to the first hash value and the second hash value; According to the verification result, the encrypted data is decrypted.

9. The method according to claim 8, characterized in that According to the verification result, the encrypted data is decrypted, including: If the verification passes, the encrypted data is decrypted using the restored first data encryption key; If the verification fails, m groups of original keys and corresponding m mapping relationships are selected from at least M groups of original keys sent by each key management platform; Restoring the first data encryption key using the m groups of original keys and the m mapping relationships; Wherein, M=m, and the m groups of original keys are different from at least one of the M groups of original keys.

10. The method according to claim 6 or 7, characterized in that: The original key request includes a user permission, so that each key management platform verifies the user permission and then sends the original key; The user use permission indicates the data requesting user's right to use the encrypted data.

11. The method according to claim 10, characterized in that The method further comprises: Generate an asymmetric encryption key, wherein the asymmetric encryption key includes a first public key and a first private key; Signing the user use license with the first private key; The first public key is sent to each key management platform, so that each key management platform verifies the user permission by using the first public key.

12. The method according to claim 11, characterized in that The method further comprises: Sending an original key request to N key management platforms, wherein the original key request includes a user permission, so that a leader among the N key management platforms obtains confirmation information of the data requesting user based on the user permission request; Receiving at least M groups of original keys sent by each key management platform, wherein the M groups of original keys are sent by each key management platform based on the confirmation information; Among them, the N key management platforms adopt a clustering method to select a leader and multiple collaborators, and the leader obtains confirmation information and sends it to each collaborator.

13. A data trust management device based on data security, characterized in that: Applied to a server, the device comprises: The original key receiving module is used to receive N groups of original keys sent by N key management platforms; a data encryption key generation module, configured to generate a first data encryption key and N mapping relationships according to the N groups of original keys, so that the first data encryption key can be restored by using M groups of original keys and M mapping relationships, and the complexity of the first data encryption key is higher than the complexity of the original key; A storage module, used for storing the first data encryption key and N mapping relationships to the server; Among them, the mapping relationship includes a conversion relationship between the original key and the target information in the first data encryption key; the M groups of original keys correspond to the target information in the first data encryption key and are at least partially complementary to restore the first data encryption key, and the M groups of original keys are any M groups among the N groups of original keys; M≤N.

Images