Data security-based data trust management method and device

Abstract

Embodiments of the present application relate to a data security-based data trust management method and device, the method comprising: receiving N groups of original keys sent by N key management platforms; generating a first data encryption key and N mapping relationships according to the N groups of original keys, so that the first data encryption key can be restored using M groups of original keys and M mapping relationships, the complexity of the first data encryption key being higher than that of the original keys; and storing the first data encryption key and the N mapping relationships to a server. The technical solution provided by the embodiments of the present application generates a data encryption key from multiple groups of original keys sent by multiple key management platforms according to predetermined mapping relationships, and makes the data encryption key restorable without all original keys according to the mapping relationships, thereby solving the technical problem that the original keys cannot be obtained due to failure of the key management platform and the like, and data cannot be decrypted.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of data security computing technology, and in particular to a data security-based data trust management method and apparatus. Background Technology

[0002] In existing multi-party data sharing platforms, data encryption typically involves the master server (e.g., a platform, server, or database) obtaining data, retrieving the encryption key from a key management platform (KMS), encrypting the data using this key, and then storing it on the master server. When data is needed, the master server requests the encryption key from the key management platform to decrypt the encrypted data, thus obtaining and using the decrypted data. The advantage of this method is that the master server does not store the encryption key, meaning that even the master server's backend administrators cannot directly use the encryption key to decrypt the data.

[0003] The problem with the above method is that obtaining the data encryption key depends on the key management platform, which may fail due to business or other reasons. In this case, the main server cannot obtain the key used to decrypt the data, resulting in the data being unable to be decrypted. Summary of the Invention

[0004] Based on the above-mentioned situation of the prior art, the purpose of this embodiment of the invention is to provide a data trust management method and apparatus based on data security, which solves the technical problem in the prior art that the original key cannot be obtained due to reasons such as the failure of the key management platform, and thus the data cannot be decrypted.

[0005] To achieve the above objectives, according to one aspect of the present invention, a data trust management method based on data security is provided, applied to a server, the method comprising:

[0006] Receive N sets of original keys sent by N key management platforms;

[0007] A first data encryption key and N mapping relationships are generated based on the N sets of original keys, so that the first data encryption key can be restored using M sets of original keys and M mapping relationships. The complexity of the first data encryption key is higher than that of the original key.

[0008] Store the first data encryption key and N mapping relationships to the server;

[0009] The mapping relationship includes the conversion relationship between the original key and the target information in the first data encryption key; the target information in the first data encryption key corresponding to the M original keys is at least partially complementary to restore the first data encryption key, and the M original keys are any M sets among the N original keys; M≤N.

[0010] Furthermore, the mapping relationship is configured such that each bit of the first data encryption key exists in at least M of the N sets of original keys.

[0011] Furthermore, generating a first data encryption key based on the N sets of original keys includes:

[0012] Extract the first portion from each of the N sets of original keys;

[0013] The N first parts are partially overlapped to generate a first data encryption key. By adjusting the position or converting the information of the characters in the first parts, the N first parts are made to overlap.

[0014] Furthermore, in a trusted execution environment on the server,

[0015] A first data encryption key and N mapping relationships are generated based on the N sets of original keys;

[0016] The original data is encrypted using the first data encryption key;

[0017] The first data encryption key, N mapping relationships, and the encrypted data are stored in the server.

[0018] Furthermore, the method also includes:

[0019] Generate a first combination number, which includes at least one of a physical key local to the server, a random number, and a superimposed key generated according to a key algorithm;

[0020] Insert the first combination number into the first data encryption key to encrypt the original data;

[0021] The first combination number is stored in the server.

[0022] Furthermore, the method also includes:

[0023] Send raw key requests to N key management platforms so that each key management platform sends the raw key according to the raw key request;

[0024] Receive at least M sets of original keys sent by each key management platform;

[0025] Obtain the M mapping relationships and encrypted data stored on the server, wherein the M mapping relationships correspond one-to-one with the M sets of original keys;

[0026] The first data encryption key is restored using the M sets of original keys and the M mapping relationships;

[0027] The encrypted data is decrypted using the first data encryption key to obtain the original data.

[0028] Furthermore, the method also includes:

[0029] Send raw key requests to N key management platforms so that each key management platform sends the raw key according to the raw key request;

[0030] Receive at least M sets of original keys sent by each key management platform;

[0031] Obtain the M mapping relationships stored on the server, the encrypted data, and the first combination number, wherein the M mapping relationships correspond one-to-one with the M sets of original keys;

[0032] The first data encryption key is restored using the M sets of original keys, the M mapping relationships, and the first combination number.

[0033] The encrypted data is decrypted using the first data encryption key to obtain the original data.

[0034] Furthermore, the method also includes:

[0035] Obtain the first hash value of the first data encryption key;

[0036] After restoring the first data encryption key using the M sets of original keys and M mapping relationships, the second hash value of the restored first data encryption key is obtained;

[0037] The restored first data encryption key is verified based on the first hash value and the second hash value;

[0038] Based on the verification results, the encrypted data is decrypted.

[0039] Furthermore, based on the verification results, the encrypted data is decrypted, including:

[0040] If the verification passes, the encrypted data is decrypted using the restored first data encryption key;

[0041] If the verification fails, select m sets of original keys and m corresponding mapping relationships from at least M sets of original keys sent by each key management platform;

[0042] The first data encryption key is restored using the m sets of original keys and m mapping relationships;

[0043] Where M = m, and at least one of the m sets of original keys is different from the M sets of original keys.

[0044] Furthermore, the original key request includes a user license, so that each of the key management platforms verifies the user license before sending the original key;

[0045] The user license refers to the data requester's right to use the encrypted data.

[0046] Furthermore, the method also includes:

[0047] Generate an asymmetric encryption key, wherein the asymmetric encryption key includes a first public key and a first private key;

[0048] The user license is signed with the first private key;

[0049] The first public key is sent to each key management platform so that each key management platform can use the first public key to verify the user's license.

[0050] Furthermore, the method also includes:

[0051] Send raw key requests to N key management platforms, wherein the raw key requests include user licenses, so that the leaders of the N key management platforms can obtain confirmation information of the data request user based on the user license requests;

[0052] Receive at least M sets of original keys sent by each key management platform, wherein the M sets of original keys are sent by each key management platform based on the confirmation information;

[0053] In this system, the N key management platforms are clustered together to select a leader and multiple collaborators. After receiving confirmation information, the leader sends it to each collaborator.

[0054] According to another aspect of the present invention, a data security-based trusted management device is provided, applied to a server, the device comprising:

[0055] The raw key receiving module is used to receive N sets of raw keys sent by N key management platforms;

[0056] The data encryption key generation module is used to generate a first data encryption key and N mapping relationships based on the N sets of original keys, so that the first data encryption key can be restored using M sets of original keys and M mapping relationships. The complexity of the first data encryption key is higher than that of the original key.

[0057] A storage module is used to store the first data encryption key and N mapping relationships to the server;

[0058] The mapping relationship includes the conversion relationship between the original key and the target information in the first data encryption key; the target information in the first data encryption key corresponding to the M original keys is at least partially complementary to restore the first data encryption key, and the M original keys are any M sets among the N original keys; M≤N.

[0059] In summary, this invention provides a data security-based trusted management method and apparatus. The method includes: receiving N sets of original keys sent by N key management platforms; generating a first data encryption key and N mapping relationships based on the N sets of original keys, such that the first data encryption key can be recovered using M sets of original keys and M mapping relationships, wherein the complexity of the first data encryption key is higher than the complexity of the original keys; and storing the first data encryption key and the N mapping relationships in a server. The technical solution provided by this invention, by generating a data encryption key from multiple sets of original keys sent by multiple key management platforms according to predetermined mapping relationships, and enabling the data encryption key to be recovered without all the original keys, solves the technical problem of being unable to obtain the original keys due to key management platform failures, thus preventing data decryption. This improves data security and reliability in multi-party data sharing platform scenarios. Attached Figure Description

[0060] Figure 1 This is a flowchart of a data trust management method based on data security provided in an embodiment of the present invention;

[0061] Figure 2 This is a schematic block diagram illustrating how the server encrypts data when N=5 and M=3 according to the present invention.

[0062] Figure 3 This is a schematic block diagram illustrating the encryption and decryption of data by the server when N=5 and M=3 in this invention. Detailed Implementation

[0063] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to specific embodiments and the accompanying drawings. It should be understood that these descriptions are merely exemplary and not intended to limit the scope of the invention. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concept of the invention.

[0064] It should be noted that, unless otherwise defined, the technical or scientific terms used in one or more embodiments of the present invention should have the ordinary meaning understood by one of ordinary skill in the art to which this invention pertains. The terms "first," "second," and similar terms used in one or more embodiments of the present invention do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the element or object listed following the word and its equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect.

[0065] This solution can be applied to the target device (or server, central platform) used to manage encrypted data. In this solution, the key management platform generates highly complex keys. Furthermore, the key management platform provides a key transmission interface to the target device, transmitting keys generated and managed by the platform. The target device then uses keys from multiple key management platforms to manage data. Compared to solutions where the target device generates and stores keys on the key management platform, this solution generates more complex and secure keys. Additionally, this solution requires minimal modification to the key management platform and is easy to implement.

[0066] Embodiments of the present invention provide a data security-based trusted management method, which can be applied, for example, to a multi-party data sharing system, wherein the system includes at least a server and multiple key management platforms for providing the original keys. Figure 1 The flowchart shown is a data security-based trusted management method provided by an embodiment of the present invention. This method is applied to a server, such as... Figure 1 As shown, the method includes the following steps:

[0067] S202. Receive N sets of original keys sent by N key management platforms. When the server obtains the data to be encrypted and stored, it obtains N sets of original keys from the N key management platforms, where N is, for example, a natural number greater than or equal to 3.

[0068] S204. Generate a first data encryption key and N mapping relationships based on N sets of original keys, such that the first data encryption key can be restored using M sets of original keys and M mapping relationships. The complexity of the first data encryption key is higher than that of the original keys. Here, a mapping relationship refers to the conversion relationship between the original key and the target information in the first data encryption key. Generating N mapping relationships means, for each of the N sets of original keys, generating a conversion relationship between that set of original keys and the target information in the first data encryption key. The target information in the first data encryption key corresponding to the M sets of original keys is at least partially complementary to restore the first data encryption key. The aforementioned M sets of original keys are any M sets from the N sets of original keys; and M ≤ N. According to some optional embodiments, the mapping relationship can be configured such that each bit in the generated first data encryption key exists in at least M sets of the N sets of original keys.

[0069] The first data encryption key can be generated based on N sets of original keys, as follows:

[0070] S2041. Extract the first part from each of the N original keys.

[0071] S2042. Perform partial overlap processing on the N first parts to generate the first data encryption key. By adjusting the position or converting the information of the characters in the first part, the N first parts overlap.

[0072] S206. Store the first data encryption key and N mapping relationships to the server.

[0073] The technical solution provided by this invention generates a data encryption key by sending multiple sets of original keys from multiple key management platforms according to a predetermined mapping relationship. This data encryption key can be recovered without all the original keys based on the mapping relationship. Even if some of the key management platforms malfunction or cease service, only the keys from those platforms are needed to form a complete first data encryption key for data decryption. Figure 2 The diagram shows a schematic block diagram illustrating the server encrypting data when N=5 and M=3 according to the technical solution of the present invention. Figure 3 The diagram illustrates a schematic block diagram of the server decrypting data when N=5 and M=3 according to the technical solution of the present invention. Figure 2 and Figure 3As shown, the system includes a server and five key management platforms (Key Management Platform 1, Key Management Platform 2, Key Management Platform 3, Key Management Platform 4, and Key Management Platform 5). According to the method provided in this embodiment, the server receives five sets of original keys (Original Key A, Original Key B, Original Key C, Original Key D, and Original Key E) from the five key management platforms. Based on these five sets of original keys, the server generates a first data encryption key and five mapping relationships. These five mapping relationships are configured to use three of the five sets of original keys and their corresponding three mapping relationships to reconstruct the first data encryption key. For example, if each of the five sets of original keys is a 4-digit number (or a combination of 4 letters and numbers), then the five sets of original keys can be combined to form a 5-digit number as the first data encryption key. Specifically, the five sets of original keys can be divided into three digits each, and then a mapping relationship can be superimposed to ensure that there is some overlap between the keys. This guarantees that the three digits can be derived using the other four keys. For example, original key A and original key B have two overlapping digits, original key A and original key C have one overlapping digit, original key A and original key D have one overlapping digit, and original key A and original key E have two overlapping digits. After superimposing the mapping relationship on the original key AE, the resulting numbers are 123, 234, 345, 145, and 125. The merged first data encryption key is 12345. Therefore, any three of the original keys can be combined to form the first data encryption key 12345. The mapping relationship involved in this embodiment of the invention is used to ensure that each digit or letter in the synthesized first data encryption key is represented in three of the five original keys. Alternatively, the generated first data encryption key can be a direct concatenation of the five original keys. The mapping relationship can include a scheme for converting between original key A and original key E. This scheme can be encrypted and stored, and can be restored when the original keys are missing. For example, if original keys B and D are missing, original key B can be determined by using original key A combined with the first mapping relationship, and original key D can be determined by using original key C combined with the second mapping relationship. In practice, original keys A, C, and E can each be used to restore a portion of original key B or original key D, resulting in a complete original key B or original key D.

[0074] The method also includes the following steps:

[0075] S208. Encrypt the original data using the first data encryption key, and store the first data encryption key, N mapping relationships, and the encrypted data on the server.

[0076] To enhance data security, the above steps, including generating a first data encryption key and N mapping relationships based on N sets of original keys, encrypting the original data using the first data encryption key, and storing the first data encryption key, N mapping relationships, and the encrypted data on the server, are all performed within the server's Trusted Execution Environment (TEE) to improve data security.

[0077] According to certain optional embodiments, a random combination number can be added during the above encryption process to increase the complexity of the data encryption key. When encryption is performed with an added random combination number, the random combination number must also be involved in the decryption process, thus preventing the leakage of the original key in the key management platform from leading to the leakage of the first data encryption key on the server. Adding a random combination number during the encryption process can be done according to the following steps:

[0078] S2081. Generate a first combination number, which includes at least one of the server's local physical key, a random number, and a superposition key generated according to the key algorithm.

[0079] S2082. Insert the first combination number into the first data encryption key to encrypt the original data.

[0080] S2083. Store the first combination number in the server.

[0081] When encrypted data is needed, the server can decrypt the data by retrieving M sets of original keys from all the original keys. Data decryption includes the following steps:

[0082] S302. Send original key requests to N key management platforms, so that each key management platform sends an original key according to the original key request. The original key request may include a user license, so that each key management platform verifies the user license before sending the original key. The user license represents the user's right to use the encrypted data.

[0083] According to certain optional embodiments, the key management platform can verify user licenses by using private key signing and public key verification, including the following steps:

[0084] S3021. Generate an asymmetric encryption key, which includes a first public key and a first private key. Common encryption algorithms can be selected, such as the RSA algorithm, to generate the asymmetric encryption key; this invention does not specifically limit the choice of algorithm.

[0085] S3022. User licenses are signed with the first private key.

[0086] S3023. Send the first public key to each key management platform so that each key management platform can use the first public key to verify the user's license.

[0087] According to some optional embodiments, the key management platform's verification of user permissions can also involve multiple key management platforms clustering together after receiving the original key request from the server. A leader and multiple collaborators are selected, and the leader initiates a confirmation request to the user who has the right to use the encrypted data. After receiving the user's confirmation, the leader sends a confirmation instruction to the collaborators, who in turn send confirmation instructions back. This method can be implemented through the following steps:

[0088] S3031. Send an original key request to N key management platforms. The original key request includes a user license, so that the leader of the N key management platforms can obtain the confirmation information of the data request user based on the user license request.

[0089] S3032. Receive at least M sets of original keys from each key management platform. These M sets of original keys are sent by each key management platform based on confirmation information. Specifically, the N key management platforms adopt a cluster approach to select one leader and multiple collaborators. After obtaining confirmation information, the leader sends it to each collaborator.

[0090] S304. Receive at least M sets of original keys sent by each key management platform.

[0091] S306. Obtain M mapping relationships and encrypted data stored on the server. Each of the M mapping relationships corresponds one-to-one with one of the M sets of original keys. When the first combination number is used during the encryption process, also obtain the first combination number stored on the server, so as to use the first combination number to restore the encryption key of the first data.

[0092] S308. Restore the first data encryption key using M sets of original keys and M mapping relationships, or restore the first data encryption key using M sets of original keys, M mapping relationships, and the first combination of numbers.

[0093] According to certain optional embodiments, in order to ensure the reliability of the restored first data encryption key, the first data encryption key can be verified to ensure that it has been correctly restored by means of data verification:

[0094] S3081. Obtain the first hash value of the first data encryption key. For example, the first hash value of the first data encryption key can be obtained when the first data encryption key is generated and stored in the server. During data verification, the stored first hash value is obtained.

[0095] S3082. After restoring the first data encryption key using M sets of original keys and M mapping relationships, obtain the second hash value of the restored first data encryption key. (This process is repeated twice in the original text.)

[0096] S3083. Verify the restored first data encryption key based on the first hash value and the second hash value. For example, the correctness of the restored first data encryption key can be verified by whether the first hash value and the second hash value are consistent. The first hash value and the second hash value can be generated using common hash functions, such as MD5, SHA-1, SHA-256, etc., and this invention does not impose specific limitations.

[0097] S3084. Based on the verification results, decrypt the encrypted data.

[0098] S310. Decrypt the encrypted data using the first data encryption key to obtain the original data. During the decryption process, if the restored first data encryption key is verified, decrypt the encrypted data based on the verification result.

[0099] S3101. If the verification passes, the restored first data encryption key is used to decrypt the encrypted data. For example, if the first hash value and the second hash value are the same, the verification passes. This indicates that the first data encryption key restored using the M sets of original keys and M mapping relationships is correct, and the restored first data encryption key can be directly used to decrypt the encrypted data.

[0100] S3102. If the verification fails, select m sets of original keys and m corresponding mapping relationships from at least M sets of original keys sent by each key management platform; use the m sets of original keys and m mapping relationships to restore the first data encryption key. Where M = m, and at least one set of the m sets of original keys is different from the M sets of original keys. For example, if the first hash value and the second hash value are inconsistent, the verification fails. This indicates that the first data encryption key restored using the M sets of original keys and M mapping relationships is incorrect, and the first data encryption key needs to be restored again using the m sets of original keys and m mapping relationships. For example, in an embodiment where N = 5 and M = 3, three sets of the five sets of original keys (original key A, original key B, and original key C, where original key E is missing) are used to restore the first data encryption key. If the restored first data encryption key fails verification, the other three sets of the five sets of original keys (original key A, original key B, and original key D, or original key A, original key C, and original key D, or original key B, original key C, and original key D) need to be used to restore the first data encryption key again. The restored first data encryption key can also be verified using the hash value verification method described above.

[0101] An embodiment of the present invention also provides a data trust management device based on data security, applied to a server, the device comprising:

[0102] The raw key receiving module is used to receive N sets of raw keys sent by N key management platforms.

[0103] A data encryption key generation module is used to generate a first data encryption key and N mapping relationships based on the N sets of original keys, such that the first data encryption key can be restored using M sets of original keys and M mapping relationships. The complexity of the first data encryption key is higher than that of the original keys. The mapping relationships include the conversion relationships between the original keys and the target information in the first data encryption key; the M sets of original keys correspond to at least partially complementary target information in the first data encryption key to restore the first data encryption key, and the M sets of original keys are any M sets from the N sets of original keys; M ≤ N.

[0104] A storage module is used to store the first data encryption key and N mapping relationships to the server.

[0105] In addition to the methods and apparatus described above, embodiments of the present invention may also be computer program products, including computer program instructions, which, when executed by a processor, cause the processor to perform the steps in the data security-based trusted management method as described in any of the above embodiments.

[0106] Computer program products can be written in any combination of one or more programming languages ​​to perform the operations of the embodiments of the present invention. The programming languages ​​include object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0107] Furthermore, embodiments of the present invention may also be computer-readable storage media storing computer program instructions thereon, which, when executed by a processor, cause the processor to perform the steps in the data security-based trusted management method of the various embodiments of the present invention.

[0108] Computer-readable storage media may take the form of any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may, for example, include, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatuses, or devices, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: electrical connections having one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0109] It should be understood that the processor in the embodiments of the present invention can be a Central Processing Unit (CPU), but it can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0110] In summary, the embodiments of the present invention relate to a data security-based trusted management method and apparatus. The method includes: receiving N sets of original keys sent by N key management platforms; generating a first data encryption key and N mapping relationships based on the N sets of original keys, such that the first data encryption key can be restored using M sets of original keys and M mapping relationships, wherein the complexity of the first data encryption key is higher than the complexity of the original keys; and storing the first data encryption key and the N mapping relationships in the server. The technical solution provided by the embodiments of the present invention generates a data encryption key according to a predetermined mapping relationship from multiple sets of original keys sent by multiple key management platforms, and enables the data encryption key to be restored without all the original keys, thereby solving the technical problem that the original keys cannot be obtained due to the failure of key management platforms, thus preventing data decryption. This improves the data security and reliability in multi-party data sharing platform scenarios.

[0111] It should be understood that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of the invention (including the claims) is limited to these examples. Within the framework of this invention, technical features of the above embodiments or different embodiments can also be combined, steps can be implemented in any order, and many other variations exist regarding different aspects of one or more embodiments of the invention as described above, which are not provided in the details for the sake of brevity. The specific embodiments described above are merely illustrative or explanatory of the principles of the invention and do not constitute a limitation thereof. Therefore, any modifications, equivalent substitutions, improvements, etc., made without departing from the spirit and scope of the invention should be included within the protection scope of the invention. Furthermore, the appended claims are intended to cover all variations and modifications falling within the scope and boundaries of the appended claims, or equivalent forms of such scope and boundaries.

Claims

1. A data trust management method based on data security, characterized in that, Applied to a server, the method comprises: receiving N groups of original keys sent by N key management platforms; generating a first data encryption key and N mapping relationships according to the N groups of original keys, so that M groups of original keys and M mapping relationships can restore the first data encryption key, and the complexity of the first data encryption key is higher than that of the original key; wherein generating the first data encryption key according to the N groups of original keys comprises: intercepting a first part from each of the N groups of original keys; performing partial overlap processing on the N first parts to generate the first data encryption key, so that the N first parts overlap by adjusting the position of the characters in the first part or converting the information; storing the first data encryption key and the N mapping relationships to the server; wherein the mapping relationship comprises the conversion relationship between the original key and the target information in the first data encryption key; the M groups of original keys at least partially complement the target information in the first data encryption key to restore the first data encryption key, and the M groups of original keys are any M groups of the N groups of original keys; M≤N.

2. The method of claim 1, wherein, The mapping relationship is configured so that each bit in the first data encryption key exists in at least M groups of the N groups of original keys.

3. The method according to claim 1 or 2, characterized in that, In a trusted execution environment of a server, generating a first data encryption key and N mapping relationships according to the N groups of original keys; encrypting the original data using the first data encryption key; storing the first data encryption key, N mapping relationships and encrypted data to the server.

4. The method of claim 3, wherein, The method further comprises: generating a first combination number, the first combination number comprising at least one of a physical key local to the server, a random number and a superimposed key generated according to a key algorithm; inserting the first combination number into the first data encryption key to encrypt the original data; storing the first combination number to the server.

5. The method of claim 3, wherein, The method further comprises: sending an original key request to N key management platforms, so that each key management platform sends an original key according to the original key request; receiving at least M groups of original keys sent by each key management platform; obtaining M mapping relationships and encrypted data stored in the server, the M mapping relationships corresponding one-to-one to the M groups of original keys; restoring the first data encryption key using the M groups of original keys and M mapping relationships; decrypting the encrypted data using the first data encryption key to obtain the original data.

6. The method of claim 4, wherein, The method further comprises: sending an original key request to N key management platforms, so that each key management platform sends an original key according to the original key request; receiving at least M groups of original keys sent by each key management platform; obtaining M mapping relationships, encrypted data and the first combination number stored in the server, the M mapping relationships corresponding one-to-one to the M groups of original keys; restoring the first data encryption key using the M groups of original keys, M mapping relationships and the first combination number; Decrypt the encrypted data by using the first data encryption key to obtain original data.

7. The method according to claim 5 or 6, characterized in that, The method further comprises: obtaining a first hash value of the first data encryption key; restoring the first data encryption key by using the M groups of original keys and the M mapping relationships, and obtaining a second hash value of the restored first data encryption key; verifying the restored first data encryption key according to the first hash value and the second hash value; decrypting the encrypted data according to the verification result.

8. The method of claim 7, wherein, Decrypting the encrypted data according to the verification result comprises: if the verification is passed, decrypting the encrypted data by using the restored first data encryption key; if the verification is not passed, selecting m groups of original keys and corresponding m mapping relationships from the at least M groups of original keys sent by the key management platforms; restoring the first data encryption key by using the m groups of original keys and the m mapping relationships; wherein M = m, and the m groups of original keys are different from at least one group of the M groups of original keys.

9. The method according to claim 5 or 6, characterized in that, The original key request comprises a user usage permission, so that the key management platforms verify the user usage permission and send the original keys; wherein the user usage permission represents the usage right of the data request user to the encrypted data.

10. The method of claim 9, wherein, The method further comprises: generating an asymmetric encryption key, the asymmetric encryption key comprising a first public key and a first private key; signing the user usage permission by using the first private key; sending the first public key to the key management platforms, so that the key management platforms verify the user permission by using the first public key.

11. The method of claim 10, wherein, The method further comprises: sending an original key request to N key management platforms, the original key request comprising a user usage permission, so that a leader in the N key management platforms obtains confirmation information of the data request user based on the user permission request; receiving at least M groups of original keys sent by the key management platforms, the M groups of original keys being sent by the key management platforms based on the confirmation information; wherein the N key management platforms select a leader and multiple collaborators in a cluster mode, and the leader sends the confirmation information to the collaborators after obtaining the confirmation information.

12. A data trust management apparatus based on data security, characterized by, The device is applied to a server and comprises: an original key receiving module configured to receive N groups of original keys sent by N key management platforms; a data encryption key generating module configured to generate a first data encryption key and N mapping relationships according to the N groups of original keys, so that the first data encryption key can be restored by using M groups of original keys and M mapping relationships, and the complexity of the first data encryption key is higher than that of the original keys; wherein generating the first data encryption key according to the N groups of original keys comprises: intercepting a first part from each of the N groups of original keys; and performing partial overlap processing on the N first parts to generate the first data encryption key, so that the N first parts overlap by adjusting the positions of characters or converting information of the first parts; a storage module, configured to store the first data encryption key and N mapping relationships to the server; wherein the mapping relationship comprises a conversion relationship between an original key and target information in the first data encryption key; M groups of original keys corresponding to the target information in the first data encryption key are at least partially complementary to restore the first data encryption key, and the M groups of original keys are any M groups of the N groups of original keys; M≤N.

Images