Data encryption method and device, equipment and storage medium

Abstract

The invention relates to the technical field of data encryption, and provides a data encryption method, device and equipment and a storage medium, and the method comprises the steps: obtaining the feature information of to-be-encrypted data, and determining the security risk level of the to-be-encrypted data based on the feature information, and determining an encryption strategy corresponding to the to-be-encrypted data based on the security risk level and the feature information, and encrypting the to-be-encrypted data according to the encryption strategy. According to the method and the device, the security risk level corresponding to the to-be-encrypted data can be obtained according to the feature information of the to-be-encrypted data, and the encryption strategy is selected based on the security risk level; a customized encryption scheme can be provided according to different data feature information of different to-be-encrypted data.

Description

Technical Field

[0001] The present application relates to the field of data encryption technology, and in particular to a data encryption method, device, equipment and storage medium. Background Art

[0002] Driven by the wave of digital information technology, the speed of data generation, the wide range of data transmission, and the large amount of data storage have all reached unprecedented levels. However, data security issues are constantly threatening personal privacy and corporate secrets.

[0003] Currently, fixed encryption strategies are generally used to encrypt data to be encrypted, which is not enough to meet the complex and changing protection requirements of encrypted data. This single encryption mode lacks the necessary flexibility. It cannot perform customized encryption processing based on the characteristic information of different data, such as sensitivity, volume and purpose, resulting in the problem of being unable to provide customized encryption solutions based on different data characteristic information during the data encryption process.

[0004] The above contents are only used to assist in understanding the technical solution of the present application and do not constitute an admission that the above contents are prior art. Summary of the invention

[0005] The main purpose of this application is to provide a data encryption method, device, equipment and storage medium, aiming to solve the problem that the existing technology cannot provide customized encryption solutions according to different data feature information.

[0006] To achieve the above purpose, the present application proposes a data encryption method, which includes:

[0007] Acquire characteristic information of the data to be encrypted, and determine the security risk level of the data to be encrypted based on the characteristic information;

[0008] Determining an encryption strategy corresponding to the data to be encrypted based on the security risk level and the characteristic information;

[0009] The data to be encrypted is encrypted according to the encryption policy.

[0010] In one embodiment, the step of determining the security risk level of the data to be encrypted based on the characteristic information includes:

[0011] Determine the grade score of the data to be encrypted in each judgment dimension based on a preset dimension standard;

[0012] The security risk level of the data to be encrypted is determined according to each of the level scores.

[0013] In one embodiment, the step of determining the encryption policy corresponding to the data to be encrypted based on the security risk level and the characteristic information includes:

[0014] Performing risk assessment on the characteristic information based on the security risk level;

[0015] According to the risk assessment result, the encryption policy corresponding to the data to be encrypted is matched from a preset encryption policy library.

[0016] In one embodiment, the step of matching the encryption policy corresponding to the data to be encrypted from a preset encryption policy library according to the risk assessment result includes:

[0017] Determining the encryption type and encryption requirements of the data to be encrypted according to the risk assessment result;

[0018] A corresponding encryption policy is matched from a preset encryption policy library based on the encryption type and the encryption requirement.

[0019] In one embodiment, the step of matching a corresponding encryption policy from a preset encryption policy library based on the encryption type and the encryption requirement includes:

[0020] Matching a corresponding encryption algorithm and corresponding algorithm parameters from a preset encryption policy library based on the encryption type and the encryption requirement;

[0021] The corresponding encryption algorithm and the corresponding algorithm parameters are used as the encryption strategy corresponding to the data to be encrypted.

[0022] In one embodiment, after the step of encrypting the data to be encrypted according to the encryption policy, the method further includes:

[0023] Conduct security assessment on encrypted files;

[0024] The encryption policy is adjusted based on the security assessment result.

[0025] In one embodiment, after the step of encrypting the data to be encrypted according to the encryption policy, the method further includes:

[0026] Monitor the current application environment;

[0027] When an abnormality exists in the current application environment, a corresponding defense measure is determined according to the abnormality type, and defense is performed according to the defense measure.

[0028] In addition, to achieve the above purpose, the present application also proposes a data encryption device, characterized in that the device includes:

[0029] An intelligent analysis and monitoring module, used to obtain characteristic information of the data to be encrypted, and determine the security risk level of the data to be encrypted based on the characteristic information;

[0030] An intelligent encryption decision module, used to determine an encryption strategy corresponding to the data to be encrypted based on the security risk level and the characteristic information;

[0031] The dynamic encryption execution module is used to encrypt the data to be encrypted according to the encryption strategy.

[0032] In addition, to achieve the above-mentioned purpose, the present application also proposes a data encryption device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the data encryption method described above.

[0033] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the data encryption method described above are implemented.

[0034] The present application proposes a data encryption method, device, equipment and storage medium, characterized in that the method includes: obtaining characteristic information of the data to be encrypted, and determining the security risk level of the data to be encrypted based on the characteristic information, and then determining the encryption strategy corresponding to the data to be encrypted based on the security risk level and the characteristic information, and encrypting the data to be encrypted according to the encryption strategy. Since the present application can obtain the security risk level corresponding to the data to be encrypted according to the characteristic information of the data to be encrypted and select the encryption strategy based on the security risk level, compared with the existing fixed encryption strategy for encrypting the data to be encrypted, a customized encryption scheme can be provided according to different data characteristic information of different data to be encrypted. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0036] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0037] Figure 1 A flowchart of a first embodiment of a data encryption method proposed in an embodiment of the present application;

[0038] Figure 2 A flowchart of a second embodiment of the data encryption method proposed in the embodiment of the present application;

[0039] Figure 3 A diagram of a data encryption device provided in an embodiment of the present application;

[0040] Figure 4 It is a structural diagram of a data encryption device suitable for implementing an embodiment of the present application.

[0041] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0042] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0043] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0044] It should be noted that all directional indications in the embodiments of the present application (such as up, down, left, right, front, back, etc.) are only used to explain the relative position relationship, movement status, etc. between the components under a certain specific posture (as shown in the accompanying drawings). If the specific posture changes, the directional indication will also change accordingly.

[0045] It is understandable that data encryption technology is a core technology in the field of information security, and its background stems from the widespread application of information transmission and storage in the digital age. With the rapid development of the Internet, cloud computing and big data technology, the amount of data has exploded, and the value of information has become increasingly prominent. At the same time, security incidents such as data leaks and cyber attacks have occurred frequently, and personal information and corporate secrets are facing serious threats. In order to protect the security of data during transmission and storage and prevent unauthorized access and tampering, data encryption technology came into being. It converts raw data into ciphertext to ensure that only users with the correct key can decrypt and access the original information, thereby providing solid protection for data security in a complex and changing network environment.

[0046] Existing encryption practices usually adopt a fixed encryption strategy that implements a unified encryption process for the data to be encrypted. Regardless of the type of data, its importance, or the specific application scenario in which it is located, it is encrypted according to the preset encryption algorithm and parameters. This approach simplifies the encryption process to a certain extent, making data encryption operations more convenient and standardized. However, this also means that all data to be encrypted is treated equally without considering its uniqueness. Although a fixed encryption strategy can meet basic encryption needs, it lacks flexibility and cannot design personalized encryption schemes based on the characteristics of different data.

[0047] Therefore, in order to solve the problem that the prior art cannot provide customized encryption schemes according to different data feature information, this embodiment proposes a data encryption method, device, equipment and storage medium, the method comprising: obtaining feature information of the data to be encrypted, and determining the security risk level of the data to be encrypted based on the feature information, and then determining the encryption strategy corresponding to the data to be encrypted based on the security risk level and the feature information, and encrypting the data to be encrypted according to the encryption strategy. Since the present embodiment can obtain the security risk level corresponding to the data to be encrypted according to the feature information of the data to be encrypted and select the encryption strategy based on the security risk level, compared with the existing fixed encryption strategy to encrypt the data to be encrypted, a customized encryption scheme can be provided according to different data feature information of different data to be encrypted.

[0048] For ease of understanding, the following combination Figures 1 to 4 The data encryption method provided in the embodiment of the present application and the data encryption method, device, equipment and storage medium provided in the following embodiments are specifically introduced.

[0049] The present application embodiment provides a data encryption method, referring to Figure 1 , Figure 1 This is a flow chart of the first embodiment of the data encryption method proposed in the embodiments of the present application.

[0050] like Figure 1 As shown, the method includes:

[0051] Step S10: Acquire characteristic information of the data to be encrypted, and determine the security risk level of the data to be encrypted based on the characteristic information.

[0052] It should be noted that the execution subject of this embodiment can be a computing service device with data encryption, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device capable of realizing the above functions, etc. The following takes a data encryption device (hereinafter referred to as the device) as an example to illustrate this embodiment and the following embodiments.

[0053] It should be noted that the above-mentioned data to be encrypted can be data that needs to be encrypted selected by the user, and the above-mentioned characteristic information can at least include: data type (such as text, audio, image, graphic, video, etc.), data size, data sensitivity level (such as confidential, sensitive, internal, etc.), usage scenario (such as cloud storage, network communication, local storage, etc.) and data transmission environment (such as network security, stability and potential security threats, etc.). The above-mentioned security risk level can be a level determined by the characteristic information of the above-mentioned data to be encrypted for subsequent selection of encryption strategy. It can be a simple classification (such as low risk, medium risk, high risk) or a digital classification (such as a level of 0-100). This embodiment uses digital classification for illustration, but does not specifically limit this embodiment.

[0054] In a specific implementation, when the above device receives the data to be encrypted uploaded by the user, it first obtains the characteristic information of the data to be encrypted, including but not limited to the data type, data size, data sensitivity level, usage scenario and data transmission environment. Based on the judgment results of the above characteristic information under different judgment conditions, the security risk level score of the data to be encrypted is determined.

[0055] Furthermore, in order to accurately obtain the security risk level of the data to be encrypted so as to encrypt the data to be encrypted more accurately, the step of determining the security risk level of the data to be encrypted based on the characteristic information includes:

[0056] Step S101: Determine the grade score of the to-be-encrypted data in each judgment dimension based on a preset dimension standard.

[0057] It should be noted that the preset dimension standards can be the standards preset by the user in each judgment dimension before encryption, which are used to determine the grade scores of the characteristic information of the data to be encrypted in each judgment dimension, and the judgment dimensions can be the characteristic dimensions corresponding to all the characteristic information of the data to be encrypted (such as data type, data size, data sensitivity level, usage scenario, and data transmission environment, etc.). In a specific implementation, after obtaining the characteristic information of the data to be encrypted, the device compares the characteristic information with the standards preset by the user in each judgment dimension to determine the grade scores of the data to be encrypted in each judgment dimension.

[0058] In addition, it should be noted that the above-mentioned preset dimension standard can be a set composed of multiple judgment dimensions. For ease of understanding, the following example is given but no specific explanation is given for this embodiment. When the module detects that there is data to be encrypted, it reads the size of the data file and divides it into categories such as extremely small, small, medium, large, extra large, and huge. Since the data size will affect the encryption rate, its size is matched to the corresponding encryption level table, such as the extremely small level is 100 points and the huge level is 2 points;

[0059] According to the file data feature information, data can be divided into text, audio, video, picture, graphic, audio and video, etc. In terms of encryption complexity, text encryption is relatively easy, so the level is set at 2, and high-fidelity ultra-high-definition audio and video level is 100. For details, please refer to the following example standards.

[0060] Text: Text data is usually one of the easiest data types to encrypt and decrypt, so the encryption level is set to 2; Image: Image data contains a large amount of pixel information, and the encryption of this information can make the image unrecognizable. If the encryption algorithm is not strong enough or the key is leaked, the image data may also be restored. The encryption of image data is usually slightly stronger than that of text data, so the encryption level is set to 10; Image and text: Image and text data is a combination of text and images. Its encryption depends on the encryption strength of the text and image and the combination method between them. The encryption level is set to 20 here; Audio: Audio data contains continuous sound wave information, which can be transformed by complex algorithms during the encryption process, making decryption more difficult. In addition, the encryption of audio data can also use the statistical characteristics and time correlation of audio signals to enhance the encryption effect. The encryption level is set to 40 here; Video: The encryption of video data needs to consider the encryption of video frames and video streams at the same time. Some advanced video encryption algorithms can be optimized for the special structure of video data to improve encryption effect and efficiency. Here, the encryption level is set to 60; Audio and video (or multimedia data): contains richer information (such as sound, image, time synchronization, etc.), which can be interrelated and enhanced during the encryption process, thereby improving the complexity and security of encryption. Here, the encryption level is set to 80.

[0061] According to the sensitivity of files or data, they can be divided into: confidential type (such as national military confidential documents, core information, military secrets and other documents). This type of data has very strict security requirements and matches encryption level 100; core type (such as developed software codes, patented technologies and other core assets of the enterprise). This type of data is related to the survival of the enterprise and requires the highest level of protection, matching encryption level 90; sensitive type (such as customer information, financial statements, technical secrets and other materials involving personal privacy or business secrets, etc.). The encryption of this type of data can only be accessed and used by authorized personnel, matching encryption level 70; internal type (such as employee information, internal documents and other shared materials within the enterprise or between partners, etc.). Although the requirements for this type of data are not too strict, it still requires certain protection measures and matches encryption level 40; public type, matching encryption level 0.

[0062] At the same time, the encrypted data needs to be saved, so the security of the storage device (not limited to the computer or electronic device itself, storage media such as USB flash drives and hard drives) and the risk of being attacked need to be considered. If data transmission is involved, the security of the transmission environment and the risk of data being intercepted need to be monitored. The worse the security performance, the higher the data encryption level should be. (Such as network security, stability and potential security threats, etc.). In this example, the encryption level is matched after evaluation based on the following indicators.

[0063] Physical environment safety assessment indicators may include those related to storage equipment site selection, computer room fire protection facilities, power supply system, electrostatic protection, lightning protection measures, grounding, temperature and humidity control, etc. They are used to assess the physical environment safety of the data center and prevent safety risk factors caused by physical environment problems.

[0064] Business security evaluation indicators may include indicators related to the protection of stored data, the management of user rights, and whether authorized user access rights are effectively ensured through the implementation of mechanisms such as discretionary access control (DAC) and mandatory access control (MAC); data security evaluation indicators focus on data backup and recovery strategies in the event of hardware anomalies, as well as audit tracking of data access and modification to prevent data leakage and unauthorized access;

[0065] Communication security assessment indicators can be the following factors involving data: integrity, identity authentication, and prevention of tampering; availability, preventing service interruption, ensuring that only authorized entities can obtain services, and attackers cannot occupy all resources and hinder the work of the authorizer; controllability, which refers to the ability to control the dissemination and content of information, and control the scope and content of information dissemination through authorization mechanisms. When necessary, the key can be restored to achieve controllability of network resources and information; auditability, providing a basis and means for investigating security issues that arise; non-repudiation (also known as non-repudiation), in the process of information interaction in network information systems, ensures the true identity of the participants, prevents the sender from falsely denying the information sent or the receiver from denying the information received, and is used to ensure that data is not intercepted or tampered with during transmission.

[0066] Business continuity evaluation indicators may be indicators that emphasize whether the system can recover quickly in the event of a failure and ensure data continuity and availability.

[0067] Security management organization assessment indicators may include those related to the formulation of security policies, security training and awareness raising, and the response and handling of security incidents, which are used to ensure the security management and response capabilities within the organization.

[0068] Step S102: Determine the security risk level of the data to be encrypted according to each of the level scores.

[0069] In a specific implementation, after the above-mentioned device judges the characteristic information of the above-mentioned data to be encrypted by the standards of each judgment dimension, it uses algorithm technology to model the grade scores corresponding to the data characteristics according to the grade scores on each dimension obtained by judgment, and calculates the security risk level of the above-mentioned data to be encrypted.

[0070] In an exemplary embodiment, the algorithm may be a weighted average method, which obtains the weight value of each dimension, and obtains the security risk level of the data to be encrypted by multiplying the grade value corresponding to each dimension by the weight and then summing the results.

[0071] In another example, the above algorithm can also be a fuzzy comprehensive analysis method: a fuzzy relationship matrix is ​​established based on the above judgment dimension grade score set and the evaluation dimension set, and the fuzzy relationship matrix is ​​synthesized with the weight set through fuzzy transformation to obtain a fuzzy comprehensive security risk level. This method is conducive to positive feedback matching of the best encryption algorithm.

[0072] In another example, the above algorithm can also be a factor analysis method: analyze the correlation factor matrix of the encrypted data, find out the common factors that affect the comprehensive encryption level score, and calculate the contribution rate of each factor to the encryption score. Finally, calculate the security risk level based on the factor score and contribution rate.

[0073] Step S20: Determine an encryption strategy corresponding to the data to be encrypted based on the security risk level and the characteristic information.

[0074] It should be noted that the above encryption strategy can be composed of an encryption algorithm and algorithm parameters, and can be a strategy customized for the above data to be encrypted. It should be noted that the above encryption algorithm and algorithm parameters can be several existing encryption algorithms (such as an asymmetric encryption algorithm, a symmetric encryption algorithm), or can be a combination of algorithms and parameters added by users in subsequent use. In a specific implementation, after obtaining the above security risk level, the above device selects an encryption algorithm and corresponding algorithm parameters suitable for the data to be encrypted based on the above security risk level and the above characteristic information, and uses the encryption algorithm and the algorithm parameters as the encryption strategy for subsequent use of the strategy to encrypt the above data to be encrypted.

[0075] For example, based on the analyzed security risk level, machine learning, reinforcement learning, deep learning, expert systems, and other advanced technologies are used to conduct a comprehensive evaluation of factors such as data type and characteristics, transmission environment, and security threat level. The encryption level value is evaluated in combination with algorithm performance, compatibility, and ease of use, encryption efficiency, stability, and security. The above-mentioned equipment uses multi-objective optimization algorithms (such as genetic algorithms, particle swarm algorithms, convolutional neural network algorithms, edge computing, web crawler algorithms, etc.) for flexible intelligent matching to ensure that encryption strategies with higher encryption efficiency are matched as much as possible while meeting the requirements of security, stability, and reliability.

[0076] In addition, it should be noted that the above devices also support the combined use of multiple encryption strategies: multiple encryption strategies can be applied to the same data at the same time to form a multi-level encryption protection network. This combination of multiple encryption strategies not only enhances the confidentiality of data, but also improves the integrity and availability of data.

[0077] Step S30: Encrypt the data to be encrypted according to the encryption strategy.

[0078] In a specific implementation, after the above-mentioned device selects the encryption strategy, it will automatically call the corresponding encryption strategy to encrypt the data. The above-mentioned device will monitor the encryption process in real time, track the progress and logs, and handle and display exceptions to ensure the timeliness, stability and reliability of the encryption operation. Once the encryption process is started, the above-mentioned device will enter a highly centralized working state. It will carefully monitor every step of the execution of the encryption strategy to ensure that there are no omissions. At the same time, the above-mentioned device can also include an encryption progress display module, so that the user can clearly understand the completion level of the current encryption task.

[0079] In addition, it is important to understand that during the encryption process, if any exception or problem is encountered, the above-mentioned device will immediately start the built-in exception handling mechanism, which will not only automatically record and display the exception information, but also try to self-repair or give corresponding solution suggestions according to the preset strategy. Such a design greatly improves the stability and reliability of encryption operations.

[0080] In addition, in order to ensure the security of the encryption process, the above-mentioned equipment is also equipped with a detailed log tracking function. The above-mentioned log records every step of the encryption operation in detail, including the selection of the algorithm, the configuration of the parameters, the transmission of the data and the encryption results, etc., which not only provides strong support for the subsequent audit and traceability, but also helps users better understand the encryption process and enhance their trust in the encryption results.

[0081] Furthermore, in order to ensure that the above-mentioned device is in a safe environment to complete the secure encryption of the data to be encrypted, after the step of encrypting the data to be encrypted according to the encryption strategy, it also includes:

[0082] Monitor the current application environment;

[0083] When an abnormality exists in the current application environment, a corresponding defense measure is determined according to the abnormality type, and defense is performed according to the defense measure.

[0084] It should be understood that the above-mentioned current application environment can be the application environment inside the above-mentioned device before the above-mentioned device performs data encryption, and the above-mentioned defense measures can be defense measures pre-set by users to solve the above-mentioned abnormalities (such as the latest security patches to fix known problems).

[0085] In specific implementations, the above-mentioned devices will monitor in real time or regularly whether there are security loopholes and hidden dangers in the application environment where the devices are located, identify and analyze potential threat intelligence, and check whether there are any abnormalities according to firewall rules.

[0086] In addition, the above-mentioned devices will also pay attention to whether the latest security patches to fix known problems are installed to ensure that the system will not be attacked due to these known problems. At the same time, they will also monitor external attack behaviors, detect and alarm in time, so as to take corresponding defensive measures.

[0087] In addition, it should be noted that the above-mentioned devices will collect user feedback information at any time to understand the user's satisfaction with the system, and then dynamically update and adjust the security policy. The above-mentioned devices will record all security-related activities, including changes and adjustments, so that users can trace back and analyze these activities. Users can also adjust the types and parameter configurations in the encryption algorithm library according to actual conditions to improve the flexibility and adaptability of the system, so that the system can better cope with various complex and changing security challenges.

[0088] This embodiment proposes a data encryption method, device, equipment and storage medium, characterized in that the method includes: obtaining characteristic information of the data to be encrypted, and determining the security risk level of the data to be encrypted based on the characteristic information, and then determining the encryption strategy corresponding to the data to be encrypted based on the security risk level and the characteristic information, and encrypting the data to be encrypted according to the encryption strategy. Since the present application can obtain the security risk level corresponding to the data to be encrypted according to the characteristic information of the data to be encrypted and select the encryption strategy based on the security risk level, compared with the existing fixed encryption strategy for encrypting the data to be encrypted, a customized encryption scheme can be provided according to different data characteristic information of different data to be encrypted.

[0089] Based on the first embodiment, in the second embodiment, the same or similar contents as those in the above-mentioned embodiment 1 can be referred to the above introduction, and will not be described in detail later. Figure 2 , Figure 2This is a flow chart of a second embodiment of the data encryption method proposed in an embodiment of the present application. In order to further select an accurate encryption strategy, the step of determining the encryption strategy corresponding to the data to be encrypted based on the security risk level and the feature information includes:

[0090] Step S201: performing risk assessment on the feature information based on the security risk level;

[0091] Step S202: matching the encryption policy corresponding to the data to be encrypted from a preset encryption policy library according to the risk assessment result.

[0092] It should be noted that the above risk assessment may be an assessment of factors such as the data type and characteristics of the above data to be encrypted, the transmission environment, and the degree of security threats, etc., to determine the security level and encryption efficiency of the data to be encrypted. The above preset encryption strategy library may be an algorithm library pre-set by the user containing at least two encryption algorithms and corresponding parameters of the algorithms, for selecting a suitable encryption strategy according to the above assessment results.

[0093] In the specific implementation, the above-mentioned equipment uses machine learning, reinforcement learning, deep learning, expert systems and other advanced technologies based on the analyzed security risk level to conduct risk assessment on factors such as data type and characteristics, transmission environment, and security threat level. The above-mentioned equipment uses multi-objective optimization algorithms (such as genetic algorithms, particle swarm algorithms, convolutional neural network algorithms, edge computing, web crawler algorithms, etc.) to perform flexible intelligent matching based on risk assessment results to ensure that encryption strategies with higher encryption efficiency are searched and matched in the encryption strategy library as much as possible while meeting the requirements of security, stability and reliability.

[0094] In order to further select a more efficient encryption strategy from the encryption strategy library, the step of matching the encryption strategy corresponding to the data to be encrypted from the preset encryption strategy library according to the risk assessment result includes:

[0095] Step S2021: Determine the encryption type and encryption requirements of the data to be encrypted according to the risk assessment result.

[0096] It should be noted that the above-mentioned encryption type can be a classification of encryption algorithms that can be selected for the above-mentioned data to be encrypted (such as symmetric encryption algorithm, asymmetric encryption algorithm, hash algorithm, etc.), and the above-mentioned encryption requirements can be the type of encryption that can be performed on the data to be encrypted based on the application scenario or purpose of the data to be encrypted (such as when encrypting data suitable for public or internal data, Message Digest Algorithm 5 (MD5) can be used to convert information of any length into a 128-bit hash value to encrypt the data to be encrypted).

[0097] Step S2022: Match a corresponding encryption policy from a preset encryption policy library based on the encryption type and the encryption requirement.

[0098] In a specific implementation, after performing a risk assessment on the data to be encrypted, the device obtains a classification of encryption strategies that can be selected for the data to be encrypted and an application scenario or purpose of the data to be encrypted based on the result of the risk assessment, and matches a suitable encryption strategy from an algorithm library preset by the user containing at least two encryption strategies based on the classification and application scenario.

[0099] Furthermore, the step of matching a corresponding encryption policy from a preset encryption policy library based on the encryption type and the encryption requirement includes:

[0100] Matching a corresponding encryption algorithm and corresponding algorithm parameters from a preset encryption policy library based on the encryption type and the encryption requirement;

[0101] The corresponding encryption algorithm and the corresponding algorithm parameters are used as the encryption strategy corresponding to the data to be encrypted.

[0102] It should be understood that there are at least two encryption algorithms and corresponding encryption parameters in the above-mentioned preset encryption policy library. Exemplarily, the encryption policy library covers a variety of encryption algorithms and parameter combinations.

[0103] like:

[0104] Symmetric encryption algorithm: fast encryption and decryption speed: suitable for encryption and decryption of large amounts of data; complex key management: it is necessary to ensure the secure transmission and storage of keys to prevent them from being obtained by unauthorized parties. Advanced Encryption Standard (AES), a symmetric encryption algorithm, has the characteristics of high strength, high speed and easy implementation. It supports multiple key lengths (128 bits, 192 bits, 256 bits), application: suitable for encrypting large amounts of data, such as file encryption, network communication security, database encryption, etc.; Data Encryption Standard (DES), uses 56-bit keys. The security is not as good as AES, application: due to its low security, DES has been gradually eliminated, but it may still be used in certain specific scenarios; Triple DES, a more secure variation of DES, uses three 56-bit keys to encrypt data three times. Application: It is still used in the fields of financial transaction security, file encryption, database encryption, etc. Stream Cipher 4 (RC4), a stream cipher algorithm, generates a pseudo-random number stream and performs XOR operation with the plaintext to achieve encryption. It has the characteristics of fast speed, ease of use, high flexibility and wide application range. Application: It is mainly used in encrypted communication protocols, Secure Sockets Layer (SSL), Transport Layer Security (TLS) and other network security protocols.

[0105] Asymmetric encryption algorithm: key management is relatively simple, the public key can be made public, and the private key only needs to ensure the security of the private key holder; encryption and decryption speed is slow: compared with symmetric encryption algorithms, the encryption and decryption process of asymmetric encryption algorithms is more complicated and slower. Including: asymmetric encryption method RSA (Rivest-Shamir-Adleman, RSA), an algorithm based on public key encryption, uses a pair of keys (public key and private key) for encryption and decryption. The public key can be made public, and the private key is kept confidential. Application: widely used in the key exchange and digital signature process in SSL certificates, helping websites implement HTTPS encryption and ensure network communication security; Elliptic Curve Cryptography (Elliptic Curve Cryptography, ECC), an encryption algorithm based on elliptic curve mathematical problems, provides higher security and shorter key length than the RSA algorithm. Application: It is also used in SSL certificates. SSL certificates of many well-known brands support the ECC algorithm.

[0106] Hash algorithm: Fast forward: given a plaintext and a hash algorithm, the hash value can be quickly calculated within limited time and resources; difficult reverse: given a hash value, it is almost impossible to reverse the plaintext under existing computing conditions. Includes: MD5, which converts information of any length into a 128-bit hash value. However, shorter hash values ​​have collision vulnerabilities. Application: Suitable for encryption of public or internal data, and can be used in data verification scenarios; Hash encryption algorithm (Secure Hash Algorithm, SHA), SHA-1 is the first generation SHA algorithm standard, which can generate a 160-bit hash value. There are certain security issues. SHA-2 is the successor of SHA-1, including SHA-224, SHA-256, SHA-384 and SHA-512 and other versions. The higher the version, the higher the security. Application: Due to security issues, the use of SHA-1 is decreasing. The SHA-2 algorithm is used in code signing certificates to digitally sign software applications; Bcrypt, a cryptographic hash function based on the Blowfish cryptographic algorithm, uses a recursive hash algorithm and can adjust the encryption strength according to the setting of the work factor. Application: Due to its security and flexibility, bcrypt has been widely used in password storage and verification; Argon2, recognized by the industry as the most secure cryptographic hash algorithm currently, has configurable CPU, memory and time consumption parameters.

[0107] Furthermore, after the step of encrypting the data to be encrypted according to the encryption strategy, the method further includes:

[0108] Conduct security assessment on encrypted files;

[0109] The encryption policy is adjusted based on the security assessment result.

[0110] It should be noted that the above security assessment can be conducted based on encryption strength, transparency, authority control, outbound control, audit and monitoring, etc. In a specific implementation, the above device quantifies these standards based on multiple key standards such as encryption strength, transparency, authority management, distribution control, audit and monitoring, and uses a weight algorithm to give a specific assessment value for the security level of data encryption, and the encryption strategy can be adjusted based on the assessment value (such as selecting a more secure encryption strategy).

[0111] In addition, the above-mentioned equipment is also designed with anti-cracking mechanisms, as well as simulation and detection of various potential external attack methods to verify whether the encryption effect can meet the expected security standards. After the evaluation is completed, the results will be fed back to the intelligent analysis and monitoring module to further analyze the evaluation results and make detailed adjustments or optimizations to the encryption strategy. This optimization may include but is not limited to methods and techniques for re-encrypting already encrypted data to further enhance data security. In this way, the above-mentioned equipment forms a closed-loop feedback mechanism that can continuously improve the intelligence level of the encryption system, enhance its stability and security, and ensure the safety of data during transmission and storage.

[0112] This embodiment also provides a data encryption device, please refer to Figure 3 , Figure 3 A diagram of a data encryption device provided in an embodiment of the present application, wherein the data encryption device comprises:

[0113] An intelligent analysis and monitoring module, used to obtain characteristic information of the data to be encrypted, and determine the security risk level of the data to be encrypted based on the characteristic information;

[0114] An intelligent encryption decision module, used to determine an encryption strategy corresponding to the data to be encrypted based on the security risk level and the characteristic information;

[0115] The dynamic encryption execution module is used to encrypt the data to be encrypted according to the encryption strategy.

[0116] The data encryption device provided in this embodiment adopts the data encryption method in the above embodiment, which can solve the problem that the prior art cannot provide customized encryption schemes according to different data feature information. Compared with the prior art, the beneficial effects of the data encryption device provided in this embodiment are the same as the beneficial effects of the data encryption method provided in the above embodiment, and other technical features in the data encryption device are the same as the features disclosed in the above embodiment method, which will not be described in detail here.

[0117] This embodiment provides a data encryption device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the data encryption method in the above-mentioned embodiment one.

[0118] Reference below Figure 4 , Figure 4Schematic diagram of the structure of a data encryption device suitable for implementing the embodiment of the present application. The data encryption device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 4 The data encryption device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0119] like Figure 4 As shown, the data encryption device may include a processing device 1001 (e.g., a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the data encryption device are also stored. The processing device 1001, ROM1002, and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the data encryption device to communicate with other devices wirelessly or by wire to exchange data. Although the data encryption device with various systems is shown in the figure, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or have alternatively.

[0120] In particular, according to the present embodiment, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the present embodiment includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through a communication device, or installed from the storage device 1003, or installed from the ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present embodiment are executed.

[0121] The data encryption device provided in this embodiment adopts the data encryption method in the above embodiment, which can solve the problem that the prior art cannot provide customized encryption solutions according to different data feature information. Compared with the prior art, the beneficial effects of the data encryption device provided in this embodiment are the same as the beneficial effects of the data encryption method provided in the above embodiment, and other technical features in the data encryption device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0122] It should be understood that the various parts disclosed in this embodiment can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0123] The above is only a specific implementation of this embodiment, but the protection scope of this embodiment is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in this embodiment, which should be included in the protection scope of this embodiment. Therefore, the protection scope of this embodiment should be based on the protection scope of the claims.

[0124] This embodiment provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the data encryption method in the above-mentioned embodiment.

[0125] The computer-readable storage medium provided in this embodiment may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including, but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0126] The computer-readable storage medium may be included in the data encryption device; or may exist independently without being assembled into the data encryption device.

[0127] The computer-readable storage medium carries one or more programs. When the one or more programs are executed by the data encryption device, the data encryption device performs data encryption.

[0128] The computer program code for performing the operations of the present embodiment may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0129] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present embodiment. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0130] The modules involved in the description of this embodiment may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0131] The readable storage medium provided in this embodiment is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned data encryption method, aiming to solve the problem that the prior art cannot provide customized encryption schemes according to different data feature information. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this embodiment are the same as the beneficial effects of the data encryption method provided in the above-mentioned embodiment, and will not be elaborated here.

[0132] This embodiment also provides a computer program product, including a computer program, and when the computer program is executed by a processor, the steps of the data encryption method as described above are implemented.

[0133] The computer program product provided in this embodiment can solve the problem that the prior art cannot provide customized encryption solutions according to different data feature information. Compared with the prior art, the beneficial effects of the computer program product provided in this embodiment are the same as the beneficial effects of the data encryption method provided in the above embodiment, which will not be repeated here.

[0134] The above descriptions are only some embodiments, and are not intended to limit the patent scope of this embodiment. All equivalent structural changes made using the contents of the specification and drawings of this application under the technical concept of this application, or directly / indirectly applied in other related technical fields are included in the patent protection scope of this application.

Claims

1. A data encryption method, characterized in that: The method comprises: Acquire characteristic information of the data to be encrypted, and determine the security risk level of the data to be encrypted based on the characteristic information; Determining an encryption strategy corresponding to the data to be encrypted based on the security risk level and the characteristic information; The data to be encrypted is encrypted according to the encryption policy.

2. The method according to claim 1, characterized in that The step of determining the security risk level of the data to be encrypted based on the characteristic information includes: Determine the grade score of the data to be encrypted in each judgment dimension based on a preset dimension standard; The security risk level of the data to be encrypted is determined according to each of the level scores.

3. The method according to claim 1, characterized in that The step of determining the encryption strategy corresponding to the data to be encrypted based on the security risk level and the characteristic information includes: Performing risk assessment on the characteristic information based on the security risk level; According to the risk assessment result, the encryption policy corresponding to the data to be encrypted is matched from a preset encryption policy library.

4. The method according to claim 3, characterized in that The step of matching the encryption policy corresponding to the data to be encrypted from a preset encryption policy library according to the risk assessment result includes: Determining the encryption type and encryption requirements of the data to be encrypted according to the risk assessment result; A corresponding encryption policy is matched from a preset encryption policy library based on the encryption type and the encryption requirement.

5. The method according to claim 4, characterized in that The step of matching a corresponding encryption policy from a preset encryption policy library based on the encryption type and the encryption requirement includes: Matching a corresponding encryption algorithm and corresponding algorithm parameters from a preset encryption policy library based on the encryption type and the encryption requirement; The corresponding encryption algorithm and the corresponding algorithm parameters are used as the encryption strategy corresponding to the data to be encrypted.

6. The method according to any one of claims 1 to 5, further comprising: after the step of encrypting the data to be encrypted according to the encryption policy: Conduct security assessment on encrypted files; The encryption policy is adjusted based on the security assessment result.

7. The method according to claim 6, characterized in that After the step of encrypting the data to be encrypted according to the encryption strategy, the method further includes: Monitor the current application environment; When an abnormality exists in the current application environment, a corresponding defense measure is determined according to the abnormality type, and defense is performed according to the defense measure.

8. A data encryption device, characterized in that: The device comprises: An intelligent analysis and monitoring module, used to obtain characteristic information of the data to be encrypted, and determine the security risk level of the data to be encrypted based on the characteristic information; An intelligent encryption decision module, used to determine an encryption strategy corresponding to the data to be encrypted based on the security risk level and the characteristic information; The dynamic encryption execution module is used to encrypt the data to be encrypted according to the encryption strategy.

9. A data encryption device, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the data encryption method according to any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the data encryption method according to any one of claims 1 to 7 are implemented.

Images