Data encryption storage method and decryption method

Abstract

The invention discloses a data encryption storage method and a data decryption method, and belongs to the technical field of data security. The method comprises the following steps: encrypting original data to obtain at least one ciphertext fragment; obtaining at least one first device correspondingly stored in the at least one ciphertext fragment; determining address information and an address hash value of next equipment adjacent to the first equipment in the multiple pieces of equipment according to an address sequence of the multiple pieces of equipment by aiming at the ciphertext fragment correspondingly stored by each piece of first equipment; and encrypting the ciphertext fragment according to the address information and the address hash value to obtain encrypted data. Through the mode, the complexity of accessing the ciphertext fragments can be increased, so that an attacker cannot bypass or skip equipment to obtain the ciphertext fragments, thereby improving the security of data storage and reducing the risk of data leakage.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of data security technology, and in particular to a data encryption storage method and a data decryption method. Background Art

[0002] In a specific network environment, it usually includes a semi-enclosed network area (Demilitarized Zone, DMZ) and an internal network. The DMZ usually houses servers for external services, while the internal network houses more sensitive and important data resources, such as databases. If the database host in the internal network is compromised by a request from the DMZ network, the attacker obtains administrator privileges and can read all the data in the current database through the administrator account.

[0003] In order to prevent certain very important data from being unreadable, the following measures can usually be taken: 1) Encrypt important data with a long key; 2) Store the encrypted data on a specific machine that has a high-strength login password or other authentication method; 3) Split the data encryption key and distribute it to multiple people, who must be authorized by multiple people at the same time to obtain the key; 4) The key can be stored in a white box mixed with data, or it can be stored separately.

[0004] However, no matter how strong the key is or how many times it is split, as long as the last key in all key fragments is cracked, the complete key can be obtained, leading to data leakage. Summary of the invention

[0005] The embodiments of the present application provide a data encryption storage method and a decryption method to at least solve the problems of insufficient security of data storage and easy data leakage in the related art.

[0006] In order to solve the above technical problems, this application is implemented as follows:

[0007] In a first aspect, an embodiment of the present application provides a data encryption storage method, including: encrypting original data to obtain at least one ciphertext fragment; obtaining at least one first device corresponding to the storage of the at least one ciphertext fragment; for each ciphertext fragment stored corresponding to the first device, determining the address information and address hash value of the next device adjacent to the first device among the multiple devices according to the address order of multiple devices; encrypting the ciphertext fragment stored by the first device according to the address information and the address hash value to obtain encrypted data.

[0008] In second aspect, an embodiment of the present application provides a data decryption method, including: obtaining at least one encrypted data stored corresponding to at least one first device among multiple devices; for each encrypted data stored corresponding to the first device, determining the address information and address hash value of the next device adjacent to the first device among the multiple devices according to the address order of the multiple devices; decrypting the encrypted data stored in the first device according to the address information and the address hash value to obtain a ciphertext fragment; decrypting the at least one ciphertext fragment to obtain the original data.

[0009] In a third aspect, an embodiment of the present application provides a data encryption storage device, comprising: a first encryption module, used to encrypt original data to obtain at least one ciphertext fragment; a device acquisition module, used to obtain at least one first device corresponding to the storage of the at least one ciphertext fragment; a second encryption module, used to determine, for each ciphertext fragment stored corresponding to the first device, the address information and address hash value of the next device adjacent to the first device among the multiple devices according to the address order of the multiple devices; encrypt the ciphertext fragment stored by the first device according to the address information and the address hash value to obtain encrypted data.

[0010] In a fourth aspect, an embodiment of the present application provides a data decryption device, comprising: a data acquisition module, used to acquire at least one encrypted data stored corresponding to at least one first device among multiple devices; a first decryption module, used to determine, for each encrypted data stored corresponding to the first device, the address information and address hash value of the next device adjacent to the first device among the multiple devices according to the address order of the multiple devices; decrypt the encrypted data stored by the first device according to the address information and the address hash value to obtain a ciphertext fragment; a second decryption module, used to decrypt the at least one ciphertext fragment to obtain the original data.

[0011] In a fifth aspect, an embodiment of the present application provides an electronic device, comprising a processor and a memory, wherein the memory stores programs or instructions that can be run on the processor, and when the programs or instructions are executed by the processor, the steps of the method described in the first aspect or the second aspect above are implemented.

[0012] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the method described in the first aspect or the second aspect above are implemented.

[0013] In the seventh aspect, an embodiment of the present application provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer executes the steps of the method described in the first or second aspect above.

[0014] In an embodiment of the present application, the original data is encrypted to obtain at least one ciphertext slice; at least one first device corresponding to the storage of the at least one ciphertext slice is obtained; for each ciphertext slice corresponding to the storage of the first device, the address information and address hash value of the next device adjacent to the first device in the multiple devices are determined according to the address sequence of the multiple devices; according to the address information and the address hash value, the ciphertext slice stored in the first device is encrypted to obtain encrypted data. In this way, the complexity of accessing the ciphertext slice can be increased, so that attackers cannot bypass or skip the device to obtain the ciphertext slice, thereby improving the security of data storage and reducing the risk of data leakage.

[0015] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0017] Figure 1 A schematic diagram of the process of the data encryption storage method provided in an embodiment of the present application is shown;

[0018] Figure 2 A schematic diagram of encrypting original data provided by an embodiment of the present application is shown;

[0019] Figure 3 A schematic diagram of corresponding storage ciphertext sharding provided by an embodiment of the present application is shown;

[0020] Figure 4 A schematic diagram of a random machine provided in an embodiment of the present application is shown;

[0021] Figure 5 A schematic diagram of the structure of the target blockchain provided by an embodiment of the present application is shown;

[0022] Figure 6 A schematic diagram of a process flow of a data decryption method provided in an embodiment of the present application is shown;

[0023] Figure 7 Another schematic diagram of a data decryption method according to an embodiment of the present invention is shown;

[0024] Figure 8 A schematic diagram of the structure of a data encryption storage device provided in an embodiment of the present application is shown;

[0025] Fig. 9 A schematic diagram of the structure of a data decryption device provided in an embodiment of the present application is shown;

[0026] Fig.10 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0027] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0028] Figure 1 A flow chart of the data encryption storage method provided in an embodiment of the present application is shown. The execution subject of the method may be a terminal device or a server, wherein the terminal device may be a device such as a personal computer, or a mobile terminal device such as a mobile phone or a tablet computer, and the terminal device may be a terminal device used by a user. The server may be an independent server, or a server cluster composed of multiple servers, and the server may be a background server of a certain business, or a background server of a certain platform or application (for example, a database system, a cloud storage service, a distributed file system, etc.). In the embodiment of the present application, the execution subject is taken as an example to illustrate. For the case of a terminal device, it can be processed according to the following related content, which will not be repeated here. As shown in the figure, the data encryption storage method 100 may include the following steps:

[0029] S101: Encrypt original data to obtain at least one ciphertext fragment.

[0030] In an exemplary embodiment, if Figure 2 As shown, the server can divide the original data C into at least one data segment, and use the initial key S to encrypt at least one data segment to obtain at least one ciphertext fragment SC1, SC2, ..., SCM, where M is a positive integer.

[0031] S102: Obtain at least one first device corresponding to the storage of the at least one ciphertext fragment.

[0032] Continuing with the above embodiment, the ciphertext fragments SC1, SC2, ..., SCM may be stored in the corresponding M first devices respectively, for example, SC1 may be stored in the AAAA machine, SC2 may be stored in the BBBB machine, and SCM may be stored in the CCCC machine.

[0033] Compared with the method of increasing the key length in related schemes, the embodiment of the present application uses the initial key to encrypt at least one data segment to obtain ciphertext fragments, that is, the number of keys is increased, and at least one ciphertext fragment is stored in at least one first device. In this way, when a first device is cracked, the attacker still cannot obtain the complete original data, which is beneficial to improve data security.

[0034] S103: For each ciphertext fragment stored corresponding to the first device, determine the address information and address hash value of the next device adjacent to the first device among the multiple devices according to the address order of the multiple devices; encrypt the ciphertext fragment stored in the first device according to the address information and the address hash value to obtain encrypted data.

[0035] Continuing with the above embodiment, the AAAA machine stores the ciphertext fragment SC1, the BBBB machine stores the ciphertext fragment SC2, and the CCCC machine stores the ciphertext fragment SC3. Figure 3 As shown, for the ciphertext slice SC1 stored in the AAAA machine, the address information S1 and the address hash value hash4 of the next device adjacent to the AAAA machine among the multiple devices are determined according to the address order of the multiple devices, and the ciphertext slice SC1 is encrypted according to the address information S1 and the address hash value hash4 to obtain the encrypted data (S1+hash4)[SC1]. Similarly, the ciphertext slice SC2 stored in the BBBB machine and the ciphertext slice SC3 stored in the CCCC machine are encrypted to obtain the corresponding encrypted data.

[0036] Among them, hash1 is the address hash value corresponding to the address information of the AAAA machine, hash2 is the address hash value corresponding to the address information of the BBBB machine, and hash3 is the address hash value corresponding to the address information of the CCCC machine. The initial key S can be stored in the first device AAAA machine to facilitate the subsequent data decryption process.

[0037] The business scenario of the above data encryption storage method can be defined as: in an office intranet environment, a copy of data needs to be stored in a safe. The safe stipulates that the data can only be read by the corresponding user who has logged in to the AAAA machine and obtained authorization. This method has the following risks: the attacker finds the AAAA machine; the attacker captures the AAAA machine. Therefore, the following solution is adopted: the rules of the safe are modified to: the corresponding user who has logged in to the 7 machines AAAA, BBBB, CCCC, S1, S2, SN-1, SN+1 and obtained authorization can be read, and the above 6 machines must be cracked in sequence to obtain all the data. The embodiment of the present application stores at least one ciphertext fragment in at least one first device, and for each ciphertext fragment stored in the first device, the address information and address hash value of the next device adjacent to the first device in the multiple devices are determined according to the address sequence of the multiple devices; according to the address information and address hash value, the ciphertext fragment stored in the first device is encrypted to obtain encrypted data. In this way, the complexity of accessing the ciphertext shards can be increased, making it impossible for attackers to bypass or jump over the device to obtain the ciphertext shards, thereby improving the security of data storage and reducing the risk of data leakage.

[0038] In a possible implementation, the multiple devices include a second device; in the above S103, before determining the address information and the address hash value of the next device adjacent to the first device among the multiple devices according to the address sequence of the multiple devices, the method further includes:

[0039] The first device and the second device are randomly arranged to obtain an address sequence of the plurality of devices.

[0040] In the embodiment of the present application, in order to improve security strength, a second device for obfuscation can be added to the first device. Figure 4 As shown in , random machines S1, S2, SN, SN+1 are added to the first device, where N is a positive integer. hash4, hash5, hash6 and hash7 correspond to the address hash values ​​corresponding to the address information of the S1, S2, SN, SN+1 machines, respectively.

[0041] In a possible implementation, in S103, encrypting the ciphertext fragment according to the address information and the address hash value to obtain encrypted data includes:

[0042] Generate a first key corresponding to the ciphertext segment according to the address information and the address hash value; and encrypt the ciphertext segment using the first key to obtain the encrypted data.

[0043] In an embodiment of the present application, a first key can be generated based on the address information and address hash value of the next device adjacent to the first device stored in the ciphertext fragments SC1, SC2, ..., SCM. For example, the address information and address hash value can be used as the first key; the first key is used to encrypt each ciphertext fragment to obtain encrypted data, and the encrypted data is stored in the corresponding first device.

[0044] In a possible implementation, in S103, after encrypting the ciphertext fragment according to the address information and the address hash value to obtain encrypted data, the method further includes:

[0045] The address sequence of the multiple devices is encrypted to obtain address sequence encryption information corresponding to the multiple devices.

[0046] In the embodiment of the present application, in order to further improve the security of data storage, the address sequence of multiple devices can be encrypted to obtain the encrypted address sequence information of multiple devices. For example, the address sequence of multiple devices is: AAAA, S1, S2, BBBB, SN, CCCC, SN+1, and the address sequence information of the target device can be determined based on the address information of the device adjacent to the target device and the address information of the target device. For example, based on AAAA and S1, the address sequence information AAAA+S1 of S1 is determined, and the address sequence information is encrypted to obtain the encrypted address sequence information of device S1.

[0047] In a possible implementation, the above-mentioned encrypting the address sequence of the multiple devices to obtain the address sequence encryption information corresponding to the multiple devices includes:

[0048] For any one of the multiple devices, obtain address sequence information of the any one of the devices, wherein the address sequence information includes address information of a previous device adjacent to the any one of the multiple devices, address information of the any one of the devices, and a random number;

[0049] Generate a second key of a next device adjacent to the starting device among the multiple devices according to the initial key and the address hash value of the starting device among the multiple devices; and generate a second key of a next device adjacent to any one of the multiple devices according to the address information of the previous device adjacent to any one of the devices and the address hash value of any one of the devices, starting from the next device adjacent to the starting device;

[0050] The address sequence information corresponding to the multiple devices is encrypted using the second keys of the multiple devices to obtain the address sequence encrypted information corresponding to the multiple devices.

[0051] In the embodiment of the present application, taking the address sequence of multiple devices as AAAA, S1, S2, BBBB, SN, CCCC, SN+1 as an example, for any device, its address sequence information may include the address information of the previous device adjacent to any device among the multiple devices, the address information of any device, and a random number. For example, the address sequence information of S1 is [AAAA+S1+3], where AAAA is the address information of the previous device, S1 is the address information of the current device, and 3 is a random number; the address sequence information of S2 is [S1+S2+3]; the address sequence information of BBBB is [S2+BBBB+3].

[0052] In particular, for the starting device AAAA, [AAAA+3] can be used as its address sequence information.

[0053] Furthermore, the address sequence information corresponding to each device is encrypted. Specifically, based on the initial key S and the address hash value hash1 of the starting device among the multiple devices, a second key (S+hash1) of the next device S1 adjacent to the starting device among the multiple devices is generated; starting from the next device S1 adjacent to the starting device, based on the address information of the previous device adjacent to any device and the address hash value of any device, a second key of the next device adjacent to any device among the multiple devices is generated, for example, the second key of S2 is (AAAA+hash4), and the second key of BBBB is (S1+hash5).

[0054] The second keys of the multiple devices are used to encrypt the address sequence information corresponding to the multiple devices to obtain the address sequence encryption information corresponding to the multiple devices. For example, the address sequence encryption information of S1 is (S+hash1)[AAAA+S1+3], the address sequence encryption information of S2 is (AAAA+hash4)[S1+S2+3], the address sequence encryption information of BBBB is (S1+hash5)[S2+BBBB+3], the address sequence encryption information of SN is (S2+hash2)[BBBB+SN+3], the address sequence encryption information of CCCC is (SN-1+3)[SN+CCCC+3], and the address sequence encryption information of SN+1 is (SN+hash3)[CCCC+NULL+3].

[0055] The second devices S1, S2, SN, and SN+1 used for obfuscation are interference factors used to improve security strength. The AAAA machine, BBBB machine, and CCCC machine are machines that actually store data. If an attacker attempts to attack, even if the entire link can be completely cracked, only the encrypted data of the second device address and the real data storage address and the data splicing sequence can be obtained. The attacker still has to attack all machines one by one and crack to obtain the ciphertext fragments of the original data encrypted in the machine, and finally crack the ciphertext and splice the data to obtain the original data. In this way, the difficulty of decryption for attackers can be greatly increased, and unlike traditional methods, the encryption algorithm can improve security strength by increasing the number of obfuscated machines or further fragmenting the original data.

[0056] In a possible implementation, after the address sequence of the multiple devices is encrypted to obtain the address sequence encryption information corresponding to the multiple devices, the method further includes:

[0057] A target blockchain is used to store address sequence encryption information corresponding to the multiple devices, wherein the target blockchain includes multiple blocks, and the multiple blocks correspond one-to-one to the multiple devices.

[0058] Continuing the above example, Figure 5 As shown in the figure, the AAAA address is put on the chain as the first node of the target blockchain. In block 1, the key consists of the initial key S and the address hash value of the initial block (block 0), which is used to encrypt and decrypt address information. For block 1, AAAA is the address of the previous block node, S1 is the address information of the current block node, and three randomly generated random values ​​are added to the address information each time as interference items.

[0059] Access the AAAA machine to obtain hash1, and then use the AAAA address + S1 address + 3-digit random number as data, the initial key S + hash1 as the second key, use the second key to encrypt the data to obtain the address sequence encryption information, that is, the ciphertext (S + hash1) [AAAA + S1 + 3], and link the ciphertext to the second node block 1 of the target blockchain. Access the S1 machine to obtain the hash value hash4, use [AAAA + hash4] as the second key, S1 address + S2 address + 3-digit random number as data, encrypt the data with the key to obtain the ciphertext (AAAA + hash4) [S1 + S2 + 3], and link the ciphertext to the third node block 2 of the blockchain. After the same logic as above, the subsequent block nodes are (S1 + hash5) [S2 + BBBB + 3], (S2 + hash2) [BBBB + SN + 3], (SN-1 + 3) [SN + CCCC + 3], (SN + hash3) [CCCC + NULL + 3].

[0060] According to the order in which the ciphertext is uploaded to the chain, the address information + hash value of the next node is used as the key, and the ciphertext fragments SC1, SC2, ..., SCM are encrypted using the key and stored in the corresponding first device.

[0061] In this way, by using the target blockchain to store the address sequence encryption information corresponding to multiple devices, the address sequence encryption information can be prevented from being tampered with. The address sequence information can only be increased but not decreased, and it supports increasing the decryption difficulty by increasing the number of keys.

[0062] Figure 6 A flow chart of a data decryption method provided by an embodiment of the present application is shown. The data decryption method is used to decrypt the encrypted data obtained by the above-mentioned data encryption storage method to obtain the original data. As shown in the figure, the data decryption method 600 may include the following steps:

[0063] S601: Obtain at least one encrypted data stored corresponding to at least one first device among multiple devices.

[0064] In an exemplary embodiment, the encrypted data correspondingly stored in the AAAA machine, the BBBB machine and the CCCC machine are obtained. Taking the AAAA machine as an example, the encrypted data (S1+hash4)[SC1] stored in the AAAA machine is obtained.

[0065] S602: For each encrypted data stored corresponding to the first device, determine the address information and address hash value of the next device adjacent to the first device among the multiple devices according to the address order of the multiple devices; decrypt the encrypted data stored in the first device according to the address information and the address hash value to obtain ciphertext fragments.

[0066] Continuing with the above embodiment, for each encrypted data stored in the first device, according to the address sequence of multiple devices AAAA, S1, S2, BBBB, SN, CCCC, SN+1, the address information S1 and address hash value hash4 of the next device S1 adjacent to the AAAA machine are determined, and according to the address information S1 and address hash value hash4, the encrypted data (S1+hash4)[SC1] stored in the AAAA machine is decrypted to obtain the ciphertext fragment SC1. By analogy, the ciphertext fragment SC2 stored in the BBBB machine and the ciphertext fragment SCM stored in the CCCC machine can be obtained.

[0067] S603: Decrypt the at least one ciphertext fragment to obtain original data.

[0068] Continuing with the above embodiment, the initial key S can be used to decrypt SC1, SC2, ... SCM to obtain the original data C.

[0069] In a possible implementation, in the above S602, before determining the address information and the address hash value of the next device adjacent to the first device among the multiple devices according to the address sequence of the multiple devices, the method further includes:

[0070] The address sequence encrypted information of the multiple devices is decrypted to obtain the address sequence of the multiple devices.

[0071] In an embodiment of the present application, in order to further improve the security of data storage, the address order of multiple devices is encrypted when data is encrypted and stored to obtain address order encryption information of the multiple devices. When data is decrypted, the address order encryption information of the multiple devices can be decrypted to obtain the address order of the multiple devices. Then, according to the address order of the multiple devices, the encrypted data stored in at least one first device is decrypted to obtain ciphertext fragments SC1, SC2, ... SCM.

[0072] In a possible implementation, decrypting the address sequence information of the multiple devices to obtain the address sequence of the multiple devices includes:

[0073] Obtain an initial key and an address hash value of a starting device among the multiple devices; generate a second key for a next device adjacent to the starting device among the multiple devices based on the address hash value of the starting device and the initial key; use the second key to decrypt the address sequence encrypted information of the next device adjacent to the starting device to obtain the address information of the next device adjacent to the starting device, and repeat this process until the address information of the terminal device among the multiple devices is obtained, thereby obtaining the address sequence of the multiple devices.

[0074] In an embodiment of the present application, the address information AAAA of a starting device among multiple devices can be obtained, the initial key S and the address hash value hash1 of the starting device can be obtained from the starting device AAAA, and the second key (S+hash1) of the next device S1 adjacent to the starting device among the multiple devices is generated according to the address hash value hash1 of the starting device and the initial key S; the second key (S+hash1) is used to decrypt the address sequence encrypted information (S+hash1) [AAAA+S1+3] of the next device adjacent to the starting device, and the address information AAAA+S1+3-bit random value of the next device adjacent to the starting device is obtained, and the interference item AAAA and the three-bit random value are removed to obtain the S1 address. According to the decrypted value, log in to the next machine: S1, obtain its address hash value hash4, and then combine it with AAAA to get the second key (AAAA+hash4), obtain the ciphertext (AAAA+hash4)[S1+S2+3] in the S2 device, decrypt it with the second key (AAAA+hash4) to get the S1+S2+3-bit random value, remove the interference item S1 and the three-bit random value to get the S2 address, and repeat this process until the address information SN+1 of the terminal device among multiple devices is obtained, and the address sequence of multiple devices is obtained: AAAA, S1, S2, BBBB, SN, CCCC, SN+1.

[0075] In a possible implementation, before decrypting the encrypted information of the address sequence of the multiple devices to obtain the address sequence of the multiple devices, the method further includes:

[0076] The address sequence encryption information corresponding to the multiple devices is obtained from the multiple blocks of the target blockchain, and the multiple blocks correspond to the multiple devices one by one.

[0077] In the embodiment of the present application, the address sequence encryption information corresponding to multiple devices stored in multiple blocks on the target blockchain can be read by traversing the target blockchain. Figure 7 As shown in , taking the address sequence encryption information of the AAAA machine as an example, by accessing the 0th node of the target blockchain, that is, block 0, the address sequence encryption information (NULL) [NULL+AAAA+3) corresponding to the AAAA machine returned by the target blockchain is obtained. Then the address information AAAA+3 of the starting device is obtained; the initial key S stored in the starting device AAAA; and the address hash value hash1 of the starting device is obtained. Based on the initial key S and the address hash value hash1 of the starting device AAAA, the address sequence encryption information of multiple devices is decrypted to obtain the address sequence of multiple devices.

[0078] The embodiment of the present application provides a data decryption method, which obtains at least one encrypted data stored corresponding to at least one first device among multiple devices; for each encrypted data stored corresponding to the first device, according to the address sequence of the multiple devices, determines the address information and address hash value of the next device adjacent to the first device among the multiple devices; according to the address information and the address hash value, decrypts the encrypted data stored in the first device to obtain a ciphertext slice; decrypts the at least one ciphertext slice to obtain the original data. In this way, the complexity of accessing the ciphertext slice can be increased, so that attackers cannot bypass or skip the device to obtain the ciphertext slice, thereby improving the security of data storage and reducing the risk of data leakage.

[0079] Figure 8 The structure diagram of the data encryption storage device provided in the embodiment of the present application is shown. The data encryption storage device can be implemented as follows: Figure 1 All or part of the contents of the illustrated embodiment, as shown in the figure, the data encryption storage device 800 includes:

[0080] A first encryption module 810 is used to encrypt the original data to obtain at least one ciphertext fragment;

[0081] A device acquisition module 820 is used to acquire at least one first device corresponding to the storage of the at least one ciphertext fragment;

[0082] The second encryption module 830 is used to determine, for each ciphertext fragment stored corresponding to the first device, the address information and address hash value of the next device adjacent to the first device among the multiple devices according to the address order of the multiple devices; encrypt the ciphertext fragment stored in the first device according to the address information and the address hash value to obtain encrypted data.

[0083] In a possible implementation, the multiple devices include a second device; and the second encryption module 830, before determining address information and an address hash value of a next device adjacent to the first device among the multiple devices according to an address sequence of the multiple devices, is further configured to:

[0084] The first device and the second device are randomly arranged to obtain an address sequence of the plurality of devices.

[0085] In a possible implementation, the second encryption module 830, when used to encrypt the ciphertext fragment according to the address information and the address hash value to obtain encrypted data, is specifically used to:

[0086] Generate a first key corresponding to the ciphertext fragment according to the address information and the address hash value;

[0087] The ciphertext segment is encrypted using the first key to obtain the encrypted data.

[0088] In a possible implementation, the second encryption module 830, after being used to encrypt the ciphertext fragment according to the address information and the address hash value to obtain encrypted data, is further used to:

[0089] The address sequence of the multiple devices is encrypted to obtain address sequence encryption information corresponding to the multiple devices.

[0090] In a possible implementation, the second encryption module 830, when used to encrypt the address sequence of the multiple devices to obtain the address sequence encryption information corresponding to the multiple devices, is specifically used to:

[0091] For any one of the multiple devices, obtain address sequence information of the any one of the devices, wherein the address sequence information includes address information of a previous device adjacent to the any one of the multiple devices, address information of the any one of the devices, and a random number;

[0092] Generate a second key of a next device adjacent to the starting device among the multiple devices according to the initial key and the address hash value of the starting device among the multiple devices; and generate a second key of a next device adjacent to any one of the multiple devices according to the address information of the previous device adjacent to any one of the devices and the address hash value of any one of the devices, starting from the next device adjacent to the starting device;

[0093] The address sequence information corresponding to the multiple devices is encrypted using the second keys of the multiple devices to obtain the address sequence encrypted information corresponding to the multiple devices.

[0094] In a possible implementation, the second encryption module 830, after being used to encrypt the address sequence of the multiple devices to obtain the address sequence encryption information corresponding to the multiple devices, is further used to:

[0095] A target blockchain is used to store address sequence encryption information corresponding to the multiple devices, wherein the target blockchain includes multiple blocks, and the multiple blocks correspond one-to-one to the multiple devices.

[0096] The embodiment of the present application provides a data encryption storage device, including a first encryption module, a device acquisition module, and a second encryption module; the first encryption module encrypts the original data to obtain at least one ciphertext fragment; the device acquisition module obtains at least one first device corresponding to the storage of the at least one ciphertext fragment; the second encryption module determines the address information and address hash value of the next device adjacent to the first device in the plurality of devices for each ciphertext fragment stored corresponding to the first device according to the address sequence of the plurality of devices; according to the address information and the address hash value, the ciphertext fragment stored by the first device is encrypted to obtain encrypted data. In this way, the complexity of accessing the ciphertext fragment can be increased, so that the attacker cannot bypass or skip the device to obtain the ciphertext fragment, thereby improving the security of data storage and reducing the risk of data leakage.

[0097] Fig. 9 The structure diagram of the data decryption device provided in the embodiment of the present application is shown. The data decryption device can be implemented as follows: Figure 6 All or part of the contents of the illustrated embodiment, as shown in the figure, the data decryption device 900 includes:

[0098] A data acquisition module 910 is used to acquire at least one encrypted data stored corresponding to at least one first device among multiple devices;

[0099] A first decryption module 920 is configured to determine, for each encrypted data stored corresponding to the first device, address information and an address hash value of a next device adjacent to the first device among the multiple devices according to the address sequence of the multiple devices; decrypt the encrypted data stored in the first device according to the address information and the address hash value to obtain a ciphertext fragment;

[0100] The second decryption module 930 is used to decrypt the at least one ciphertext fragment to obtain original data.

[0101] In a possible implementation, the first decryption module 920, before determining the address information and the address hash value of the next device adjacent to the first device among the multiple devices according to the address sequence of the multiple devices, is further configured to:

[0102] The address sequence encrypted information of the multiple devices is decrypted to obtain the address sequence of the multiple devices.

[0103] In a possible implementation, the first decryption module 920, when used to decrypt the address sequence encryption information of multiple devices to obtain the address sequence of the multiple devices, is specifically used to:

[0104] Obtaining an initial key and an address hash value of a starting device among the multiple devices;

[0105] Generate a second key of a next device adjacent to the starting device among the multiple devices according to the starting device address hash value and the initial key;

[0106] Use the second key to decrypt the address sequence encrypted information of the next device adjacent to the starting device to obtain the address information of the next device adjacent to the starting device, and repeat this process until the address information of the terminal device among the multiple devices is obtained, thereby obtaining the address sequence of the multiple devices.

[0107] In a possible implementation, the first decryption module 920, before being used to decrypt the address sequence information of the multiple devices to obtain the address sequence of the multiple devices, is further used to:

[0108] The address sequence encryption information corresponding to the multiple devices is obtained from the multiple blocks of the target blockchain, and the multiple blocks correspond to the multiple devices one by one.

[0109] The embodiment of the present application provides a data decryption device, including: a data acquisition module, a first decryption module, and a second decryption module; the data acquisition module acquires at least one encrypted data stored corresponding to at least one first device among multiple devices; the first decryption module determines the address information and address hash value of the next device adjacent to the first device among the multiple devices according to the address sequence of the multiple devices for each encrypted data stored corresponding to the first device; according to the address information and the address hash value, the encrypted data stored in the first device is decrypted to obtain a ciphertext fragment; the second decryption module decrypts the at least one ciphertext fragment to obtain the original data. In this way, the complexity of accessing the ciphertext fragment can be increased, so that attackers cannot bypass or skip the device to obtain the ciphertext fragment, thereby improving the security of data storage and reducing the risk of data leakage.

[0110] Fig.10 The hardware structure diagram of the electronic device provided by the embodiment of the present application is shown. Referring to the figure, at the hardware level, the electronic device 1000 includes a processor 1010, and optionally, includes an internal bus 1020, a network interface 1030, and a memory 1040. Among them, the memory 1040 may include a memory 1041, such as a high-speed random access memory (Random-Access Memory, RAM), and may also include a non-volatile memory 1042 (non-volatile memory), such as at least one disk storage, etc. Of course, the electronic device 1000 may also include hardware required for other services.

[0111] The processor 1010, the network interface 1030 and the memory may be connected to each other via an internal bus 1020, which may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one bidirectional arrow is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0112] The memory 1040 stores programs. Specifically, the programs may include program codes, and the program codes include computer operation instructions. The memory 1040 may include a memory 1041 and a non-volatile memory 1042 , and provide instructions and data to the processor 1010 .

[0113] The processor 1010 reads the corresponding computer program from the non-volatile memory 1042 into the memory and then runs it, forming a device for locating the target user at the logical level. The processor 1010 executes the program stored in the memory and specifically performs: Figure 1 or Figure 6 The method disclosed in the illustrated embodiment realizes the functions and beneficial effects of each method described in the foregoing method embodiments, which will not be described in detail here.

[0114] The above application Figure 1 or Figure 6The method disclosed in the illustrated embodiment can be applied to the processor 1010, or implemented by the processor 1010. The processor 1010 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 1010. The above processor 1010 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware decoding processor for execution, or a combination of hardware and software modules in the decoding processor for execution. The software module can be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0115] The computer device can also execute the methods described in the foregoing method embodiments, and realize the functions and beneficial effects of the methods described in the foregoing method embodiments, which will not be repeated here.

[0116] Of course, in addition to software implementation, the electronic device 1000 of the present application does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc., that is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0117] The embodiment of the present application also provides a computer-readable storage medium, wherein the computer-readable medium stores one or more programs, and when the one or more programs are executed by an electronic device including multiple application programs, the electronic device executes Figure 1 or Figure 6 The method disclosed in the illustrated embodiment realizes the functions and beneficial effects of each method described in the foregoing method embodiments, which will not be described in detail here.

[0118] The computer-readable storage medium includes a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0119] Furthermore, an embodiment of the present application also provides a computer program product, the computer program product comprising a computer program stored on a non-transitory computer-readable storage medium, the computer program comprising program instructions, and when the program instructions are executed by a computer, the following process is implemented: Figure 1 or Figure 6 The method disclosed in the illustrated embodiment realizes the functions and beneficial effects of each method described in the foregoing method embodiments, which will not be described in detail here.

[0120] The embodiments of the present application can be applied to various electronic device collaboration or interconnection scenarios, including: collaboration and interconnection between mobile phones and laptops / tablet computers; collaboration and interconnection between mobile terminals and smart TVs / displays; collaboration and interconnection between mobile phones or tablet computers and in-car entertainment systems; collaboration and interconnection between mobile terminals and smart conference systems, etc., so as to meet the needs of users in various scenarios such as smart homes, smart offices, and smart travel.

[0121] In short, the above is only a preferred embodiment of the present application and does not limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

[0122] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0123] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0124] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0125] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

Claims

1. A data encryption storage method, characterized in that: include: Encrypt the original data to obtain at least one ciphertext fragment; Obtaining at least one first device storing the at least one ciphertext fragment; For each ciphertext fragment stored corresponding to the first device, determine the address information and address hash value of the next device adjacent to the first device among the multiple devices according to the address sequence of the multiple devices; The ciphertext fragments stored in the first device are encrypted according to the address information and the address hash value to obtain encrypted data.

2. The method according to claim 1, characterized in that The plurality of devices include a second device; and before determining the address information and the address hash value of the next device adjacent to the first device among the plurality of devices according to the address sequence of the plurality of devices, further comprising: The first device and the second device are randomly arranged to obtain an address sequence of the plurality of devices.

3. The method according to claim 1, characterized in that: The step of encrypting the ciphertext fragment according to the address information and the address hash value to obtain encrypted data includes: Generate a first key corresponding to the ciphertext fragment according to the address information and the address hash value; The ciphertext segment is encrypted using the first key to obtain the encrypted data.

4. The method according to claim 1, characterized in that After encrypting the ciphertext fragment according to the address information and the address hash value to obtain encrypted data, the method further includes: The address sequence of the multiple devices is encrypted to obtain address sequence encryption information corresponding to the multiple devices.

5. The method according to claim 4, characterized in that The step of encrypting the address sequence of the plurality of devices to obtain the address sequence encryption information corresponding to the plurality of devices includes: For any one of the multiple devices, obtain address sequence information of the any one of the devices, wherein the address sequence information includes address information of a previous device adjacent to the any one of the multiple devices, address information of the any one of the devices, and a random number; Generate a second key of a next device adjacent to the starting device among the multiple devices according to the initial key and the address hash value of the starting device among the multiple devices; and generate a second key of a next device adjacent to any one of the multiple devices according to the address information of the previous device adjacent to any one of the devices and the address hash value of any one of the devices, starting from the next device adjacent to the starting device; The address sequence information corresponding to the multiple devices is encrypted using the second keys of the multiple devices to obtain the address sequence encrypted information corresponding to the multiple devices.

6. The method according to claim 4, characterized in that After encrypting the address sequence of the multiple devices to obtain the address sequence encryption information corresponding to the multiple devices, the method further includes: A target blockchain is used to store address sequence encryption information corresponding to the multiple devices, wherein the target blockchain includes multiple blocks, and the multiple blocks correspond one-to-one to the multiple devices.

7. A data decryption method, characterized in that: include: Obtaining at least one encrypted data stored corresponding to at least one first device among the multiple devices; For each encrypted data stored corresponding to the first device, determine the address information and address hash value of the next device adjacent to the first device among the multiple devices according to the address sequence of the multiple devices; Decrypting the encrypted data stored in the first device according to the address information and the address hash value to obtain ciphertext fragments; Decrypt the at least one ciphertext fragment to obtain original data.

8. The method according to claim 7, characterized in that Before determining the address information and the address hash value of the next device adjacent to the first device among the multiple devices according to the address sequence of the multiple devices, the method further includes: The address sequence encrypted information of the multiple devices is decrypted to obtain the address sequence of the multiple devices.

9. The method according to claim 8, characterized in that The decrypting of the address sequence information of the multiple devices to obtain the address sequence of the multiple devices includes: Obtaining an initial key and an address hash value of a starting device among the multiple devices; Generate a second key of a next device adjacent to the starting device among the multiple devices according to the starting device address hash value and the initial key; Use the second key to decrypt the address sequence encrypted information of the next device adjacent to the starting device to obtain the address information of the next device adjacent to the starting device, and repeat this process until the address information of the terminal device among the multiple devices is obtained, thereby obtaining the address sequence of the multiple devices.

10. The method according to claim 8, characterized in that Before decrypting the address sequence information of the multiple devices to obtain the address sequence of the multiple devices, the method further includes: The address sequence encryption information corresponding to the multiple devices is obtained from the multiple blocks of the target blockchain, and the multiple blocks correspond to the multiple devices one by one.

Images