Data encryption method and system based on multi-stage processing

Abstract

The invention discloses a data encryption method and system based on multi-stage processing, and relates to the technical field of data encryption, and the method comprises the steps: determining stages of multi-stage parallel processing; the stages comprise a data classification stage, a key management and distribution stage and an encryption execution stage; in the data classification stage, data are analyzed, and the data are classified into sensitive blocks and non-sensitive blocks; in the key management and distribution stage, a corresponding encryption key is selected according to the sensitivity of data; in the encryption execution stage, encrypted data are generated according to different encryption keys. According to the method, the data processing efficiency is greatly improved through parallel processing of multiple stages, and the method is suitable for processing large-scale data sets. The dynamic key management strategy enhances the security and flexibility of the system, allows real-time generation and distribution of keys according to data sensitivity, and effectively protects various security threats. And the integrated homomorphic encryption technology enables the encrypted data to be directly subjected to complex operation, so that the use scene of the encrypted data is expanded, and meanwhile, the data privacy is protected.

Description

Technical Field

[0001] The present invention relates to the technical field of data encryption, and in particular to a data encryption method and system based on multi-stage processing. Background Art

[0002] In the current information age, the importance of data security, especially data encryption technology, continues to rise. With the rapid development of cloud computing, big data, and the Internet of Things, data encryption technology has become a key means to protect personal privacy and trade secrets. Traditional data encryption technologies, such as symmetric encryption (AES) and asymmetric encryption (RSA), although providing strong security, still show limitations in some occasions. Especially in scenarios where complex operations need to be performed on encrypted data, these traditional technologies are either not directly applicable or inefficient. As an emerging solution, homomorphic encryption technology allows calculations to be performed directly on ciphertext, and the calculation results are the same as the results of the same calculations performed directly on plaintext after decryption, which shows great potential in data privacy protection.

[0003] However, existing homomorphic encryption technologies face multiple challenges in practical applications. First, although fully homomorphic encryption (FHE) is powerful, its computational efficiency is low, which makes it difficult to be widely used in real-time systems that require high-efficiency processing. Second, data classification and sensitivity analysis usually require additional processing steps, which adds additional delays before data processing. In addition, the key management of existing encryption systems often fails to flexibly respond to dynamically changing encryption requirements, especially when facing large-scale distributed systems, the distribution and management of keys remains a major problem. These problems limit the application of encryption technology in a wider range of scenarios, especially when security and efficiency requirements are high at the same time.

[0004] In response to the shortcomings of the existing technology, we have invented a data encryption method and system based on multi-stage processing, which pays special attention to optimizing the efficiency and security of data classification, key management and encryption execution. By dividing the data encryption process into multiple parallel processing stages, not only the processing speed is improved, but also the flexibility and security of the system are improved through dynamic key management strategies. In addition, the introduction of homomorphic encryption technology allows complex data analysis while maintaining the data encryption state, which is particularly important for business scenarios that need to process sensitive data under the premise of confidentiality. This invention also reduces the misjudgment rate through precise data flow analysis and sensitivity determination, and ensures the security of keys and the immediacy of data processing through a real-time key distribution mechanism. These innovations significantly improve the efficiency and security of data encryption processing and provide a new direction for the application of data encryption technology. Summary of the invention

[0005] In view of the above-mentioned problems, the present invention is proposed.

[0006] Therefore, the technical problem solved by the present invention is: how to improve data processing efficiency while maintaining data security and effectively manage encryption keys.

[0007] In order to solve the above technical problems, the present invention provides the following technical solutions: a data encryption method based on multi-stage processing, which comprises the following steps:

[0008] Determine the stages of multi-stage parallel processing; the stages include a data classification stage, a key management and distribution stage, and an encryption execution stage; the data classification stage analyzes the data and classifies the data into sensitive and non-sensitive blocks; the key management and distribution stage selects corresponding encryption keys according to the sensitivity of the data; the encryption execution stage generates encrypted data according to different encryption keys.

[0009] As a preferred solution of the data encryption method based on multi-stage processing described in the present invention, the data analysis includes using pattern recognition technology to detect specific patterns or structures in the data to determine whether the data belongs to a sensitive category, specifically including defining pattern matching rules based on known sensitive information characteristics, applying pattern matching rules to conduct a preliminary review of the data stream, and when the data to be encrypted meets any rule, it is marked as potentially sensitive and passed to the next stage for further analysis. When the data to be encrypted does not meet the rule, it is non-sensitive data.

[0010] As a preferred solution of the data encryption method based on multi-stage processing described in the present invention, the further analysis includes pre-defining sensitive behavior patterns, using sequence analysis technology to conduct in-depth analysis on data marked as potentially sensitive, checking the element sequence in the data stream, and determining whether there is a pre-defined sensitive behavior pattern. When the pre-defined sensitive behavior pattern exists, the current data is determined to be sensitive data, otherwise it is non-sensitive data.

[0011] The predefined sensitive behavior pattern is that the frequency of occurrence of a sequence to be detected in the data stream exceeds a limit.

[0012] As a preferred solution of the data encryption method based on multi-stage processing described in the present invention, wherein: the selection of the corresponding encryption key includes generating an encryption key, storing the encryption key and distributing the encryption key, wherein before generating the encryption key, it is further confirmed whether non-sensitive data needs to use dynamic encryption technology.

[0013] The criterion for whether to use dynamic encryption technology is that non-sensitive data needs to be subjected to arithmetic or logical operations in an encrypted state.

[0014] Once it is determined to use dynamic encryption technology, select the corresponding homomorphic encryption scheme based on the processing requirements of the encrypted ciphertext.

[0015] The selection of the corresponding homomorphic encryption scheme includes: if the ciphertext generated by the homomorphic encryption technology only requires a single type of operation, including addition or multiplication, then selecting partial homomorphic encryption technology; if the ciphertext generated by the homomorphic encryption technology needs to support a limited number of multiple operations, including a combination of addition and multiplication, then selecting quasi-homomorphic encryption technology; if the ciphertext generated by the homomorphic encryption technology supports an unlimited number of addition and multiplication operations, then selecting full homomorphic encryption technology.

[0016] The generating of the encryption key includes generating a one-time cryptographic key by a random number generator and generating a multiple-time cryptographic key by a pseudo-random number generator when the dynamic encryption technology is not required.

[0017] The stored encryption key includes a one-time pad cryptographic key and a multiple-time pad cryptographic key stored in a key management module.

[0018] The encryption key allocation includes allocating a one-time key in real time based on the real-time classification results of the data. When the data is marked as sensitive, the key management module allocates a one-time key in real time. When the data is marked as non-sensitive and does not require homomorphic encryption, a multiple-time key is allocated. The key management module transmits the corresponding key to the data processing node requesting encryption in real time through the communication protocol.

[0019] The one-time pad cipher key has the same length as the data to be encrypted, and the multi-time pad cipher key length is determined according to an encryption algorithm.

[0020] As a preferred solution of the data encryption method based on multi-stage processing described in the present invention, wherein: the communication protocol includes key transmission through a TLS encrypted channel, using an X.509 certificate to authenticate the key management module and the data processing node mutually, and after authentication, the key management module uses the public key of the data processing node to encapsulate the key, and after the data processing node receives the key, it uses the private key to decapsulate it.

[0021] As a preferred solution of the data encryption method based on multi-stage processing described in the present invention, wherein: the generation of encrypted data according to different encryption keys includes an encryption algorithm represented as:

[0022] C=E K (P)

[0023] Among them, C represents the ciphertext data encrypted by the AES-256 algorithm, P represents the plaintext data, K represents the encryption key with a length of 256 bits, and E represents the encryption function of AES-256.

[0024] The K is expressed as,

[0025] K = PRNG()

[0026] Here, PRNG stands for pseudo-random number generator.

[0027] The homomorphic encryption technology is expressed as:

[0028]

[0029] C′=Compute(C1)

[0030] in, Indicates the use of homomorphic encryption key K HT encryption function, C1 represents the ciphertext generated after homomorphic encryption, C′ represents the ciphertext result calculated by homomorphic encryption technology, and Compute represents the calculation function executed on the ciphertext.

[0031] As a preferred solution of the data encryption method based on multi-stage processing described in the present invention, wherein: the generation of encrypted data according to different encryption keys also includes storing all generated ciphertext data in an encrypted data warehouse for subsequent decryption, the ciphertext of sensitive data allows predefined operations to be performed directly on the ciphertext, the one-time cryptographic key is destroyed from the key management module immediately after use, and the multiple-time cryptographic key is replaced periodically according to the security policy.

[0032] The predefined operations include data analysis and query.

[0033] Another object of the present invention is to provide a data encryption system based on multi-stage processing, which can solve the problems of low encryption efficiency and difficulty in maintaining operational flexibility when processing sensitive data in the prior art by realizing integrated operations of data classification, dynamic key management and homomorphic encryption.

[0034] To solve the above technical problems, the present invention provides the following technical solutions: a data encryption system based on multi-stage processing, including a data classification module, a key management module, a secure communication protocol module and an encryption execution module.

[0035] The data classification module is responsible for analyzing and classifying the data stream.

[0036] The key management module generates and manages keys according to the sensitivity of data.

[0037] The secure communication protocol module is responsible for the security of the key during the transmission process from the key management module to the data processing node.

[0038] The encryption execution module is responsible for encrypting data using the selected key.

[0039] A computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the data encryption method based on multi-stage processing as described above are implemented.

[0040] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of a data encryption method based on multi-stage processing as described above.

[0041] Beneficial effects of the present invention: Our invention greatly improves data processing efficiency by processing multiple stages in parallel, and is suitable for processing large-scale data sets. The dynamic key management strategy enhances the security and flexibility of the system, allowing real-time generation and distribution of keys based on data sensitivity, effectively protecting against various security threats. The integrated homomorphic encryption technology enables encrypted data to directly perform complex operations, expanding the use scenarios of encrypted data while protecting data privacy. In addition, the application of automatic classification technology ensures that sensitive data is specially protected, while non-sensitive data processing is more efficient, making the present invention very suitable for commercial and technical environments that require a high degree of data protection and processing efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0043] Figure 1 An overall flow chart of a data encryption method based on multi-stage processing provided for the first embodiment of the present invention.

[0044] Figure 2 An overall framework diagram of a data encryption system based on multi-stage processing provided for the second embodiment of the present invention. DETAILED DESCRIPTION

[0045] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0046] Example 1

[0047] Reference Figure 1, as an embodiment of the present invention, provides a data encryption method based on multi-stage processing, characterized in that:

[0048] S1: Determine the stage of multi-stage parallel processing.

[0049] The phases include data classification phase, key management and distribution phase, and encryption execution phase.

[0050] S2: The data classification stage analyzes the data and classifies the data into sensitive and non-sensitive blocks.

[0051] Analyzing the data includes using pattern recognition technology to detect specific patterns or structures in the data and determine whether the data belongs to a sensitive category. Specifically, it includes defining pattern matching rules based on known characteristics of sensitive information, applying pattern matching rules to conduct a preliminary review of the data stream, and marking the data to be encrypted as potentially sensitive when it meets any rule and passing it to the next stage for further analysis. When the data to be encrypted does not meet the rules, it is non-sensitive data.

[0052] Further analysis includes pre-defining sensitive behavior patterns, using sequence analysis technology to conduct in-depth analysis of data marked as potentially sensitive, checking the sequence of elements in the data stream, and determining whether there are pre-defined sensitive behavior patterns. When pre-defined sensitive behavior patterns exist, the current data is determined to be sensitive data, otherwise it is non-sensitive data.

[0053] The predefined sensitive behavior pattern is that the frequency of occurrence of a sequence to be detected in the data stream exceeds a limit.

[0054] It is further added that the data classification stage is to analyze the data by using pattern recognition technology to distinguish whether the data is sensitive. This stage uses known sensitive information characteristics to define pattern matching rules and conduct a preliminary review of the data flow. If the data meets the predetermined rules, it is marked as potentially sensitive data. The key advantage of this step is that it can quickly and accurately identify the information that needs to be protected, thereby achieving priority management during data processing, improving processing efficiency and reducing risks.

[0055] S3: In the key management and distribution stage, the corresponding encryption key is selected according to the sensitivity of the data.

[0056] Selecting the corresponding encryption key includes generating the encryption key, storing the encryption key and distributing the encryption key, wherein before generating the encryption key, it is further confirmed whether the non-sensitive data needs to use the dynamic encryption technology.

[0057] The criterion for whether dynamic encryption technology needs to be used is that non-sensitive data needs to be subjected to arithmetic or logical operations in an encrypted state.

[0058] Once it is determined to use dynamic encryption technology, select the corresponding homomorphic encryption scheme based on the processing requirements of the encrypted ciphertext.

[0059] Selecting the corresponding homomorphic encryption scheme includes: if the ciphertext generated by the homomorphic encryption technology only requires a single type of operation, including addition or multiplication, then select partial homomorphic encryption technology; if the ciphertext generated by the homomorphic encryption technology needs to support a limited number of multiple operations, including a combination of addition and multiplication, then select quasi-homomorphic encryption technology; if the ciphertext generated by the homomorphic encryption technology supports an unlimited number of addition and multiplication operations, then select full homomorphic encryption technology.

[0060] Generating encryption keys includes generating a one-time cryptographic key through a random number generator and generating a multiple-time cryptographic key through a pseudo-random number generator when dynamic encryption technology is not required.

[0061] The stored encryption keys include a one-time pad cryptographic key and a multiple-time pad cryptographic key stored in a key management module.

[0062] The allocation of encryption keys includes allocating a one-time key in real time based on the real-time classification results of the data. When the data is marked as sensitive, the key management module allocates a one-time key in real time. When the data is marked as non-sensitive and does not require homomorphic encryption, a multiple-time key is allocated. The key management module transmits the corresponding key to the data processing node requesting encryption in real time through the communication protocol.

[0063] The one-time pad cipher key has the same length as the data to be encrypted, and the multi-time pad cipher key length is determined according to the encryption algorithm.

[0064] The communication protocol includes key transmission through the TLS encrypted channel, using X.509 certificates to authenticate the key management module and the data processing node. After authentication, the key management module uses the public key of the data processing node to encapsulate the key. After the data processing node receives the key, it uses the private key to unseal it.

[0065] Entering the key management and distribution phase, encryption keys are selected based on the sensitivity of the data, which involves the process of generating, storing, and distributing keys. In particular, sensitive data will be assigned a one-time pad key, while non-sensitive data will use a reusable key strategy. This design can ensure the timely update and distribution of encryption keys through a real-time key management module, greatly improving data security.

[0066] S4: The encryption execution phase generates encrypted data according to different encryption keys.

[0067] Generating encrypted data according to different encryption keys includes encryption algorithms represented as:

[0068] C=EK (P)

[0069] Among them, C represents the ciphertext data encrypted by the AES-256 algorithm, P represents the plaintext data, K represents the encryption key with a length of 256 bits, and E represents the encryption function of AES-256.

[0070] K is represented by

[0071] K = PRNG()

[0072] Here, PRNG stands for pseudo-random number generator.

[0073] Homomorphic encryption technology is expressed as,

[0074]

[0075] C′=Compute(C1)

[0076] in, Indicates the use of homomorphic encryption key K HT encryption function, C1 represents the ciphertext generated after homomorphic encryption, C′ represents the ciphertext result calculated by homomorphic encryption technology, and Compute represents the calculation function executed on the ciphertext.

[0077] Furthermore, the encryption execution phase encrypts data according to the selected key type, using different encryption algorithms such as AES-256 to ensure data security. If it is necessary to support calculations in an encrypted state, select a suitable homomorphic encryption scheme based on data processing requirements, such as partial homomorphic encryption, quasi-homomorphic encryption, or fully homomorphic encryption technology. This allows encrypted data to be directly used for some calculation operations, such as addition or multiplication, without decryption, thereby protecting the privacy of the data without losing operational flexibility.

[0078] Generating encrypted data according to different encryption keys also includes storing all generated ciphertext data in the encrypted data warehouse for subsequent decryption. The ciphertext of sensitive data allows predefined operations to be performed directly on the ciphertext. The one-time password key is destroyed from the key management module immediately after use, and the multiple-time password key is replaced regularly according to the security policy.

[0079] The predefined operations include data analysis and query.

[0080] Example 2

[0081] Reference Figure 2 , as an embodiment of the present invention, provides a system for a data encryption method based on multi-stage processing, a data encryption system based on multi-stage processing includes a data classification module, a key management module, a secure communication protocol module and an encryption execution module.

[0082] The data classification module is responsible for analyzing and classifying data streams.

[0083] The key management module generates and manages keys based on the sensitivity of the data.

[0084] The secure communication protocol module is responsible for the security of the key during the transmission from the key management module to the data processing node.

[0085] The encryption execution module is responsible for encrypting the data using the selected key.

[0086] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program code.

[0087] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0088] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0089] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0090] Example 3

[0091] In this embodiment, in order to verify the beneficial effects of the present invention, scientific demonstration is carried out through economic benefit calculation and simulation experiments. Traditional data encryption methods usually adopt a unified encryption strategy, using the same encryption algorithm and key management scheme for all data. Although this method is simple, it has obvious limitations when facing large amounts of data and high security requirements.

[0092] This paper designs theoretical experiments to compare the performance of this method with traditional encryption methods in different aspects. The experimental data is obtained by simulating scenarios with different data volumes, different sensitive data ratios, and different computing tasks. The specific comparison indicators include:

[0093] Encryption time: The time required to process the same amount of data.

[0094] Computational efficiency: How efficiently computational tasks are performed on encrypted data.

[0095] The following is a table of experimental data. By comparing the performance of this method with that of traditional methods, the effectiveness and superiority of this method are demonstrated, as shown in Table 1.

[0096] Table 1 Experimental effect comparison chart

[0097]

[0098] In summary, it can be seen from the table that the encryption time of this method is significantly lower than that of the traditional method when processing the same amount of data. This is because this method classifies data and adopts different encryption strategies for sensitive data and non-sensitive data, reducing unnecessary computing overhead.

[0099] When performing computing tasks on encrypted data, the efficiency of this method is significantly higher than that of traditional methods. This is because this method flexibly selects encryption algorithms, especially using dynamic encryption technology for non-sensitive data, which improves computing efficiency.

[0100] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A data encryption method based on multi-stage parallel processing, characterized in that: include: Determine the stage of multi-stage parallel processing; Said phases include a data classification phase, a key management and distribution phase, and an encryption execution phase; The data classification phase analyzes the data and classifies it into sensitive and non-sensitive blocks; In the key management and distribution phase, the corresponding encryption key is selected according to the sensitivity of the data; The encryption execution phase generates encrypted data based on different encryption keys.

2. A data encryption method based on multi-stage processing as claimed in claim 1, characterized in that: The analysis of the data includes using pattern recognition technology to detect specific patterns or structures in the data to determine whether the data belongs to a sensitive category. Specifically, it includes defining pattern matching rules based on known characteristics of sensitive information, applying pattern matching rules to conduct a preliminary review of the data stream, and when the data to be encrypted meets any rule, it is marked as potentially sensitive and passed to the next stage for further analysis. When the data to be encrypted does not meet the rules, it is non-sensitive data.

3. A data encryption method based on multi-stage processing as claimed in claim 2, characterized in that: The further analysis includes pre-defining sensitive behavior patterns, using sequence analysis technology to conduct in-depth analysis on data marked as potentially sensitive, checking the element sequence in the data stream, and determining whether there is a pre-defined sensitive behavior pattern. If there is a pre-defined sensitive behavior pattern, the current data is determined to be sensitive data, otherwise it is non-sensitive data; The predefined sensitive behavior pattern is that the frequency of occurrence of a sequence to be detected in the data stream exceeds a limit.

4. A data encryption method based on multi-stage processing as claimed in claim 3, characterized in that: The selecting of the corresponding encryption key includes generating the encryption key, storing the encryption key and distributing the encryption key, wherein before generating the encryption key, it is further confirmed whether the non-sensitive data needs to use the dynamic encryption technology; The criterion for whether dynamic encryption technology needs to be used is that non-sensitive data needs to be subjected to arithmetic or logical operations in an encrypted state; When dynamic encryption technology is used, the corresponding homomorphic encryption scheme is selected according to the processing requirements of the encrypted ciphertext; The selection of the corresponding homomorphic encryption scheme includes: if the ciphertext generated by the homomorphic encryption technology only requires a single type of operation, including addition or multiplication, then selecting partial homomorphic encryption technology; if the ciphertext generated by the homomorphic encryption technology needs to support a limited number of multiple operations, including a combination of addition and multiplication, then selecting quasi-homomorphic encryption technology; if the ciphertext generated by the homomorphic encryption technology supports an unlimited number of addition and multiplication operations, then selecting full homomorphic encryption technology. Generating the encryption key includes generating a one-time cryptographic key by a random number generator and generating a multiple-time cryptographic key by a pseudo-random number generator when dynamic encryption technology is not required; The stored encryption keys include one-time password keys and multiple-time password keys stored in a key management module; The encryption key allocation includes, according to the instant classification result of the data, when the data is marked as sensitive, the key management module allocates a one-time key in real time, and when the data is marked as non-sensitive and does not need to be homomorphically encrypted, allocates a multiple-time key, and the key management module transmits the corresponding key to the data processing node requesting encryption in real time through the communication protocol; The one-time pad cipher key has the same length as the data to be encrypted, and the multi-time pad cipher key length is determined according to an encryption algorithm.

5. A data encryption method based on multi-stage processing as claimed in claim 4, characterized in that: The communication protocol includes key transmission through a TLS encrypted channel, using X.509 certificates to authenticate the key management module and the data processing node. After authentication, the key management module uses the public key of the data processing node to encapsulate the key, and after the data processing node receives the key, it uses the private key to unseal it.

6. A data encryption method based on multi-stage processing as claimed in claim 5, characterized in that: The generating of encrypted data according to different encryption keys includes an encryption algorithm represented as: C=E K (P) Where C represents the ciphertext data encrypted by the AES-256 algorithm, P represents the plaintext data, K represents the encryption key with a length of 256 bits, and E represents the encryption function of AES-256; The K is expressed as, K = PRNG() Among them, PRNG means pseudo-random number generator; The homomorphic encryption technology is expressed as: C′=Compute(C1) in, Indicates the use of homomorphic encryption key K HT encryption function, C1 represents the ciphertext generated after homomorphic encryption, C′ represents the ciphertext result calculated by homomorphic encryption technology, and Compute represents the calculation function executed on the ciphertext.

7. A data encryption method based on multi-stage processing as claimed in claim 6, characterized in that: Generating encrypted data according to different encryption keys also includes storing all generated ciphertext data in an encrypted data warehouse for subsequent decryption, allowing predefined operations to be performed directly on the ciphertext of sensitive data, destroying the one-time cipher key from the key management module immediately after use, and replacing the multiple-time cipher key regularly according to the security policy; The predefined operations include data analysis and query.

8. A system using a data encryption method based on multi-stage processing as claimed in any one of claims 1 to 7, characterized in that: It includes a data classification module, a key management module, a secure communication protocol module and an encryption execution module; The data classification module is responsible for analyzing and classifying the data stream; The key management module generates and manages keys according to the sensitivity of the data; The secure communication protocol module is responsible for the security of the key during the transmission process from the key management module to the data processing node; The encryption execution module is responsible for encrypting data using the selected key.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of a data encryption method based on multi-stage processing as described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of a data encryption method based on multi-stage processing as described in any one of claims 1 to 7 are implemented.

Images