Data encryption method and device, equipment, storage medium and product

Abstract

The invention relates to the technical field of computers, and particularly provides a data encryption method and device, equipment, a storage medium and a product, and the method comprises the steps: responding to a data encryption request triggered by a user, and collecting to-be-authenticated information of the user; security verification processing is carried out on the to-be-authenticated information, a security authentication result corresponding to the to-be-authenticated information is obtained, and the security authentication result is that security authentication passes or does not pass; under the condition that the security authentication result is that the security authentication is passed, acquiring a target secret key of the user with the use permission; according to the target secret key, performing encryption processing on a to-be-encrypted data stream of the user to obtain an encrypted ciphertext; and sending the encrypted ciphertext to a cloud server. According to the technical scheme, the security of data encryption is improved.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a data encryption method, device, equipment, storage medium and product. Background Art

[0002] In cloud storage systems, data encryption technology has been widely used to protect the privacy and security of user data during transmission and storage. Currently, the more common data encryption technology is generally through software encryption. For example, encryption algorithms such as AES and RSA are used to encrypt the data that users need to upload to the cloud.

[0003] However, current encryption algorithms are generally common to all users. The more widely an encryption algorithm is used, the worse its security is. The encrypted data is extremely easy to crack, and the data security is low. Summary of the invention

[0004] In view of the above problems, the present disclosure is proposed. The present disclosure provides a data encryption method, device, equipment, storage medium and product.

[0005] According to one aspect of the present disclosure, a data encryption method is provided, which is applied to a programmable user device, and the method includes:

[0006] In response to a data encryption request triggered by a user, collecting the user's information to be authenticated;

[0007] Performing security verification processing on the information to be authenticated to obtain a security authentication result corresponding to the information to be authenticated, wherein the security authentication result is security authentication passed or security authentication failed;

[0008] If the security authentication result is that the security authentication is passed, obtaining a target key that the user has permission to use;

[0009] According to the target secret key, encrypt the user's data stream to be encrypted to obtain an encrypted ciphertext;

[0010] The encrypted ciphertext is sent to the cloud server.

[0011] According to one or more embodiments of the present disclosure, the information to be authenticated includes the biometric features of the user, and the step of performing security verification processing on the information to be authenticated to obtain a security authentication result corresponding to the information to be authenticated includes:

[0012] According to a preset biometric algorithm, the user's biometric features are authenticated to obtain a security authentication result of the user.

[0013] According to one or more embodiments of the present disclosure, when the security authentication result is that the security authentication is passed, obtaining the target key that the user has permission to use includes:

[0014] If the security authentication result is that the security authentication is passed, enabling the user's access rights to the storage component of the user device;

[0015] The target key is read from the storage component.

[0016] According to one or more embodiments of the present disclosure, the target key includes multiple sub-keys, and the multiple sub-keys are respectively stored in multiple storage components of the user device. The step of obtaining the target key that the user has permission to use includes:

[0017] Obtain storage components corresponding to multiple subkeys of the target key that the user has permission to use, so as to read the multiple subkeys from each storage component;

[0018] The multiple sub-keys are subjected to key recovery processing to obtain the target key.

[0019] According to one or more embodiments of the present disclosure, the method further includes:

[0020] Splitting the target secret key of the user into the multiple sub-secret keys by a secret sharing algorithm;

[0021] Storing the plurality of sub-keys in the plurality of storage components;

[0022] The performing key restoration processing on the multiple sub-keys to obtain the target key includes:

[0023] The multiple sub-keys are subjected to key reorganization calculation by Lagrange interpolation algorithm to obtain the target key.

[0024] According to one or more embodiments of the present disclosure, encrypting the user's to-be-encrypted data stream according to the target key to obtain an encrypted ciphertext includes:

[0025] Determine an algorithm library in an encryption engine of the user equipment, the algorithm library including at least one encryption algorithm;

[0026] Determining a target encryption algorithm for the user from the at least one encryption algorithm;

[0027] The user's data stream to be encrypted is encrypted according to the target encryption algorithm and the target secret key to obtain the encrypted ciphertext.

[0028] According to one or more embodiments of the present disclosure, determining the target encryption algorithm of the user from the at least one encryption algorithm includes:

[0029] Collecting the encryption environment information of the user;

[0030] Determining the encryption level required by the user according to the encryption environment information;

[0031] Inputting the encryption level into a dynamic scheduler in the encryption engine, the dynamic scheduler being used to schedule a target encryption algorithm corresponding to the encryption level from the at least one encryption algorithm;

[0032] Obtain the target encryption algorithm output by the dynamic scheduler.

[0033] According to one or more embodiments of the present disclosure, the to-be-encrypted data stream includes a plurality of data streams, and the encrypting the to-be-encrypted data stream of the user according to the target encryption algorithm and the target key to obtain the encrypted ciphertext includes:

[0034] determining an encryption processor of the user device;

[0035] Inputting the target encryption algorithm, the target key, and the plurality of data streams to be encrypted into the encryption processor, the encryption processor being used to perform encryption processing on the plurality of data streams to be encrypted in parallel using the target encryption algorithm and the target key;

[0036] The encrypted ciphertext is obtained by the encryption processor performing parallel encryption processing on the plurality of data streams to be encrypted.

[0037] According to one or more embodiments of the present disclosure, the present invention further includes:

[0038] In response to an algorithm selection operation on at least one encryption algorithm of an algorithm library in the encryption engine, determining a first encryption algorithm corresponding to the algorithm selection operation;

[0039] In response to a trigger operation performed on the first encryption algorithm, an operation result of the first encryption algorithm is obtained, where the trigger operation includes a modification operation or a deletion operation.

[0040] According to one or more embodiments of the present disclosure, the present invention further includes:

[0041] In response to an algorithm addition operation performed on an algorithm library in the encryption engine, obtaining a second encryption algorithm corresponding to the algorithm addition operation;

[0042] Add the second encryption algorithm to the algorithm library.

[0043] According to one or more embodiments of the present disclosure, the user device stores multiple secret keys of the user, and the method further includes:

[0044] detecting a current target power consumption level of the user equipment;

[0045] The step of obtaining the target key that the user has permission to use includes:

[0046] Selecting a target key matching the target power consumption level from a plurality of keys of the user stored in the user device;

[0047] The step of determining a target encryption algorithm of the user from the at least one encryption algorithm comprises:

[0048] A target encryption algorithm matching the target power consumption level is selected from the at least one encryption algorithm.

[0049] According to one or more embodiments of the present disclosure, the power consumption level of the user device is inversely proportional to the encryption strength of each key, and the power consumption level of the user device is inversely proportional to the computational complexity of each encryption algorithm.

[0050] According to one or more embodiments of the present disclosure, the present invention further includes:

[0051] Calculate the encryption load required for the encryption module of the user equipment to perform encryption calculation using the target secret key and the target encryption algorithm;

[0052] According to the encryption load required by the encryption module, the power resources of the user device are dynamically scheduled to obtain the target power resources of the encryption module. The target power resources are used by the encryption module to encrypt the user's data stream to be encrypted using the target encryption algorithm and the target key to obtain the encrypted ciphertext.

[0053] According to one or more embodiments of the present disclosure, the calculating the encryption module of the user device performing the encryption load required for the encryption calculation by using the target key and the target encryption algorithm includes:

[0054] Determining a first power consumption parameter corresponding to when the user equipment performs security verification processing on the information to be authenticated;

[0055] Determining a second power consumption parameter required for the user equipment to perform encryption calculation using the target encryption algorithm and the target key;

[0056] Determining a third power consumption parameter required by the user equipment when encrypting the data stream to be encrypted;

[0057] The first power consumption parameter, the second power consumption parameter and the third power consumption parameter are added together to obtain an encryption load required by an encryption module of the user equipment.

[0058] According to one or more embodiments of the present disclosure, the dynamically scheduling the power resources of the user equipment according to the encryption load required by the encryption module includes:

[0059] Determining the encryption weight required by the encryption module according to the encryption load required by the encryption module;

[0060] The target power resources allocated by the user equipment to the encryption module are calculated according to the encryption weight and weights of other modules of the user equipment.

[0061] According to one or more embodiments of the present disclosure, the dynamically scheduling the power resources of the user equipment according to the encryption load required by the encryption module includes:

[0062] Calculating a voltage change of the encryption module according to the encryption load, the maximum encryption load of the user equipment, and a preset voltage adjustment range;

[0063] The voltage change is added to a preset basic operating voltage of the encryption module to obtain a target operating voltage of the encryption module.

[0064] According to one or more embodiments of the present disclosure, the present invention further includes:

[0065] Generate a secret key of the user based on a quantum random number generation algorithm;

[0066] The user's secret key is stored in a storage component of the user's device.

[0067] According to one or more embodiments of the present disclosure, generating the user's secret key based on a quantum random number generation algorithm includes:

[0068] Generate quantum random numbers based on a preset quantum random number generator;

[0069] Obtaining the user's secret key information;

[0070] The quantum random number and the secret key information are hashed to obtain the secret key of the user.

[0071] According to one or more embodiments of the present disclosure, the programmable user equipment is a user equipment based on a field programmable gate array (FPGA).

[0072] According to another aspect of the present disclosure, a data encryption device is provided, which is applied to a programmable user device, and the device includes:

[0073] A request response unit, configured to respond to a data encryption request triggered by a user and collect the user's information to be authenticated;

[0074] A security verification unit, used to perform security verification processing on the information to be authenticated, and obtain a security authentication result corresponding to the information to be authenticated, wherein the security authentication result is security authentication passed or security authentication failed;

[0075] A key acquisition unit, used for acquiring a target key that the user has permission to use if the security authentication result is that the security authentication is passed;

[0076] An encryption calculation unit, used to encrypt the user's to-be-encrypted data stream according to the target secret key to obtain an encrypted ciphertext;

[0077] The ciphertext sending unit is used to send the encrypted ciphertext to the cloud server.

[0078] According to another aspect of the present disclosure, a programmable user device is provided, comprising a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of any data encryption method.

[0079] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program / instruction is stored. When the computer program / instruction is executed by a processor, the steps of any data encryption method are implemented.

[0080] According to another aspect of the present disclosure, a computer program product is provided, comprising a computer program / instruction, which implements the steps of any data encryption method when executed by a processor.

[0081] As will be described in detail below, according to the data encryption method of the embodiment of the present disclosure, a programmable user device can respond to a data encryption request triggered by a user and collect the user's information to be authenticated. By performing security verification processing on the information to be authenticated, a security authentication result corresponding to the information to be authenticated can be obtained. The security authentication result is security authentication passed or security authentication failed. In the case where the security authentication result is security authentication passed, the target key that the user has permission to use can be obtained. Before obtaining the key, the user's identity needs to be securely authenticated to achieve strict use control of the key. Only users who have passed the security authentication can use the target key, thereby improving the security of key management, avoiding the possibility of key abuse at the software level, and improving the security of the data encryption process.

[0082] It is to be understood that both the foregoing general description and the following detailed description are exemplary, and are intended to provide further explanation of the technology as claimed. BRIEF DESCRIPTION OF THE DRAWINGS

[0083] The above and other purposes, features and advantages of the present disclosure will become more apparent by describing the embodiments of the present disclosure in more detail in conjunction with the accompanying drawings. The accompanying drawings are used to provide a further understanding of the embodiments of the present disclosure and constitute a part of the specification. Together with the embodiments of the present disclosure, they are used to explain the present disclosure and do not constitute a limitation of the present disclosure. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0084] Figure 1 is a flow chart illustrating a data encryption method according to an embodiment of the present disclosure;

[0085] Figure 2 is an example diagram illustrating a security authentication according to an embodiment of the present disclosure;

[0086] Figure 3 is an example diagram illustrating a key storage according to an embodiment of the present disclosure;

[0087] Figure 4 is a flow chart further illustrating a data encryption method according to an embodiment of the present disclosure;

[0088] Figure 5 is a block diagram illustrating a data encryption device according to an embodiment of the present disclosure;

[0089] Figure 6 is a hardware block diagram illustrating a programmable user device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0090] In order to make the purpose, technical solution and advantages of the present disclosure more obvious, the exemplary embodiments according to the present disclosure will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all the embodiments of the present disclosure, and it should be understood that the present disclosure is not limited to the exemplary embodiments described here.

[0091] The technical solution disclosed in the present invention can be applied in computer scenarios. By first performing security authentication on a programmable user device and then obtaining a target key that the user has permission to use, strict control over the use of the key can be achieved. Only users who have passed security authentication can use the target key, thereby improving the security of key management, avoiding the possibility of key abuse at the software level, and improving the security of the data encryption process.

[0092] Figure 1A flowchart of a data encryption method provided in an embodiment of the present application, the data encryption method can be applied to a programmable user device, and the data encryption method may include the following steps:

[0093] S101 . In response to a data encryption request triggered by a user, collect the user's information to be authenticated.

[0094] Optionally, the execution subject of the present disclosure may be a programmable user equipment. The programmable user equipment may be a user equipment based on a field programmable gate array (FPGA).

[0095] The programmable user device can display a data encryption page, which can provide corresponding data encryption controls, detect the triggering operation performed by the user on the data encryption control, and determine the data encryption request other than the triggering user.

[0096] The user's information to be authenticated may refer to relevant information used for user identity authentication, such as the user's biometrics and the user's login information. For example, the user's login information may refer to the user's account number and password.

[0097] Exemplarily, an input control for user login information may be provided in the data encryption page, and the login information input by the user may be obtained by detecting an input operation performed by the user on the input control.

[0098] S102, performing security verification processing on the information to be authenticated, and obtaining a security authentication result corresponding to the information to be authenticated, the security authentication result being security authentication passed or security authentication failed.

[0099] Optionally, performing security verification processing on the information to be authenticated and obtaining the security authentication result of the information to be authenticated may include performing security verification processing on the user's login information to obtain the security authentication result of the information to be authenticated. Specifically, the user's login information is compared with the locally stored login information, and if the security authentication result provided by the user is correct.

[0100] The security authentication result is security authentication passed or security authentication failed. Exemplarily, the security authentication result can be represented by a 1-bit parameter, where if the parameter value is 1 or True, it means that the security authentication passed, and if the parameter value is 0 or False, it means that the security authentication failed.

[0101] S103. When the security authentication result is that the security authentication is passed, obtain a target key that the user has permission to use.

[0102] Optionally, obtaining the target key that the user has permission to use may include: obtaining the target key pre-associated with user information of the user. The user information of the user may be, for example, user identification, user number, user name, and other information.

[0103] It should be noted that the user information involved in this disclosure is all relevant information authorized by the user and does not involve user privacy information, which complies with relevant national laws and regulations.

[0104] Optionally, the user device may pre-store a target key that the user has permission to use, and establish an association relationship between the user information and the target key.

[0105] S104: Encrypt the user's data stream to be encrypted according to the target secret key to obtain an encrypted ciphertext.

[0106] Optionally, before S104, the process may further include receiving a data stream to be encrypted to execute S104.

[0107] Specifically, the user device to be encrypted can establish a communication connection with the electronic device, the data stream that the user needs to upload to the cloud can be stored in the electronic device, and the electronic device can send the data stream that needs to be uploaded to the cloud to the user device under the user's operation.

[0108] Optionally, after the user device encrypts the data stream to be encrypted, the encrypted ciphertext may be uploaded to the cloud server. For example, the user device may display a transmission program of the cloud server, such as a cloud service program, and send the encrypted ciphertext to the cloud server through the operation of the transmission program.

[0109] Optionally, the electronic device may also receive the encrypted ciphertext sent by the user device, and the electronic device may send the encrypted ciphertext to the cloud server. For example, the electronic device may also display a transmission program of the cloud server, such as a cloud service program, and send the encrypted ciphertext to the cloud server through the transmission program.

[0110] S105: Send the encrypted ciphertext to the cloud server.

[0111] Optionally, sending the encrypted ciphertext to the cloud server may include sending the encrypted ciphertext to the cloud server when the connection with the cloud server is successful.

[0112] Optionally, when the encrypted ciphertext includes multiple encrypted ciphertexts, sending the encrypted ciphertext to the cloud server may include: sending multiple encrypted ciphertexts to the cloud server.

[0113] In the technical solution of the present disclosure, a programmable user device can collect the user's information to be authenticated in response to a data encryption request triggered by the user. By performing security verification processing on the information to be authenticated, a security authentication result corresponding to the information to be authenticated can be obtained. The security authentication result is security authentication passed or security authentication failed. In the case where the security authentication result is security authentication passed, the target key that the user has permission to use can be obtained. Before obtaining the key, the user's identity needs to be securely authenticated to achieve strict use control of the key. Only users who have passed the security authentication can use the target key, thereby improving the security of key management, avoiding the possibility of key abuse at the software level, and improving the security of the data encryption process.

[0114] In a possible design, the information to be authenticated may include the user's biometrics. Step 102 may include:

[0115] According to the preset biometric algorithm, the user's biometric features are authenticated to obtain the user's security authentication result.

[0116] For ease of understanding, Figure 2 An example diagram of a security authentication is shown. Figure 2 As shown, the programmable user device may include a biometric module 201, and the biometric module 201 may be configured with a feature collection device, which may collect the user's biometric features. The programmable user device may also include an identity authentication module 202, and the identity authentication module 202 may be pre-configured with a biometric algorithm, and the biometric module 201 may input the collected biometric features into the identity authentication module 202. The identity authentication module 202 may use the biometric algorithm to authenticate the user's biometric features and obtain a security authentication result of the user.

[0117] Optionally, according to a preset biometric algorithm, the user's biometric characteristics are authenticated to obtain the user's security authentication result, which may include: obtaining the user's feature template, matching the user's biometric characteristics with the feature template, and if the match is successful, determining that the security authentication is passed as the security authentication result; if the match is recognized, determining that the security authentication fails as the security authentication result.

[0118] Exemplarily, the formula of the biometric algorithm is as follows:

[0119] P acess =Match(B user , B template )

[0120] Among them, P acess is the security authentication result, B user is the user's biometric feature, B template is a feature template.

[0121] In the data encryption method provided in the embodiment of the present disclosure, biometric identification is used to securely authenticate the identity of the user, ensuring that only users who have passed biometric identity authentication can access and use the key, further improving the security of key management.

[0122] In another possible design, when the security authentication result is that the security authentication is passed, obtaining the target key that the user has permission to use includes:

[0123] If the security authentication result is that the security authentication is passed, the user is enabled with access rights to the storage component of the user device;

[0124] Read the target key from the storage component.

[0125] In another possible design, when the security authentication result is that the security authentication fails, a prompt message indicating that the authentication is abnormal is output, and the data encryption process is terminated.

[0126] For ease of understanding, Figure 2 In the embodiment, the programmable user device may further include: an access control unit 203, which, when the identity authentication module 202 determines that the security authentication result is a security authentication pass, enables the user's access rights to the storage component of the user device, and then implements the access control of the key through the key access control module 204.

[0127] Exemplarily, the formula for obtaining the target key is as follows:

[0128]

[0129] Among them, A key is the target key, K is the decryption key, and 0 means that the security authentication fails.

[0130] Optionally, enabling the user's access rights to the storage component may refer to turning on an access switch of the access component. For example, a physical switch may be set for the storage component. When the security authentication result is that the security authentication is passed, the physical switch of the storage component may be turned on, thereby enabling the user's access rights to the storage component of the user device.

[0131] For example, a normal value or abnormal value of the access parameter can also be set for the storage component. If the security authentication result is that the security authentication is passed, the value of the access parameter can be set to a normal value, and if it is detected that the access parameter is a normal value, the user's access right to the storage component of the user device is enabled.

[0132] In the technical solution disclosed in the present invention, when the user security authentication is passed, the user's access rights to the storage component are activated from the hardware, and strict access control of the secret key is implemented from the hardware, which effectively prevents the secret key leakage that may occur directly from the software level and improves the access security of the secret key.

[0133] The target key may be distributedly stored in multiple storage components of the user device. As an embodiment, the method further includes:

[0134] Through the secret sharing algorithm, the user's target secret key is divided into multiple sub-secret keys;

[0135] Storing multiple sub-keys in multiple storage components;

[0136] Perform key recovery on multiple sub-keys to obtain the target key, including:

[0137] Through the Lagrange interpolation algorithm, multiple sub-keys are reorganized and calculated to obtain the target key.

[0138] Figure 3 An example diagram of key storage is shown. For example, the target key can be divided into sub-key 1, sub-key 2 and sub-key 3, where sub-key 1 is stored in, sub-key 2 is stored in storage component b, and sub-key 3 can be stored in storage component c.

[0139] The secret sharing algorithm may be, for example, Shamir's secret sharing algorithm.

[0140] Optionally, a Lagrange interpolation algorithm is used to perform key reorganization calculation on multiple sub-keys to obtain a target key, which may include: multiplying each sub-key with the Lagrange difference of each sub-key to obtain the first data of each sub-key, and concatenating or adding the first data of each sub-key to obtain the target key.

[0141] Through the Langrange interpolation algorithm, multiple sub-keys are recombined and the calculation formula for the target is obtained as follows:

[0142]

[0143] Among them, S is the target secret key, S i is the ith sub-key, L i (x) is the i-th Lagrange interpolation polynomial.

[0144] Optionally, the storage component may refer to a component in the user device for storing data, such as a memory, a hard disk, a processor, a disk, etc. The multiple storage components of the user device may include multiple memories, hard disks, storage devices, and disks.

[0145] In a possible design, a storage component can store one or more sub-keys. For security reasons, a storage component can also store only one sub-key.

[0146] Of course, the user device can record the storage association between each sub-key and the storage component where it is located, so that the user device can query the stored sub-keys from each storage component according to the storage association between the sub-key and the storage component, and then obtain multiple sub-keys.

[0147] Furthermore, after obtaining multiple sub-keys from multiple storage components, the key integrity of the multiple sub-keys can also be checked, such as the number of sub-keys stored in the user device. If the number of multiple sub-keys read is the same as the number of stored sub-keys, the reading is determined to be successful, and subsequent key restoration processing can be performed; if the number of multiple sub-keys read is different from the number of stored sub-keys, the reading is determined to have failed, and the multiple sub-keys need to be re-read.

[0148] In addition, if multiple reads fail, that is, the number of read failures exceeds a preset threshold, a prompt message indicating that the key reading is abnormal can be output, and the data encryption process is terminated.

[0149] In the disclosed embodiment, the user's target secret key is divided into multiple sub-secret keys through a password sharing algorithm, and the multiple sub-secret keys are stored in multiple storage components. By storing each fragment independently, the security of the secret key is enhanced. Even if an attacker obtains part of the sub-secret key, he cannot crack the entire secret key, which greatly reduces the success rate of the attack.

[0150] In order to use the target key normally, it is necessary to first read multiple sub-keys of the target key from multiple storage components, and then restore the multiple sub-keys to obtain the target key. Therefore, as another embodiment, the target key includes multiple sub-keys, and the multiple sub-keys are respectively stored in multiple storage components of the user's device. Obtaining the target key that the user has permission to use includes:

[0151] Obtain storage components corresponding to multiple subkeys of a target key that the user has permission to use, so as to read multiple subkeys from each storage component;

[0152] Perform key recovery on multiple sub-keys to obtain the target key.

[0153] Optionally, performing key restoration processing on multiple sub-keys to obtain a target key may include: performing key reorganization on multiple sub-keys to obtain the target key.

[0154] Optionally, during the key restoration process of multiple sub-keys, the key restoration time can be calculated and displayed.

[0155] Furthermore, calculating the key restoration time may include: determining the time for obtaining multiple sub-keys and the reorganization calculation time, adding the time for obtaining the multiple sub-keys and the reorganization calculation time to obtain the key restoration time.

[0156] The calculation formula for key restoration time is as follows:

[0157]

[0158] Among them, T reconstruction is the key recovery time, T i，fetch The time to obtain the i-th sub-key, T compute Calculate the time for the reorganization.

[0159] In the embodiment of the present disclosure, multiple sub-keys of the target key are distributed and stored in multiple storage components. When restoring the key, it is necessary to first read multiple sub-keys from each storage component, and then perform key restoration on the multiple sub-keys to obtain the target key. By collecting the sub-keys and restoring the keys, the user device can access and reorganize the keys, thereby improving the security of key access.

[0160] As an embodiment, according to the target secret key, the user's to-be-encrypted data stream is encrypted to obtain the encrypted ciphertext, including:

[0161] Determine an algorithm library in an encryption engine of a user device, the algorithm library including at least one encryption algorithm;

[0162] determining a target encryption algorithm for a user from at least one encryption algorithm;

[0163] According to the target encryption algorithm and target secret key, the user's data stream to be encrypted is encrypted to obtain the encrypted ciphertext.

[0164] Optionally, the algorithm library may include at least one of the following encryption algorithms: AES (Advanced Encryption Standard), ChaCha20 (ChaCha 20), RSA (Rivest-Shamir-Adleman algorithm, asymmetric encryption algorithm), ECC (Error Checking and Correcting, elliptic curve encryption), DSA (Digital Signature Algorithm, digital signature algorithm), DES (Data Encryption Standard, data encryption standard), etc. In this embodiment, the number and types of encryption algorithms are not excessively limited.

[0165] In the embodiment of the present disclosure, an encryption engine is added to the user device, and at least one encryption algorithm in the algorithm library is scheduled by the encryption engine to obtain a target encryption algorithm, so that the user device can dynamically schedule each encryption algorithm through the encryption engine, so that different security requirements can be applied during the encryption process, and different security threats can be responded to quickly, thereby improving the encryption effect.

[0166] In one possible design, determining a target encryption algorithm of a user from at least one encryption algorithm includes:

[0167] Collect the user's encrypted environment information;

[0168] Determine the encryption level required by the user based on the encryption environment information;

[0169] Inputting the encryption level into a dynamic scheduler in the encryption engine, the dynamic scheduler being used to schedule a target encryption algorithm corresponding to the encryption level from at least one encryption algorithm;

[0170] Get the target encryption algorithm output by the dynamic scheduler.

[0171] Optionally, the encryption environment information may refer to, for example, relevant information of the network environment in which the user is located, such as network type, network status information, location of user equipment, accessed cell or base station, and the like.

[0172] Optionally, determining the encryption level required by the user according to the encryption environment information may include: obtaining an association relationship between preset environment information and encryption levels, querying the encryption level associated with the encryption environment information in the association relationship, and obtaining the encryption level required by the user.

[0173] Optionally, the dynamic scheduler can be a trained machine learning model that can schedule at least one encryption algorithm in the algorithm library according to the input encryption level and output a corresponding target encryption algorithm.

[0174] Exemplarily, the scheduling formula of the dynamic scheduler is as follows:

[0175] A selected =SelectAlgorithm(T threat , D type )

[0176] Among them, A selected is the selected encryption algorithm, T threat is the encryption level, D type Is the data type.

[0177] In the technical solution disclosed in the present invention, encryption environment information is collected, and the encryption level required by the user is determined based on the encryption environment information. The encryption level of the user is confirmed through changes in the external environment, and the encryption algorithm is switched quickly and accurately according to the encryption requirements, ensuring that the best security performance can be provided under any circumstances.

[0178] In another possible design, the data stream to be encrypted includes multiple data streams, and according to the target encryption algorithm and the target secret key, the data stream to be encrypted by the user is encrypted to obtain the encrypted ciphertext, including:

[0179] Determine the cryptographic processor of the user's device;

[0180] Inputting a target encryption algorithm and a target secret key, as well as a plurality of data streams to be encrypted, into an encryption processor, the encryption processor being used to perform encryption processing on the plurality of data streams to be encrypted in parallel using the target encryption algorithm and the target secret key;

[0181] The encrypted ciphertext is obtained by the encryption processor performing parallel encryption processing on multiple data streams to be encrypted.

[0182] Optionally, the encryption processor of the user equipment may refer to a processor element for processing encryption calculations, such as an MCU (Microcontroller Unit), a CPU (Central Processing Unit), and the like.

[0183] The encryption processor can establish multiple threads, each of which can call up the target encryption algorithm, input the target secret key and encrypted data stream into the target encryption algorithm, perform encryption calculations on the input target secret key and encrypted data stream through the target encryption algorithm in the thread, and obtain encrypted ciphertext.

[0184] C = AES-GCM (K, P, IV, A)

[0185] Among them, C is the output encrypted ciphertext, K is the target secret key, P is the input confidential data stream, IV is the initialization vector, and A is the additional authentication data.

[0186] Optionally, IV and A are known data.

[0187] In the technical solution disclosed in the present invention, an encryption processor is set in the user device, and the encryption processor uses the target encryption algorithm and the target key to perform parallel encryption processing on multiple data streams to be encrypted, thereby realizing simultaneous processing of multiple data streams and effectively improving data encryption efficiency.

[0188] As an embodiment, it also includes:

[0189] In response to an algorithm selection operation on at least one encryption algorithm of an algorithm library in an encryption engine, determining a first encryption algorithm corresponding to the algorithm selection operation;

[0190] In response to a trigger operation performed on the first encryption algorithm, an operation result of the first encryption algorithm is obtained, where the trigger operation includes a modification operation or a deletion operation.

[0191] Optionally, the modification operation on the first encryption algorithm may be, for example, a modification operation on the algorithm name, parameters, etc. of the first encryption algorithm.

[0192] Optionally, if the triggering operation is a modification operation, the operation result includes modification success or modification failure. Alternatively, if the triggering operation is a deletion operation, the operation result includes deletion success or deletion failure.

[0193] The first encryption algorithm may be any encryption algorithm in the algorithm library, and this is not particularly limited in this embodiment.

[0194] In the disclosed embodiment, at least one encryption algorithm is integrated in the algorithm library of the encryption engine. The at least one encryption algorithm can implement modification operations or deletion operations in a targeted manner, realize dynamic management of the algorithm, and ensure that the encryption algorithms in the algorithm library can be updated quickly and efficiently.

[0195] As yet another embodiment, it further includes:

[0196] In response to an algorithm addition operation performed on an algorithm library in an encryption engine, obtaining a second encryption algorithm corresponding to the algorithm addition operation;

[0197] Add a second encryption algorithm to the algorithm library.

[0198] Optionally, the second encryption algorithm may be any algorithm different from the algorithm library or an algorithm with an updated version, which is not particularly limited in this embodiment.

[0199] In the disclosed embodiment, at least one encryption algorithm is integrated in the algorithm library of the encryption engine, and encryption algorithms can also be added to the algorithm library to implement algorithm addition management, thereby ensuring that the encryption algorithms in the algorithm library can be updated as needed.

[0200] In practical applications, the selection of the target key may be related to the power consumption of the user device.

[0201] In yet another possible design, a storage component of a user device stores multiple secret keys of the user, and the method further includes:

[0202] Detecting the current target power consumption level of the user equipment;

[0203] Get the target key that the user has permission to use, including:

[0204] Selecting a target key that matches the target power consumption level from a plurality of keys of the user stored in the user device;

[0205] Determining a target encryption algorithm of a user from at least one encryption algorithm includes:

[0206] A target encryption algorithm matching the target power consumption level is selected from the at least one encryption algorithm.

[0207] Optionally, the power consumption level of the user equipment is inversely proportional to the encryption strength of each key, and the power consumption level of the user equipment is inversely proportional to the computational complexity of each encryption algorithm.

[0208] In some embodiments, the target power consumption level may refer to a power consumption level determined according to the current power consumption of the user equipment, and then the current target power consumption level of the user equipment is determined from a plurality of power consumption levels.

[0209] Exemplarily, several power consumption levels can be pre-set, each power consumption level is associated with a corresponding power consumption value range, after obtaining the current power consumption of the user device, the power consumption value range in which the current power consumption is located can be determined, and then the power consumption level associated with the power consumption value range can be determined as the target power consumption level.

[0210] Optionally, detecting the current target power consumption level of the user equipment may include calculating the current power consumption of the user equipment and determining the target power consumption level according to the current power consumption. Specifically, multiple power consumption ranges and associations between each power consumption range and the power consumption level may be preset, and when the power consumption is determined, the target power consumption range in which the power consumption is located may be determined from each power consumption range, thereby obtaining the target power consumption level associated with the target power consumption range.

[0211] For example, when it is detected that the user device is currently at a high power consumption level, a low-strength key can be selected, a relatively simple encryption algorithm (such as AES-128) can be selected, and data can be locally encrypted and uploaded to the cloud server.

[0212] Alternatively, when it is detected that the user device is currently at a medium power consumption level, a medium-strength key can be selected, and a medium-complexity encryption algorithm (such as AES-256) can be selected. Combined with the real-time password entered by the user or the random number generated in real time, the data is locally encrypted and uploaded to the cloud server.

[0213] Alternatively, when it is detected that the user device is currently at a low power consumption level, a high-strength key can be selected, a high-complexity encryption algorithm can be selected, and combined with the user's current input behavior mode (for example, currently in manual keyboard input, voice input, facial expression operation, etc.), the biometric information corresponding to the input behavior (for example, fingerprint information, voiceprint information, iris / expression information) is obtained, and further based on the above-mentioned high-complexity encryption algorithm and the biometric information corresponding to the input behavior, the data is locally encrypted and uploaded to the cloud server.

[0214] The power management unit allocates more power to other modules, such as the network interface, storage controller, or encryption processor, to extend the device's battery life.

[0215] In the disclosed embodiment, the user device may have a power management function. By detecting the current target power consumption level of the user device, the target key and target encryption algorithm may be selected according to the target power consumption level, so that the encryption power consumption can be related to the user's current target power consumption level, thereby improving the utilization efficiency of the user device's power resources and extending the battery life of the device.

[0216] Further, optionally, it also includes:

[0217] The encryption module of the computing user device performs the encryption load required for the encryption calculation using the target secret key and the target encryption algorithm;

[0218] According to the encryption load required by the encryption module, the power resources of the user device are dynamically scheduled to obtain the target power resources of the encryption module. The target power resources are used by the encryption module to encrypt the user's data stream to be encrypted using the target encryption algorithm and target key to obtain the encrypted ciphertext.

[0219] The encryption load may refer to the power consumption required by the encryption module to perform encryption calculations on the data stream to be encrypted using the target secret key and the target encryption algorithm.

[0220] In the disclosed embodiment, after obtaining the target key and the target encryption algorithm, the encryption load required to perform encryption calculations using the target key and the target encryption algorithm can be calculated, and then the power resources of the encryption module can be determined through the encryption load, thereby achieving dynamic scheduling of the power resources of the power equipment, thereby ensuring that sufficient power resources are provided to the encryption module and improving the security of the encryption operation.

[0221] Further, optionally, calculating the encryption load required for the encryption module of the user device to perform encryption calculations using the target secret key and the target encryption algorithm includes:

[0222] Determine a first power consumption parameter corresponding to when the user equipment performs security verification processing on the authentication information;

[0223] Determine a second power consumption parameter required for the user equipment to perform encryption calculations using the target encryption algorithm and the target key;

[0224] Determining a third power consumption parameter required by the user equipment when encrypting the data stream to be encrypted;

[0225] The first power consumption parameter, the second power consumption parameter, and the third power consumption parameter are added together to obtain an encryption load required by an encryption module of the user equipment.

[0226] Optionally, the encryption payload is calculated as follows:

[0227] L current =α·C input +β·P process +γ·S data

[0228] Among them, L current The encryption load required by the encryption module, C input is the first power consumption parameter, P process is the second power consumption parameter, S data is the third power consumption parameter.

[0229] Among them, the first power consumption parameter may refer to the complexity of the biometric feature input by the user, such as fingerprint feature, iris feature, high complexity password login feature. The second power consumption parameter refers to the complexity of the encryption process, that is, the amount of calculation of the selected encryption algorithm. The third power consumption parameter may refer to the amount of data in the data stream that needs to be encrypted. α, β and γ are adjustment parameters that can be used to balance the impact of each power consumption parameter on the responsible, and can be preset.

[0230] In the disclosed embodiment, when calculating the encryption load of the target key and the target encryption module, the first power consumption parameter of the security verification processing and the second power consumption parameter of the encryption calculation, as well as the third power consumption parameter of the data encryption can be calculated first, and then the encryption load required by the encryption module can be calculated from three dimensions to realize dynamic scheduling of power management, so as to ensure efficient operation of power resources.

[0231] Further, optionally, dynamically scheduling the power resources of the user equipment according to the encryption load required by the encryption module includes:

[0232] Determine the encryption weight required by the encryption module based on the encryption load required by the encryption module;

[0233] The target power resources allocated by the user equipment to the encryption module are calculated according to the encryption weight and the weights of other modules of the user equipment.

[0234] Optionally, according to the encryption load required by the encryption module, determining the encryption weight required by the encryption module may include: querying the encryption weight associated with the encryption load.

[0235] Optionally, the encryption weight of the encryption module and the weights of other modules of the user equipment may be preset.

[0236] Optionally, calculating the target power resources allocated to the encryption module by the user device based on the encryption weight and the weights of other modules of the user device may include: scheduling the power resources of the user device based on the encryption weight of the encryption module and the weights of other modules of the user device to obtain the target power resources allocated to the encryption module by the user device.

[0237] The calculation formula of the target power resource of the encryption module is as follows:

[0238]

[0239] Among them, P allocated is the target power resource of the encryption module, P total is the total power resource of the system, W module is the encryption weight, W i is the weight of other modules, and δ is the power buffer reserved for the system to avoid over-allocation, which can be obtained by pre-setting.

[0240] The power resource may refer to the power-related resources that can be provided by the user equipment, such as the energy consumption or power consumption of the power.

[0241] In the disclosed embodiment, the encryption weight required by the encryption module can be determined based on the encryption load. Based on the encryption weight and the weights of other modules of the user device, on-demand allocation of power resources can be achieved, thereby ensuring the accuracy of power resource allocation and improving the utilization efficiency of power resources.

[0242] Further, optionally, dynamically scheduling the power resources of the user equipment according to the encryption load required by the encryption module includes:

[0243] Calculate the voltage change of the encryption module according to the encryption load and the maximum encryption load of the user device and the preset voltage adjustment range;

[0244] The voltage change is added to the preset basic operating voltage of the encryption module to obtain the target operating voltage of the encryption module.

[0245] Optionally, calculating the voltage change of the encryption module based on the encryption load, the maximum encryption load of the user device, and a preset voltage adjustment range may include: calculating the quotient of the encryption load and the maximum encryption load of the user device to obtain a first value, calculating the product of the first value and the preset voltage adjustment range to obtain the voltage change of the encryption module.

[0246] Optionally, the basic operating voltage of the encryption module may be obtained by preset settings.

[0247] The calculation formula for the target operating voltage of the encryption module is as follows:

[0248]

[0249] Among them, V module is the target operating voltage of the encryption module, V base is the basic working voltage of the encryption module, ΔV is the voltage adjustment range, L current To encrypt the payload, L max is the maximum encrypted payload.

[0250] In the disclosed embodiment, when the power resources of the user device are dynamically scheduled, the voltage change of the encryption module can be calculated, and the target operating voltage of the encryption module can be obtained by adding the voltage change and the basic operating voltage. By dynamically adjusting the operating voltage of the encryption module, efficient management of voltage resources is achieved.

[0251] As an embodiment, it also includes:

[0252] Generate the user's secret key based on the quantum random number generation algorithm;

[0253] The user's secret key is stored in the storage component of the user's device.

[0254] Optionally, the quantum random number production algorithm may include a quantum random number generator.

[0255] In the disclosed embodiment, a user's secret key can be generated by a quantum random number generation algorithm. The generated secret key is randomly generated and unpredictable. Compared with a traditional random number generator, a quantum random number generator can provide higher security and has a stronger security advantage.

[0256] In one possible design, the user's secret key is generated based on a quantum random number generation algorithm, including:

[0257] Generate quantum random numbers based on a preset quantum random number generator;

[0258] Get the user's secret key information;

[0259] The quantum random number and secret key information are hashed to obtain the user's secret key.

[0260] Optionally, the quantum random number generator may include a quantum state generator and a random number generation module, and a measurement module.

[0261] Optionally, the quantum state generator can be used to generate a quantum state. The quantum state can be input into a random number generation module, and the random number generation module can generate a quantum random number corresponding to the quantum state.

[0262] Furthermore, the measurement module of the quantum state generator can measure the generated quantum state to obtain quantum random numbers.

[0263] For example, the generation formula of quantum random numbers is as follows: quantum =H(ψ)

[0264] Among them, ψ is the quantum state, R quantum is the generated quantum random number.

[0265] The calculation formula of the user key is as follows: K = H (R quantum , P)

[0266] Among them, K is the generated secret key, P is the user's secret key information, and H is the hash function.

[0267] The user's key information may refer to, for example, the user's password or other key materials.

[0268] In the disclosed embodiment, a quantum random number generator is first used to generate a quantum random number to ensure that the secret key is truly random and unpredictable. The user's secret key information and the quantum random number are hashed to obtain a more resistant secret key, further improving the security of the secret key. Compared with traditional pseudo-random number generators, quantum random number generators can provide stronger security, especially in the face of future quantum computing attacks, and can effectively ensure the long-term security of data.

[0269] like Figure 4 FIG. 1 is a flowchart of a data encryption algorithm provided by an embodiment of the present disclosure. The data encryption algorithm may include the following steps:

[0270] S401. In response to a data encryption request triggered by a user, collect biometric features of the user.

[0271] S402: Authenticate the user's biometric features according to a preset biometric recognition algorithm to obtain a security authentication result of the user.

[0272] S403: When the security authentication result is that the security authentication is passed, enable the user's access rights to the storage component of the user device.

[0273] S404: Detect the current target power consumption level of the user equipment.

[0274] S405: Select a target key that matches the target power consumption level from a plurality of keys of the user stored in the user device.

[0275] Optionally, the multiple keys are respectively associated with key information. Selecting a target key matching the target power consumption level from multiple keys of the user stored in the user device may include: selecting key information of the target key matching the target power consumption level from the key information of multiple keys of the user stored.

[0276] Optionally, in S405, the target key corresponding to the target power consumption level is matched, and the key information of the target key is obtained, but the target key is not obtained. Therefore, S406-S407 need to be executed.

[0277] S406. Obtain storage components corresponding to multiple subkeys of the target key that the user has permission to use, so as to read multiple subkeys from each storage component.

[0278] S407: Perform key restoration processing on multiple sub-keys to obtain a target key.

[0279] S408: Determine an algorithm library in an encryption engine of the user equipment, where the algorithm library includes at least one encryption algorithm.

[0280] S409: Select a target encryption algorithm that matches the target power consumption level from at least one encryption algorithm.

[0281] S410, calculating the encryption load required for the encryption calculation performed by the encryption module of the user device using the target secret key and the target encryption algorithm;

[0282] S411. Dynamically schedule the power resources of the user equipment according to the encryption load required by the encryption module to obtain the target power resources of the encryption module.

[0283] S412, allocating the target power resources to the encryption module, calling the encryption module to use the target encryption algorithm and the target secret key to encrypt the user's data stream to be encrypted, and obtaining the encrypted ciphertext.

[0284] S413: Send the encrypted ciphertext to the cloud server.

[0285] In the disclosed embodiment, biometric technology (such as fingerprint and iris recognition) is combined at the hardware level to achieve strict control of key access. Only users who have passed biometric authentication can access and use the key, thereby greatly improving the security of key management and avoiding possible attacks and leakage risks at the software level. The target key is divided into multiple independent sub-keys and stored in different locations. Even if an attacker obtains some sub-keys, the complete key cannot be reorganized, thereby effectively improving the security of the key. In addition, the encryption algorithm is automatically switched according to security requirements through the algorithm library in the encryption engine. And through the intelligent power management system, the power supply is dynamically adjusted according to the load of the encryption module and the user input behavior (such as fingerprint, iris or password). The system can give priority to providing power to the encryption module when it is under high load, and switch to low power consumption mode under low load or low security requirements. This intelligent power management not only improves the battery life of the device, but also ensures the stability and efficiency of encryption tasks under various working conditions. Thereby achieving high-security and high-performance cloud storage.

[0286] like Figure 5 As shown, a data encryption device provided by an embodiment of the present disclosure is applied to a programmable user device, and the device includes:

[0287] The request response unit 501 is used to respond to a data encryption request triggered by a user and collect the user's information to be authenticated.

[0288] The security verification unit 502 is used to perform security verification processing on the information to be authenticated, and obtain a security authentication result corresponding to the information to be authenticated, where the security authentication result is security authentication passed or security authentication failed.

[0289] The key acquisition unit 503 is used to acquire a target key that the user has permission to use when the security authentication result is that the security authentication is passed.

[0290] The encryption calculation unit 504 is used to encrypt the user's to-be-encrypted data stream according to the target secret key to obtain an encrypted ciphertext.

[0291] The ciphertext sending unit 505 is used to send the encrypted ciphertext to the cloud server.

[0292] As an embodiment, the information to be authenticated includes a user's biometrics, and the security verification unit may include:

[0293] The biometric verification module is used to authenticate the user's biological characteristics according to a preset biometric recognition algorithm to obtain the user's security authentication result.

[0294] As another embodiment, the key acquisition unit includes:

[0295] The permission activation module is used to enable the user's access rights to the storage component of the user device when the security authentication result is that the security authentication is passed;

[0296] The key reading module is used to read the target key from the storage component.

[0297] As another embodiment, the target key includes multiple sub-keys, and the multiple sub-keys are respectively stored in multiple storage components of the user device. The key reading module includes:

[0298] The key reading submodule is used to obtain storage components corresponding to multiple subkeys of the target key that the user has the right to use, so as to read multiple subkeys from each storage component;

[0299] The key recovery submodule is used to recover multiple sub-keys and obtain the target key.

[0300] As yet another embodiment, the method further includes:

[0301] A key splitting unit, used to split the user's target key into multiple sub-keys through a secret sharing algorithm;

[0302] A split storage unit is used to store multiple sub-keys in multiple storage components;

[0303] The secret key recovery submodule is specifically used to: use the Lagrange interpolation algorithm to perform secret key reorganization calculations on multiple sub-secret keys to obtain the target secret key.

[0304] As yet another embodiment, the encryption computing unit includes:

[0305] An engine determination module, used to determine an algorithm library in an encryption engine of a user device, the algorithm library including at least one encryption algorithm;

[0306] A target algorithm module, used to determine a target encryption algorithm of a user from at least one encryption algorithm;

[0307] The encryption calculation module is used to encrypt the user's encrypted data stream according to the target encryption algorithm and the target secret key to obtain the encrypted ciphertext.

[0308] As yet another embodiment, the target algorithm module includes:

[0309] The environment collection submodule is used to collect the encrypted environment information of the user;

[0310] The level determination submodule is used to determine the encryption level required by the user based on the encryption environment information;

[0311] An algorithm scheduling submodule, used to input the encryption level into a dynamic scheduler in the encryption engine, and the dynamic scheduler is used to schedule a target encryption algorithm corresponding to the encryption level from at least one encryption algorithm;

[0312] The target acquisition submodule is used to obtain the target encryption algorithm output by the dynamic scheduler.

[0313] As another embodiment, the data stream to be encrypted includes multiple encryption calculation modules, including:

[0314] A processing determination submodule, used to determine an encryption processor of a user device;

[0315] An information input submodule, used to input a target encryption algorithm and a target secret key, as well as a plurality of data streams to be encrypted, into an encryption processor, and the encryption processor is used to perform encryption processing on the plurality of data streams to be encrypted in parallel using the target encryption algorithm and the target secret key;

[0316] The ciphertext acquisition submodule is used to obtain the encrypted ciphertext obtained by the encryption processor through parallel encryption processing of multiple data streams to be encrypted.

[0317] As yet another embodiment, it further includes:

[0318] A first response unit, configured to determine a first encryption algorithm corresponding to the algorithm selection operation in response to an algorithm selection operation on at least one encryption algorithm in an algorithm library in the encryption engine;

[0319] The second response unit is used to obtain the operation result of the first encryption algorithm in response to the trigger operation performed on the first encryption algorithm, where the trigger operation includes a modification operation or a deletion operation.

[0320] As yet another embodiment, it further includes:

[0321] A third response unit, configured to, in response to an algorithm addition operation performed on an algorithm library in the encryption engine, obtain a second encryption algorithm corresponding to the algorithm addition operation;

[0322] The algorithm adding unit is used to add the second encryption algorithm to the algorithm library.

[0323] As another embodiment, the user device stores multiple secret keys of the user, and the apparatus further includes:

[0324] A power consumption level unit, used to detect the current target power consumption level of the user equipment;

[0325] The key acquisition unit includes:

[0326] A power consumption matching module, configured to select a target key that matches a target power consumption level from a plurality of keys of a user stored in a user device;

[0327] Target algorithm module, including:

[0328] The algorithm matching module is used to select a target encryption algorithm that matches a target power consumption level from at least one encryption algorithm.

[0329] As yet another embodiment, the power consumption level of the user equipment is inversely proportional to the encryption strength of each key, and the power consumption level of the user equipment is inversely proportional to the computational complexity of each encryption algorithm.

[0330] As yet another embodiment, it further includes:

[0331] A load calculation module, used to calculate the encryption load required by the encryption module of the user device to perform encryption calculations using a target secret key and a target encryption algorithm;

[0332] The power scheduling module is used to dynamically schedule the power resources of the user equipment according to the encryption load required by the encryption module, and obtain the target power resources of the encryption module. The target power resources are used by the encryption module to encrypt the user's data stream to be encrypted using the target encryption algorithm and target key to obtain the encrypted ciphertext.

[0333] As yet another embodiment, the load calculation module includes:

[0334] A first calculation submodule, used to determine a first power consumption parameter corresponding to when the user equipment performs security verification processing on the authentication information;

[0335] A second calculation submodule, used to determine a second power consumption parameter required for the user equipment to perform encryption calculation using the target encryption algorithm and the target key;

[0336] A third calculation submodule, used to determine a third power consumption parameter required by the user equipment when encrypting the data stream to be encrypted;

[0337] The fourth calculation submodule is used to add the first power consumption parameter, the second power consumption parameter and the third power consumption parameter to obtain the encryption load required by the encryption module of the user equipment.

[0338] As yet another embodiment, the power dispatching module includes:

[0339] The weight determination submodule is used to determine the encryption weight required by the encryption module according to the encryption load required by the encryption module;

[0340] The resource allocation submodule is used to calculate the target power resources allocated to the encryption module by the user equipment according to the encryption weight and the weights of other modules of the user equipment.

[0341] As yet another embodiment, the power dispatching module includes:

[0342] A voltage calculation submodule, used to calculate the voltage change of the encryption module according to the encryption load and the maximum encryption load of the user equipment, and a preset voltage adjustment range;

[0343] The voltage distribution submodule is used to add the voltage change to the basic working voltage preset by the encryption module to obtain the target working voltage of the encryption module.

[0344] As yet another embodiment, it further includes:

[0345] A quantum generation unit, used to generate the user's secret key based on a quantum random number generation algorithm;

[0346] The key storage unit is used to store the user's key in the storage component of the user's device.

[0347] As yet another embodiment, a quantum generation unit comprises:

[0348] A random generation module, used to generate quantum random numbers based on a preset quantum random number generator;

[0349] Information acquisition module, used to obtain the user's secret key information;

[0350] The secret key calculation module is used to perform hash calculation on the quantum random number and secret key information to obtain the user's secret key.

[0351] As yet another embodiment, the programmable user equipment is a user equipment based on a field programmable gate array (FPGA).

[0352] Figure 6 A structural diagram of a programmable user device provided in an embodiment of the present disclosure, the programmable user device may include: a memory 601, a processor 602 and a computer program stored in the memory 601, the processor executes the computer program to implement any data encryption method.

[0353] The embodiment of the present disclosure also provides a computer-readable storage medium on which a computer program / instruction is stored. When the computer program / instruction is executed by a processor, any data encryption method is implemented.

[0354] The embodiment of the present disclosure also provides a computer program product, including a computer program / instruction, which implements any data encryption method when executed by a processor.

[0355] The data encryption method according to the embodiment of the present disclosure is described above with reference to the accompanying drawings. The programmable user device can respond to the data encryption request triggered by the user and collect the user's information to be authenticated. By performing security verification processing on the information to be authenticated, the security authentication result corresponding to the information to be authenticated can be obtained. The security authentication result is security authentication passed or security authentication failed. In the case where the security authentication result is security authentication passed, the target key that the user has the right to use can be obtained. Before obtaining the key, the user's identity needs to be securely authenticated so as to achieve strict use control of the key. Only users who have passed the security authentication can use the target key, thereby improving the security of key management, avoiding the possibility of key abuse at the software level, and improving the security of the data encryption process.

[0356] The basic principles of the present disclosure are described above in conjunction with specific embodiments. However, it should be noted that the advantages, strengths, effects, etc. mentioned in the present disclosure are only examples and not limitations, and it cannot be considered that these advantages, strengths, effects, etc. are required by each embodiment of the present disclosure. In addition, the specific details disclosed above are only for the purpose of illustration and ease of understanding, and are not limitations. The above details do not limit the present disclosure to the necessity of adopting the above specific details to be implemented.

[0357] The block diagrams of the devices, apparatuses, equipment, and systems involved in this disclosure are only illustrative examples and are not intended to require or imply that they must be connected, arranged, and configured in the manner shown in the block diagrams. As will be appreciated by those skilled in the art, these devices, apparatuses, equipment, and systems can be connected, arranged, and configured in any manner. Words such as "including," "comprising," "having," and the like are open words, referring to "including but not limited to," and can be used interchangeably therewith. The words "or" and "and" used herein refer to the words "and / or," and can be used interchangeably therewith, unless the context clearly indicates otherwise. The word "such as" used herein refers to the phrase "such as but not limited to," and can be used interchangeably therewith.

[0358] Additionally, as used herein, "or" used in a list of items beginning with "at least one" indicates a separate list, so that, for example, a list of "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word "exemplary" does not mean that the example described is preferred or better than other examples.

[0359] It should also be noted that in the system and method of the present disclosure, each component or each step can be decomposed and / or recombined. Such decomposition and / or recombination should be regarded as equivalent solutions of the present disclosure.

[0360] Various changes, substitutions, and modifications of the techniques described herein may be made without departing from the teachings defined by the appended claims. Furthermore, the scope of the claims of the present disclosure is not limited to the specific aspects of the processes, machines, manufactures, compositions of events, means, methods, and actions described above. Currently existing or later to be developed processes, machines, manufactures, compositions of events, means, methods, or actions that perform substantially the same functions or achieve substantially the same results as the corresponding aspects described herein may be utilized. Thus, the appended claims include such processes, machines, manufactures, compositions of events, means, methods, or actions within their scope.

[0361] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of the present disclosure. Therefore, the present disclosure is not intended to be limited to the aspects shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

[0362] The above description has been given for the purpose of illustration and description. In addition, this description is not intended to limit the embodiments of the present disclosure to the forms disclosed herein. Although multiple example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, changes, additions and sub-combinations thereof.

Claims

1. A data encryption method, characterized in that: Applied to a programmable user device, the method comprises: In response to a data encryption request triggered by a user, collecting the user's information to be authenticated; Performing security verification processing on the information to be authenticated to obtain a security authentication result corresponding to the information to be authenticated, wherein the security authentication result is security authentication passed or security authentication failed; If the security authentication result is that the security authentication is passed, obtaining a target key that the user has permission to use; According to the target secret key, encrypt the user's data stream to be encrypted to obtain an encrypted ciphertext; The encrypted ciphertext is sent to the cloud server.

2. The method according to claim 1, characterized in that The information to be authenticated includes the biometric features of the user, and the security verification process is performed on the information to be authenticated to obtain a security authentication result corresponding to the information to be authenticated, including: According to a preset biometric recognition algorithm, the user's biometric features are authenticated to obtain a security authentication result of the user.

3. The method according to claim 1, characterized in that When the security authentication result is that the security authentication is passed, obtaining the target key that the user has permission to use includes: If the security authentication result is that the security authentication is passed, enabling the user's access rights to the storage component of the user device; The target key is read from the storage component.

4. The method according to claim 1, characterized in that The target key includes a plurality of sub-keys, and the plurality of sub-keys are respectively stored in a plurality of storage components of the user device. The step of obtaining the target key that the user has permission to use includes: Obtain storage components corresponding to multiple subkeys of the target key that the user has permission to use, so as to read the multiple subkeys from each storage component; The multiple sub-keys are subjected to key recovery processing to obtain the target key.

5. The method according to claim 4, characterized in that The method further comprises: Splitting the target secret key of the user into the multiple sub-secret keys by a secret sharing algorithm; Storing the plurality of sub-keys in the plurality of storage components; The performing key restoration processing on the multiple sub-keys to obtain the target key includes: The multiple sub-keys are subjected to key reorganization calculation by Lagrange interpolation algorithm to obtain the target key.

6. The method according to any one of claims 1 to 5, characterized in that: The step of encrypting the user's data stream to be encrypted according to the target secret key to obtain an encrypted ciphertext includes: Determine an algorithm library in an encryption engine of the user equipment, the algorithm library including at least one encryption algorithm; Determining a target encryption algorithm for the user from the at least one encryption algorithm; The user's data stream to be encrypted is encrypted according to the target encryption algorithm and the target secret key to obtain the encrypted ciphertext.

7. The method according to claim 6, characterized in that The step of determining a target encryption algorithm of the user from the at least one encryption algorithm comprises: Collecting the encryption environment information of the user; Determining the encryption level required by the user according to the encryption environment information; Inputting the encryption level into a dynamic scheduler in the encryption engine, the dynamic scheduler being used to schedule a target encryption algorithm corresponding to the encryption level from the at least one encryption algorithm; Obtain the target encryption algorithm output by the dynamic scheduler.

8. The method according to claim 6, characterized in that The data stream to be encrypted includes a plurality of data streams, and the encrypting the data stream to be encrypted of the user according to the target encryption algorithm and the target secret key to obtain the encrypted ciphertext includes: determining an encryption processor of the user device; Inputting the target encryption algorithm, the target key, and the plurality of data streams to be encrypted into the encryption processor, the encryption processor being used to perform encryption processing on the plurality of data streams to be encrypted in parallel using the target encryption algorithm and the target key; The encrypted ciphertext is obtained by the encryption processor performing parallel encryption processing on the plurality of data streams to be encrypted.

9. The method according to claim 6, characterized in that Also includes: In response to an algorithm selection operation on at least one encryption algorithm of an algorithm library in the encryption engine, determining a first encryption algorithm corresponding to the algorithm selection operation; In response to a trigger operation performed on the first encryption algorithm, an operation result of the first encryption algorithm is obtained, where the trigger operation includes a modification operation or a deletion operation.

10. The method according to claim 6, characterized in that Also includes: In response to an algorithm addition operation performed on an algorithm library in the encryption engine, obtaining a second encryption algorithm corresponding to the algorithm addition operation; Add the second encryption algorithm to the algorithm library.

11. The method according to any one of claims 1 to 10, characterized in that: The user device stores multiple secret keys of the user, and the method further includes: detecting a current target power consumption level of the user equipment; The step of obtaining the target key that the user has permission to use includes: Selecting a target key matching the target power consumption level from a plurality of keys of the user stored in the user device; The step of determining a target encryption algorithm of the user from the at least one encryption algorithm comprises: A target encryption algorithm matching the target power consumption level is selected from the at least one encryption algorithm.

12. The method according to claim 11, characterized in that The power consumption level of the user equipment is inversely proportional to the encryption strength of each key, and the power consumption level of the user equipment is inversely proportional to the computational complexity of each encryption algorithm.

13. The method according to claim 11, characterized in that Also includes: Calculate the encryption load required for the encryption module of the user equipment to perform encryption calculation using the target secret key and the target encryption algorithm; According to the encryption load required by the encryption module, the power resources of the user device are dynamically scheduled to obtain the target power resources of the encryption module. The target power resources are used by the encryption module to encrypt the user's data stream to be encrypted using the target encryption algorithm and the target key to obtain the encrypted ciphertext.

14. The method according to claim 13, characterized in that The calculating the encryption module of the user equipment performs the encryption load required for the encryption calculation by using the target secret key and the target encryption algorithm, including: Determining a first power consumption parameter corresponding to when the user equipment performs security verification processing on the information to be authenticated; Determining a second power consumption parameter required for the user equipment to perform encryption calculation using the target encryption algorithm and the target key; Determining a third power consumption parameter required by the user equipment when encrypting the data stream to be encrypted; The first power consumption parameter, the second power consumption parameter and the third power consumption parameter are added together to obtain an encryption load required by an encryption module of the user equipment.

15. The method according to claim 13, characterized in that The dynamically scheduling the power resources of the user equipment according to the encryption load required by the encryption module includes: Determining the encryption weight required by the encryption module according to the encryption load required by the encryption module; The target power resources allocated by the user equipment to the encryption module are calculated according to the encryption weight and weights of other modules of the user equipment.

16. The method according to claim 13, characterized in that The dynamically scheduling the power resources of the user equipment according to the encryption load required by the encryption module includes: Calculating a voltage change of the encryption module according to the encryption load, the maximum encryption load of the user equipment, and a preset voltage adjustment range; The voltage change is added to a preset basic operating voltage of the encryption module to obtain a target operating voltage of the encryption module.

17. The method according to any one of claims 1 to 16, characterized in that: Also includes: Generate a secret key of the user based on a quantum random number generation algorithm; The user's secret key is stored in a storage component of the user's device.

18. The method according to claim 17, characterized in that The step of generating the secret key of the user based on a quantum random number generation algorithm comprises: Generate quantum random numbers based on a preset quantum random number generator; Obtaining the user's secret key information; The quantum random number and the secret key information are hashed to obtain the secret key of the user.

19. The method according to any one of claims 1 to 18, characterized in that: The programmable user equipment is a user equipment based on a field programmable gate array FPGA.

20. A data encryption device, characterized in that: Applied to a programmable user equipment, the device comprises: A request response unit, configured to respond to a data encryption request triggered by a user and collect the user's information to be authenticated; A security verification unit, used to perform security verification processing on the information to be authenticated, and obtain a security authentication result corresponding to the information to be authenticated, wherein the security authentication result is security authentication passed or security authentication failed; A key acquisition unit, used for acquiring a target key that the user has permission to use if the security authentication result is that the security authentication is passed; An encryption calculation unit, used to encrypt the user's to-be-encrypted data stream according to the target secret key to obtain an encrypted ciphertext; The ciphertext sending unit is used to send the encrypted ciphertext to the cloud server.

21. A programmable user device comprising a memory, a processor and a computer program stored in the memory, characterized in that: The processor executes the computer program to implement the steps of the method according to any one of claims 1 to 19.

22. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 19 are implemented.

23. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 19 are implemented.

Images