Data decryption method and system
By sharding and multiple encryption of the original key and using hash value to verify the accuracy of decryption sharding, the problem of inability to decrypt when the key management platform fails is solved, and the reliability and security of data decryption are improved.
Patent Information
- Application Number
- CN202411550115.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-01
- Publication Date
- 2025-02-11
AI Technical Summary
The prior art cannot decrypt the encrypted data when the key management platform fails, affecting the reliability of data decryption.
By sharding the original key and obtaining the first key from multiple key management platforms, at least Y key shards are encrypted, encrypted shards are generated, and the accuracy of the decrypted shards is verified by hash value. Restore the original key.
Even if the key management platform is partially invalid, the original key can still be restored to decrypt the encrypted data, improving the reliability and security of data decryption.
Smart Images
Figure CN119420477A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of data processing, and in particular to a method and system for data decryption. Background Art
[0002] The existing data encryption and decryption usually obtains the data to be encrypted through the central platform, and then uses the encryption key obtained from the key management platform to encrypt the data to be encrypted, thereby obtaining the encrypted data. When decrypting the encrypted data, a request is initiated to the key management platform to obtain the encryption key, and the encrypted data is decrypted using the obtained encryption key. However, this method depends on the key management platform, and the key management platform may fail due to business or other reasons, which in turn affects the central platform from obtaining the corresponding encryption key, and cannot realize decryption of the encrypted data. Summary of the invention
[0003] The technical problem to be solved by the present invention is: the present invention provides a method and system for data decryption, which can realize decryption of encrypted data when the key management platform fails, thereby improving the reliability of data decryption.
[0004] In order to solve the above technical problems, the technical solution adopted by the present invention is:
[0005] In a first aspect, the present invention provides a method for data decryption, comprising:
[0006] Obtaining an original key, encrypting data to be encrypted using the original key to obtain encrypted data, sharding the original key to obtain X key shards, wherein at least Y key shards of the X key shards can be combined to restore the original key;
[0007] Obtain P first keys of P key management platforms, select any Q first keys from the P first keys to encrypt at least Y key shards to obtain encrypted shards, and combine the P first keys with the X key shards according to a preset combination rule to obtain combined key shards, calculate a hash value of the combined key shards to obtain a first hash value, and store the first hash value in the supervision platform, where Q is less than P;
[0008] When decrypting the encrypted data, a key request is sent to P key management platforms, a response key of the key management platform that responds to the key request is obtained, the encrypted slice is decrypted by the response key to obtain an initial decrypted slice, the initial decrypted slice is combined with the response key according to the preset combination rule to obtain a final decrypted slice, a hash value of the final decrypted slice is calculated to obtain a second hash value, and a verification request is sent to the regulatory platform to obtain the first hash value, and it is determined whether the first hash value is the same as the second hash value, and whether the decryption quantity of the initial decrypted slice is not less than Y. If both are yes, the initial decrypted slice is combined to restore the original key to decrypt the encrypted data to obtain the original data.
[0009] The beneficial effects of the present invention are as follows: the original key for encrypting the data to be encrypted is sharded to obtain X key shards, and any Q first keys are selected from P first keys obtained from P key management platforms to encrypt at least Y key shards to obtain encrypted shards, thereby ensuring the security of the key shards, and at the same time calculating the hash value of the key shard after combining the first key with the key shards, storing the obtained first hash value on the supervision platform, and sending a key request to the key management platform when decrypting the encrypted data, and decrypting the encrypted shards by using the response key of the key management platform that responds to the key request to obtain the initial decryption key. The first hash value is obtained from the supervision platform, and the first hash value is determined to be the same as the second hash value. At the same time, it is determined whether the number of decryptions of the initial decrypted shard is not less than Y. That is, while verifying the accuracy of the initial decrypted shard, it is also determined whether the initial decrypted shard can restore the original key, thereby improving the security of decryption. In the form of sharding the original key and encrypting it with the first key, even if the key management platform partially fails, the original key can still be restored to decrypt the encrypted data, thereby improving the reliability of data decryption.
[0010] Generate an original key in a trusted execution environment, obtain a local physical key and a random number, and superimpose the physical key and the random number onto the original key through an encryption algorithm to generate a new original key.
[0011] According to the above description, the original key is generated in a trusted execution environment, and the physical key and random number are superimposed on the original key through an encryption algorithm to improve the security and flexibility of the obtained new original key.
[0012] Optionally, selecting any Q first keys from the P first keys to encrypt at least Y key fragments includes:
[0013] Determine whether P is less than X. If so, randomly select a target key from the P first keys, and encrypt F key shards with the target key. If not, select any Q first keys from the P first keys to encrypt at least Y key shards, where F is less than Y.
[0014] According to the above description, when P is less than X, that is, the number of first keys is less than the number of key shards, F key shards are encrypted by a randomly selected target key, and F is less than Y, that is, the same first key is used to encrypt different key shards, ensuring the confidentiality of each key shard while ensuring the diversity and flexibility of the obtained encrypted shards.
[0015] Optionally, the selecting any Q first keys from the P first keys to encrypt at least Y key fragments includes:
[0016] Select any identical first key from the Q first keys to encrypt different key fragments;
[0017] or
[0018] Any different first key is selected from the Q first keys to encrypt the same key fragment.
[0019] According to the above description, the same first key can be used to encrypt different key shards, or different first keys can be used to perform multiple encryptions on the same key shard. The diversity and flexibility of encryption improve the security of the encrypted shards.
[0020] In a second aspect, the present invention provides a system for data decryption, comprising:
[0021] A sharding module, used to obtain an original key, encrypt data to be encrypted by using the original key to obtain encrypted data, and shard the original key to obtain X key shards, wherein at least Y key shards of the X key shards can be combined to restore the original key;
[0022] an encryption module, used to obtain P first keys of P key management platforms, select any Q first keys from the P first keys to encrypt at least Y key shards to obtain encrypted shards, and combine the P first keys with the X key shards according to a preset combination rule to obtain combined key shards, calculate a hash value of the combined key shards to obtain a first hash value, and store the first hash value in the supervision platform, wherein Q is less than P;
[0023] A decryption module is used to send a key request to P key management platforms when decrypting the encrypted data, obtain a response key from the key management platform that responds to the key request, decrypt the encrypted slice by using the response key to obtain an initial decrypted slice, combine the decrypted slice with the response key according to the preset combination rule to obtain a final decrypted slice, calculate the hash value of the final decrypted slice to obtain a second hash value and send a verification request to the supervision platform to obtain the first hash value, determine whether the first hash value is the same as the second hash value, and determine whether the decryption quantity of the initial decrypted slice is not less than Y. If both are yes, the initial decrypted slice is combined to restore the original key to decrypt the encrypted data to obtain the original data.
[0024] The beneficial effects of the present invention are as follows: the original key for encrypting the data to be encrypted is sharded to obtain X key shards, and any Q first keys are selected from P first keys obtained from P key management platforms to encrypt at least Y key shards to obtain encrypted shards, thereby ensuring the security of the key shards, and at the same time calculating the hash value of the key shard after combining the first key with the key shards, storing the obtained first hash value on the supervision platform, and sending a key request to the key management platform when decrypting the encrypted data, and decrypting the encrypted shards by using the response key of the key management platform that responds to the key request to obtain the initial decryption key. The first hash value is obtained from the supervision platform, and the first hash value is determined to be the same as the second hash value. At the same time, it is determined whether the number of decryptions of the initial decrypted shard is not less than Y. That is, while verifying the accuracy of the initial decrypted shard, it is also determined whether the initial decrypted shard can restore the original key, thereby improving the security of decryption. In the form of sharding the original key and encrypting it with the first key, even if the key management platform partially fails, the original key can still be restored to decrypt the encrypted data, thereby improving the reliability of data decryption.
[0025] Optionally, the sharding module includes:
[0026] The key generation module is used to generate an original key in a trusted execution environment, obtain a local physical key and a random number, and superimpose the physical key and the random number on the original key through an encryption algorithm to generate a new original key.
[0027] According to the above description, the original key is generated in a trusted execution environment, and the physical key and random number are superimposed on the original key through an encryption algorithm to improve the security and flexibility of the obtained new original key.
[0028] Optionally, the encryption module is specifically:
[0029] Determine whether P is less than X. If so, randomly select a target key from the P first keys, and encrypt F key shards with the target key. If not, select any Q first keys from the P first keys to encrypt at least Y key shards, where F is less than Y.
[0030] According to the above description, when P is less than X, that is, the number of first keys is less than the number of key shards, F key shards are encrypted by a randomly selected target key, and F is less than Y, that is, the same first key is used to encrypt different key shards, ensuring the confidentiality of each key shard while ensuring the diversity and flexibility of the obtained encrypted shards.
[0031] Optionally, the encryption module is specifically:
[0032] Select any identical first key from the Q first keys to encrypt different key fragments;
[0033] or
[0034] Any different first key is selected from the Q first keys to encrypt the same key fragment.
[0035] According to the above description, the same first key can be used to encrypt different key shards, or different first keys can be used to perform multiple encryptions on the same key shard. The diversity and flexibility of encryption improve the security of the encrypted shards. BRIEF DESCRIPTION OF THE DRAWINGS
[0036] Figure 1 A flow chart of a data decryption method provided in this embodiment;
[0037] Figure 2 A schematic diagram of the overall flow of a data decryption method provided in this embodiment;
[0038] Figure 3 A schematic diagram of the structure of a data decryption system provided in this embodiment.
[0039] [Description of Reference Numerals]
[0040] 1. A system for decrypting data;
[0041] 2. Sharding module; 21. Key generation module;
[0042] 3. Encryption module;
[0043] 4. Decryption module. DETAILED DESCRIPTION
[0044] In order to better understand the above technical solution, exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided to enable a clearer and more thorough understanding of the present invention and to fully convey the scope of the present invention to those skilled in the art.
[0045] Embodiment 1
[0046] When this embodiment is applied to a target device, the target device is used as a device for managing encrypted data. The first key of the key management platform is a highly complex key generated by the key management platform, and the key management platform provides a key transmission interface to the target device, and transmits the first key generated and managed by the key management through the interface. The first keys of multiple key management platforms are used to manage data on the target device. Compared with a solution in which keys are generated by the target device and stored in the key management platform, the first key generated by the key management platform in this solution has higher complexity and security. In addition, this solution makes relatively small changes to the key management platform and is easy to implement.
[0047] The specific technical solution is discussed below.
[0048] Please refer to Figure 1 to Figure 2 The present invention provides a method for data decryption, comprising the steps of:
[0049] S1. Obtain an original key, encrypt data to be encrypted using the original key to obtain encrypted data, and shard the original key to obtain X key shards, wherein at least Y key shards of the X key shards can be combined to restore the original key;
[0050] In this embodiment, if Figure 2 As shown, the data to be encrypted is encrypted by obtaining the original key to obtain the encrypted data, and the original key is sharded to obtain X key shards, wherein at least Y key shards can be combined to restore the original key, X and Y are both integers greater than 1, and X is greater than Y. The specific values can be set according to actual conditions. For example, if X is 5 and Y is 3, at least 3 key shards can be combined to restore the original key.
[0051] At this time, obtaining the original key in step S1 includes:
[0052] S11. Generate an original key in a trusted execution environment, obtain a local physical key and a random number, and superimpose the physical key and the random number onto the original key through an encryption algorithm to generate a new original key.
[0053] In this embodiment, if Figure 2 As shown, an original key is generated in a trusted execution environment, and a physical key and a random number obtained locally are superimposed on the original key through an encryption algorithm to generate a new original key, that is, the original key at this time is a multi-encrypted and dynamically changing original key.
[0054] S2. Obtain P first keys of P key management platforms, select any Q first keys from the P first keys to encrypt at least Y key shards to obtain encrypted shards, and combine the P first keys with the X key shards according to a preset combination rule to obtain combined key shards, calculate the hash value of the combined key shards to obtain a first hash value, and store the first hash value in the supervision platform, where Q is less than P;
[0055] In this embodiment, if Figure 2 As shown, any Q first keys are selected from P first keys obtained from P key management platforms to encrypt at least Y key shards, that is, the minimum number of encrypted key shards is the same as the minimum number of key shards that can restore the original key, and the P first keys are combined with the X key shards according to a preset combination rule to obtain combined key shards. The preset combination rule can be a method of combining the first key corresponding to the key shard selected for encryption with the key shard, or a different method can be used for combination, which can be specifically set according to actual conditions, and a hash value of the combined key shard is calculated to obtain a first hash value, and the obtained first hash value is stored in the supervision platform.
[0056] At this time, the step S2 of selecting any Q first keys from the P first keys to encrypt at least Y key fragments includes:
[0057] S21. Determine whether P is less than X. If so, randomly select a target key from the P first keys, and encrypt F key fragments with the target key. If not, select any Q first keys from the P first keys to encrypt at least Y key fragments, where F is less than Y.
[0058] In this embodiment, if Figure 2As shown, the first key for encrypting the key shard is obtained from the key management platform. When the key shard is encrypted by the first key, it is first determined whether P is less than X, that is, whether the number of keys of the first key is less than the number of key shards. If P is less than X, that is, the number of keys of the first key is less than the number of key shards, a target key is randomly selected from the P first keys, and the F key shards are encrypted by the target key, where F is less than Y. For example, at this time, P is 4, and the corresponding first keys are: M1, M2, M3 and M4, and X is 5, and the corresponding key shards are: K1, K2, K3, K4 and K5, then a target key is randomly selected from the first keys: M1, M2, M3 and M4 One is used as the target key. For example, the randomly selected target key is M3. When F is 2, two key shards are randomly encrypted by M3. M3 encrypts K1 and K3. The remaining first keys: M1, M2 and M4 encrypt the remaining K2, K4 and K5 respectively. If P is not less than X, that is, the number of keys of the first key is not less than the number of key shards, such as, P is 7 at this time, and the corresponding first keys are: M1, M2, M3, M4, M5, M6 and M7, then, any Q first keys are selected therefrom. When Q is 5, at least Y first keys are selected at random. When Y is 3, that is, at least 3 key shards are encrypted by any 5 first keys.
[0059] At this time, in step S21, any Q first keys are selected from the P first keys to encrypt at least Y key fragments, including:
[0060] S211. Select any identical first key from the Q first keys to encrypt different key fragments;
[0061] or
[0062] Any different first key is selected from the Q first keys to encrypt the same key fragment.
[0063] In this embodiment, if Figure 2 As shown, when any Q first keys are selected from P first keys to encrypt at least Y key shards, you can choose to select any identical first key from the selected Q first keys to encrypt different key shards, that is, use the same first key to encrypt different key shards, or you can choose to select any different first keys from the selected Q first keys to encrypt the same key shard, that is, use different first keys to perform multiple encryption on the same key shard.
[0064] S3. When decrypting the encrypted data, a key request is sent to P key management platforms to obtain a response key from the key management platform that responds to the key request, the encrypted slice is decrypted by the response key to obtain an initial decrypted slice, the initial decrypted slice is combined with the response key according to the preset combination rule to obtain a final decrypted slice, a hash value of the final decrypted slice is calculated to obtain a second hash value, and a verification request is sent to the regulatory platform to obtain the first hash value, and it is determined whether the first hash value is the same as the second hash value, and whether the decryption quantity of the initial decrypted slice is not less than Y. If both are yes, the initial decrypted slice is combined to restore the original key to decrypt the encrypted data to obtain the original data.
[0065] In this embodiment, if Figure 2 As shown, when the encrypted data is to be decrypted, a key request is sent to all key management platforms. If the key management platform is not faulty or invalid, it will respond to the key request. Therefore, the response key of the key management platform that responds to the key request is obtained, and the encrypted slice is decrypted by the response key to obtain the initial decrypted slice. The initial decrypted slice is combined with the response key according to the preset combination rule to obtain the final decrypted slice, and the hash value of the final decrypted slice is calculated to obtain the second hash value and send a verification request to the regulatory platform. When the regulatory platform agrees to the verification request, the previously stored first hash value is returned to determine whether the first hash value is the same as the second hash value, and at the same time determine whether the decryption quantity of the initial decrypted slice is not less than Y. If both are true, it means that the obtained initial decrypted slice is correct, and the obtained initial decrypted slice can be combined to restore the original key. Therefore, the initial decrypted slice is combined to restore the original key to decrypt the encrypted data to obtain the original data.
[0066] Embodiment 2
[0067] Please refer to Figure 3 The present invention provides a data decryption system 1, comprising: a sharding module 2, a key generation module 21, an encryption module 3 and a decryption module 4.
[0068] The sharding module 2 is used to obtain an original key, encrypt the data to be encrypted by using the original key to obtain encrypted data, and shard the original key to obtain X key shards, wherein at least Y key shards of the X key shards can be combined to restore the original key;
[0069] An encryption module 3 is used to obtain P first keys of P key management platforms, select any Q first keys from the P first keys to encrypt at least Y key shards to obtain encrypted shards, and combine the P first keys with the X key shards according to a preset combination rule to obtain combined key shards, calculate the hash value of the combined key shards to obtain a first hash value, and store the first hash value in the supervision platform, where Q is less than P;
[0070] The decryption module 4 is used to send a key request to P key management platforms when decrypting the encrypted data, obtain the response key of the key management platform that responds to the key request, decrypt the encrypted slice by using the response key to obtain an initial decrypted slice, combine the decrypted slice with the response key according to the preset combination rule to obtain a final decrypted slice, calculate the hash value of the final decrypted slice to obtain a second hash value and send a verification request to the supervision platform to obtain the first hash value, determine whether the first hash value is the same as the second hash value, and determine whether the decryption quantity of the initial decrypted slice is not less than Y. If both are yes, the initial decrypted slice is combined to restore the original key to decrypt the encrypted data to obtain the original data.
[0071] Specifically, the slicing module 2 includes:
[0072] The key generation module 21 is used to generate an original key in a trusted execution environment, obtain a local physical key and a random number, and add the physical key and the random number to the original key through an encryption algorithm to generate a new original key.
[0073] Specifically, the encryption module 3 is:
[0074] Determine whether P is less than X. If so, randomly select a target key from the P first keys, and encrypt F key shards with the target key. If not, select any Q first keys from the P first keys to encrypt at least Y key shards, where F is less than Y.
[0075] Specifically, the encryption module 3 is:
[0076] Select any identical first key from the Q first keys to encrypt different key fragments;
[0077] or
[0078] Any different first key is selected from the Q first keys to encrypt the same key fragment.
[0079] Since the system / device described in the above embodiments of the present invention is a system / device used to implement the method of the above embodiments of the present invention, a person skilled in the art can understand the specific structure and deformation of the system / device based on the method described in the above embodiments of the present invention, and thus will not be described in detail here. All systems / devices used in the method of the above embodiments of the present invention belong to the scope of protection of the present invention.
[0080] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0081] The present invention is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present invention. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions.
[0082] It should be noted that in the claims, any reference numerals placed between brackets shall not be construed as limiting the claims. The word "comprising" does not exclude the presence of components or steps not listed in the claims. The word "a" or "an" preceding a component does not exclude the presence of a plurality of such components. The invention may be implemented by means of hardware comprising several different components and by means of a suitably programmed computer. In the claims enumerating several means, several of these means may be embodied by the same hardware. The use of the words first, second, third, etc., is for convenience of expression only and does not indicate any order. These words may be understood as part of the component name.
[0083] In addition, it should be noted that, in the description of this specification, the description of the terms "one embodiment", "some embodiments", "embodiment", "example", "specific example" or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, unless they are contradictory.
[0084] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments after knowing the basic creative concept. Therefore, the claims should be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present invention.
[0085] Obviously, those skilled in the art can make various modifications and variations to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention should also include these modifications and variations.
Claims
1. A method for data decryption, characterized in that: include: Obtaining an original key, encrypting data to be encrypted using the original key to obtain encrypted data, sharding the original key to obtain X key shards, wherein at least Y key shards of the X key shards can be combined to restore the original key; Obtain P first keys of P key management platforms, select any Q first keys from the P first keys to encrypt at least Y key shards to obtain encrypted shards, and combine the P first keys with the X key shards according to a preset combination rule to obtain combined key shards, calculate a hash value of the combined key shards to obtain a first hash value, and store the first hash value in the supervision platform, where Q is less than P; When decrypting the encrypted data, a key request is sent to P key management platforms, a response key of the key management platform that responds to the key request is obtained, the encrypted slice is decrypted by the response key to obtain an initial decrypted slice, the initial decrypted slice is combined with the response key according to the preset combination rule to obtain a final decrypted slice, a hash value of the final decrypted slice is calculated to obtain a second hash value, and a verification request is sent to the regulatory platform to obtain the first hash value, and it is determined whether the first hash value is the same as the second hash value, and whether the decryption quantity of the initial decrypted slice is not less than Y. If both are yes, the initial decrypted slice is combined to restore the original key to decrypt the encrypted data to obtain the original data.
2. A method for data decryption as claimed in claim 1, characterized in that: The obtaining of the original key comprises: Generate an original key in a trusted execution environment, obtain a local physical key and a random number, and superimpose the physical key and the random number onto the original key through an encryption algorithm to generate a new original key.
3. A method for data decryption as claimed in claim 1, characterized in that: The selecting any Q first keys from the P first keys to encrypt at least Y key fragments includes: Determine whether P is less than X. If so, randomly select a target key from the P first keys, and encrypt F key shards with the target key. If not, select any Q first keys from the P first keys to encrypt at least Y key shards, where F is less than Y.
4. A method for data decryption as claimed in claim 3, characterized in that: The step of selecting any Q first keys from the P first keys to encrypt at least Y key fragments includes: Select any identical first key from the Q first keys to encrypt different key fragments; or Any different first key is selected from the Q first keys to encrypt the same key fragment.
5. A data decryption system, characterized in that: include: A sharding module, used to obtain an original key, encrypt data to be encrypted by using the original key to obtain encrypted data, and shard the original key to obtain X key shards, wherein at least Y key shards of the X key shards can be combined to restore the original key; an encryption module, used to obtain P first keys of P key management platforms, select any Q first keys from the P first keys to encrypt at least Y key shards to obtain encrypted shards, and combine the P first keys with the X key shards according to a preset combination rule to obtain combined key shards, calculate a hash value of the combined key shards to obtain a first hash value, and store the first hash value in the supervision platform, wherein Q is less than P; A decryption module is used to send a key request to P key management platforms when decrypting the encrypted data, obtain a response key from the key management platform that responds to the key request, decrypt the encrypted slice by using the response key to obtain an initial decrypted slice, combine the initial decrypted slice with the response key according to the preset combination rule to obtain a final decrypted slice, calculate the hash value of the final decrypted slice to obtain a second hash value and send a verification request to the supervision platform to obtain the first hash value, determine whether the first hash value is the same as the second hash value, and determine whether the decryption quantity of the initial decrypted slice is not less than Y. If both are yes, the initial decrypted slice is combined to restore the original key to decrypt the encrypted data to obtain the original data.
6. A data decryption system as claimed in claim 5, characterized in that: The sharding module includes: The key generation module is used to generate an original key in a trusted execution environment, obtain a local physical key and a random number, and superimpose the physical key and the random number on the original key through an encryption algorithm to generate a new original key.
7. A data decryption system as claimed in claim 5, characterized in that: The encryption module is specifically: Determine whether P is less than X. If so, randomly select a target key from the P first keys, and encrypt F key shards with the target key. If not, select any Q first keys from the P first keys to encrypt at least Y key shards, where F is less than Y.
8. A data decryption system as claimed in claim 7, characterized in that: The encryption module is specifically: Select any identical first key from the Q first keys to encrypt different key fragments; or Any different first key is selected from the Q first keys to encrypt the same key fragment.