Data encryption method and device, computer program product and data encryption system

Abstract

The invention provides a data encryption method and device, a computer program product and a data encryption system. The method comprises the following steps: acquiring initial data and a network transmission rate; according to the network transmission rate, the initial data is segmented to obtain data to be transmitted, and the size of the network transmission rate and the size of a data segment are in positive correlation; performing multi-layer encryption on the to-be-transmitted data to obtain encrypted data; and sending the encrypted data to the target terminal. According to the scheme, the problems that a single-layer encryption method in the prior art is easy to crack and the data security is relatively low are solved.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to a data encryption method, device, computer program product and data encryption system. Background Art

[0002] With the rapid development of information technology, data security issues have become increasingly prominent. Although traditional data encryption methods can protect data security to a certain extent, they still pose great risks when facing advanced attack methods. At present, single-layer encryption methods are easy to crack and data security is low. Summary of the invention

[0003] The main purpose of the present application is to provide a data encryption method, device, computer program product and data encryption system to at least solve the problem that the single-layer encryption method in the prior art is easily cracked and the data security is low.

[0004] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a data encryption method is provided, including: obtaining initial data and a network transmission rate; according to the network transmission rate, segmenting the initial data to obtain data to be transmitted, wherein the size of the network transmission rate and the size of the data segment are positively correlated; performing multi-layer encryption on the data to be transmitted to obtain encrypted data; and sending the encrypted data to a target terminal.

[0005] Optionally, multiple layers of encryption are performed on the data to be transmitted to obtain encrypted data, including: using a first encryption method to perform a first layer of encryption on the data to be transmitted to obtain initial encrypted data, wherein the first encryption method is encryption using an AES algorithm; using a second encryption method to perform a second layer of encryption on the initial encrypted data to obtain intermediate encrypted data, wherein the second encryption method is encryption using an RSA algorithm; using a third encryption method to perform a third layer of encryption on the intermediate encrypted data to obtain the encrypted data, wherein the third encryption method is encryption using a hash function.

[0006] Optionally, after obtaining the data to be transmitted, the method further includes: obtaining the sensitivity of the data to be transmitted, wherein the sensitivity is the risk level of the data to be transmitted; and encrypting the data to be transmitted according to the sensitivity of the data to be transmitted to obtain the encrypted data, wherein the sensitivity is positively correlated with the security level of the encryption algorithm.

[0007] Optionally, after obtaining the data to be transmitted, the method further includes: obtaining a network congestion condition; encrypting the data to be transmitted according to the congestion condition to obtain the encrypted data, wherein the degree of network congestion is negatively correlated with the complexity of the encryption algorithm.

[0008] Optionally, after obtaining the data to be transmitted, the method further includes: obtaining the type of network, wherein the type includes a public network or an intranet; when the type of the network is the public network, using a first encryption algorithm to encrypt the data to be transmitted to obtain the encrypted data; when the type of the network is the intranet, using a second encryption algorithm to encrypt the data to be transmitted to obtain the encrypted data, wherein the strength of the first encryption algorithm is greater than the strength of the second encryption algorithm.

[0009] Optionally, before performing multiple layers of encryption on the data to be transmitted to obtain encrypted data, the method also includes: obtaining a key used in the process of transmitting data; obtaining an update frequency, wherein the update frequency is the frequency of updating the key; and updating the key according to the update frequency to obtain an updated key.

[0010] Before sending the encrypted data to the target terminal, the method further includes: storing the public key at the sending end and the receiving end; and storing the private key at the receiving end.

[0011] According to another aspect of the present application, a data encryption device is provided, including: a first acquisition unit, used to acquire initial data and a network transmission rate; a segmentation unit, used to segment the initial data according to the network transmission rate to obtain data to be transmitted, wherein the size of the network transmission rate and the size of the data segment are positively correlated; a first encryption unit, used to perform multi-layer encryption on the data to be transmitted to obtain encrypted data; and a sending unit, used to send the encrypted data to a target terminal.

[0012] According to another aspect of the present application, a computer program product is provided, comprising a computer program, wherein when the computer program is executed by a processor, the steps of any one of the data encryption methods are implemented.

[0013] According to another aspect of the present application, a data encryption system is provided, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the one or more programs include an encryption method for executing any one of the data.

[0014] By applying the technical solution of the present application, in a high-speed network environment, using larger data segments can reduce the overhead of segment header information and improve transmission efficiency. In a low-speed or unstable network environment, smaller data segments help to quickly retransmit lost data packets, reduce retransmission delays, and improve transmission reliability. Through multi-layer encryption technology, data is more difficult to be cracked during transmission, thereby improving data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The drawings constituting part of the present application are used to provide a further understanding of the present application. The exemplary embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0016] Figure 1 A hardware structure block diagram of a mobile terminal for executing a data encryption method provided in an embodiment of the present application is shown;

[0017] Figure 2 A schematic diagram of a data encryption method according to an embodiment of the present application is shown;

[0018] Figure 3 The overall flow chart of this scheme is shown;

[0019] Figure 4 A structural block diagram of a data encryption device provided according to an embodiment of the present application is shown.

[0020] The above drawings include the following reference numerals:

[0021] 102, processor; 104, memory; 106, transmission device; 108, input and output devices. DETAILED DESCRIPTION

[0022] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0023] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0024] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0025] As introduced in the background technology, the single-layer encryption method in the prior art is easy to be cracked and the data security is low. To solve the above problems, the embodiments of the present application provide a data encryption method, device, computer program product and data encryption system.

[0026] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0027] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 FIG. 1 is a hardware structure block diagram of a mobile terminal of a data encryption method according to an embodiment of the present invention. Figure 1 As shown, the mobile terminal may include one or more ( Figure 1 Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the mobile terminal may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the mobile terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0028] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the display method of device information in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, the above method is implemented. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof. The transmission device 106 is used to receive or send data via a network. The above-mentioned specific examples of the network may include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0029] In this embodiment, a method for encrypting data running on a mobile terminal, a computer terminal or a similar computing device is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0030] Figure 2 FIG. 1 is a flow chart of a data encryption method according to an embodiment of the present application. Figure 2 As shown, the method comprises the following steps:

[0031] Step S201, obtaining initial data and network transmission rate;

[0032] Specifically, first identify and capture the data that needs to be transmitted on the network. This data can come from various sources, such as user input, database query results, sensor data, etc. The process of acquiring data can include reading files, extracting records from a database, receiving sensor signals, or integrating information from multiple sources. At this stage, ensure the integrity of the data and prepare it for encryption processing.

[0033] Specifically, the network transmission rate refers to the speed at which data is transmitted in the network, usually expressed in bytes or bits transmitted per second, such as Mbps (megabits per second), MBps (megabytes per second), etc. The network transmission rate is affected by many factors, including network bandwidth, network congestion, signal quality, transmission protocol, etc. The purpose of obtaining the network transmission rate is to evaluate the current network environment and the data transmission speed that can be supported, so as to determine the best data transmission strategy.

[0034] Step S202, segmenting the initial data according to the network transmission rate to obtain data to be transmitted, wherein the network transmission rate and the size of the data segment are positively correlated;

[0035] Specifically, Figure 3 As shown, the data to be encrypted can be processed in segments, and the data size of each segment can be adjusted according to specific needs, for example, 1024 bytes. After the entire text is encrypted with base64, the first four digits are taken, and the 6 digits are concatenated. The digits are sequentially taken in the order of the segments to generate a unique identifier (ID) for each segment, which is used in the subsequent encryption and decryption process.

[0036] For example, if the network transmission rate is lower than 10 Mbps, the segment size can be 512 to 1024. In a low-speed network, a smaller segment size can reduce transmission time and error rate.

[0037] The network transmission rate is 10Mbps~50Mbps, and the segment size can be 1024~4096. In a medium-speed network, appropriately increasing the segment size can improve transmission efficiency.

[0038] The network transmission rate is 50Mbps~100Mbps, and the segment size can be 4096~8192. In a higher-speed network, a larger segment size can further improve the transmission efficiency, but attention should be paid to the impact of network delay and jitter.

[0039] When the network transmission rate exceeds 100 Mbps, the segment size can be 8192 to 16384. In high-speed networks, a larger segment size can be selected to fully utilize the network bandwidth.

[0040] Step S203, performing multi-layer encryption on the data to be transmitted to obtain encrypted data;

[0041] Specifically, multi-layer encryption technology is used to encrypt data to enhance data security. Multi-layer encryption means that the data will go through multiple encryption steps, each step using a different encryption algorithm or key to form an "encryption suite", making the data more difficult to crack during transmission.

[0042] Step S204: sending the encrypted data to the target terminal.

[0043] Specifically, the encrypted data is transmitted to the target terminal through the network. This usually involves selecting a secure transmission protocol, such as HTTPS (Hypertext Transfer Protocol Secure), to ensure the confidentiality and integrity of the data during transmission. After receiving the encrypted data, the target terminal decrypts the data and restores it to its original state through the decryption key held and used. During the transmission process, some metadata may also need to be attached, such as the identification of the encryption algorithm, the identification of the encryption key, the identification of the data segment, etc., to help the recipient decrypt the data correctly.

[0044] Through this embodiment, in a high-speed network environment, using larger data segments can reduce the overhead of segment header information and improve transmission efficiency. In a low-speed or unstable network environment, smaller data segments help to quickly retransmit lost data packets, reduce retransmission delays, and improve transmission reliability. Through multi-layer encryption technology, data is more difficult to be cracked during transmission, thereby improving data security.

[0045] Specifically, first, the original data that needs to be transmitted in the network is obtained. This data can be files, database records, real-time sensor data, etc. The sources and types of data are wide.

[0046] Next, the current network transmission rate is monitored in real time. This step is crucial to understanding the real-time status of the network. The network transmission rate directly reflects the network's carrying capacity and current network conditions. Obtaining the network transmission rate can be achieved through built-in network performance monitoring tools, third-party APIs, or network protocols (such as TCP's window size adjustment mechanism).

[0047] When a high network transmission rate is detected, the initial data is segmented into larger data segments for transmission. Conversely, when the network transmission rate is low, the data is segmented into smaller data segments for more efficient transmission in the network. This segment size adjustment is based on the network transmission rate, which can effectively deal with network congestion or instability, ensuring the stability and efficiency of data transmission.

[0048] Suppose there is a cloud storage service that needs to transfer a large number of files between the user's device and the server. In order to optimize the transmission efficiency and cope with network fluctuations, a segmented transmission mechanism is adopted, which can dynamically adjust the size of the data segment according to the real-time network conditions.

[0049] When a user initiates a file upload request on the client, the file to be uploaded, i.e. the initial data, is obtained first. This can be a large media file, such as a video or a high-resolution image.

[0050] In order to dynamically adjust the data segment size, the client needs to monitor the network transmission rate in real time. This can be achieved in many ways, such as: using TCP's window size adjustment mechanism to estimate the current network transmission bandwidth. Calling the network monitoring API provided by the operating system to obtain the real-time upload speed of the network interface. Establishing a test transmission of a small data packet and evaluating the network transmission rate by calculating the transmission time of the data packet.

[0051] Based on the detected network transmission rate, the client divides the file into multiple data segments for transmission. If the network transmission rate is high (for example, greater than 50Mbps), the file is divided into larger segments, each of which is approximately 1MB in size. This can reduce the number of segments and the proportion of header information in each data packet, thereby improving transmission efficiency. If the network transmission rate is low (for example, less than 10Mbps), the file is divided into smaller segments, each of which is approximately 64KB in size. Smaller data segments can be retransmitted faster, reducing delays when the network is congested or the signal is unstable.

[0052] In some embodiments, multiple layers of encryption are performed on the data to be transmitted to obtain encrypted data, which can be specifically achieved through the following steps: using a first encryption method to perform a first layer of encryption on the data to be transmitted to obtain initial encrypted data, wherein the first encryption method is encryption using an AES algorithm; using a second encryption method to perform a second layer of encryption on the initial encrypted data to obtain intermediate encrypted data, wherein the second encryption method is encryption using an RSA algorithm; using a third encryption method to perform a third layer of encryption on the intermediate encrypted data to obtain the encrypted data, wherein the third encryption method is encryption using a hash function.

[0053] In this solution, through a three-layer encryption mechanism, data is protected in multiple ways during transmission. Even if one layer is cracked, there are other layers of encryption as a backup, which greatly improves data security and the ability to resist attacks.

[0054] The AES (Advanced Encryption Standard) algorithm is used as the first layer of encryption. AES is a symmetric encryption algorithm that uses the same key for encryption and decryption, so it is efficient when processing large amounts of data.

[0055] RSA is a public key cryptographic algorithm. In an asymmetric encryption algorithm, there are two keys: a public key and a private key. They are a pair. If you encrypt with a public key, you can only decrypt with the corresponding private key; if you encrypt with a private key, you can only decrypt with the corresponding public key.

[0056] The process of exchanging confidential information using an asymmetric encryption algorithm is as follows: Party A generates a pair of keys and discloses one of them as a public key to other parties; Party B, having obtained the public key, uses the key to encrypt the confidential information and sends it to Party A; Party A then uses its own private key to decrypt the encrypted information.

[0057] On the basis of the first layer of encryption, the RSA (Rivest-Shamir-Adleman) algorithm is used for the second layer of encryption. RSA is an asymmetric encryption algorithm that uses public key encryption and private key decryption, so that even if the initial encrypted data is intercepted during transmission, the attacker cannot decrypt the data without the private key. Through this second layer of encryption, the security of the data is further enhanced, especially when transmitting data in an insecure network environment (such as the Internet).

[0058] The last layer of encryption uses a hash function, such as SHA-256 (Secure Hash Algorithm), to generate a summary or hash value of the intermediate encrypted data. Although the hash function itself does not provide reversible encryption, it can be used for data integrity verification, that is, the receiver can calculate the summary of the encrypted data through the same hash function and compare it with the summary provided by the sender to ensure that the data has not been tampered with during transmission. This layer of encryption mainly provides data integrity guarantees.

[0059] Specifically, in order to match the data transmission process with high security performance requirements, each layer of encryption is performed separately. The first layer of encryption is performed on the data of each segment, and a symmetric encryption algorithm (such as AES) is used for encryption. The encrypted result of each segment is encrypted at the second layer, and an asymmetric encryption algorithm (such as RSA) is used for encryption. The third layer of encryption is performed on the second layer of encryption result of each segment, and a hash value is generated using a hash function (such as SHA-256) (no key is required, and the hash value needs to be recorded) as an additional security layer.

[0060] The first layer of encryption: usually uses a symmetric encryption algorithm, such as AES (Advanced Encryption Standard), to encrypt data. Symmetric encryption algorithms use the same key for encryption and decryption, which is more efficient and suitable for encrypting large amounts of data.

[0061] Second layer of encryption: Asymmetric encryption algorithms, such as RSA, can be used to encrypt the first layer of keys or encrypted data again. Asymmetric encryption algorithms use public and private key pairs, with the public key used for encryption and the private key used for decryption. This allows symmetric keys to be exchanged securely on the public Internet, thereby protecting data from being stolen by third parties.

[0062] Third layer of encryption: In some cases, a hash function may be used to generate a summary of the data as an additional layer of security verification. Although this step does not involve a key, it can ensure the integrity of the data during transmission.

[0063] In the prior art, single-layer encryption methods are easy to crack, and although multi-layer encryption methods improve security, they usually lead to reduced efficiency of the encryption and decryption process, affecting user experience. Therefore, this solution also provides the following other encryption methods.

[0064] In the specific implementation process, after obtaining the data to be transmitted, the method further includes the following steps: obtaining the sensitivity of the data to be transmitted, wherein the sensitivity is the risk level of the data to be transmitted; encrypting the data to be transmitted according to the sensitivity of the data to be transmitted to obtain the encrypted data, wherein the sensitivity is positively correlated with the security level of the encryption algorithm.

[0065] In this solution, by dynamically selecting encryption algorithms, a balance can be found between the high security requirements of data and the high efficiency requirements of data processing. Highly sensitive data uses advanced encryption algorithms to ensure data security; low-sensitivity data uses more efficient algorithms to reduce processing delays and improve system performance. For low-sensitivity data, there is no need to use an overly high encryption security level, which can save computing resources and network bandwidth and avoid unnecessary resource waste.

[0066] Specifically, the appropriate encryption algorithm is dynamically selected according to the sensitivity of the data. For example, for highly sensitive data, a more secure algorithm (such as ChaCha20) can be selected; for low-sensitivity data, an algorithm with lower computing resource consumption (such as AES-128) can be selected. This selection is based on the parameters passed in by the user, and the user determines whether the data is highly sensitive or low-sensitivity through the parameters passed in.

[0067] Specifically, before data is transmitted, the sensitivity of the data is assessed, which reflects the risk level of the data, that is, the impact and loss that may be caused by the leakage or tampering of the data. The sensitivity of the data can be determined based on multiple factors, such as the type of data (personal identity information, financial data, health records, etc.), the source and destination of the data, and the purpose of the data. By analyzing these factors, a sensitivity level such as high, medium, or low is assigned to the data.

[0068] According to the sensitivity level of the data, select an encryption algorithm with the appropriate security level. For highly sensitive data, a more secure and complex encryption algorithm will be selected to provide stronger data protection. For less sensitive data, a more efficient but less secure encryption algorithm can be selected to balance the performance overhead brought by encryption.

[0069] When processing data, a basic principle is followed: the more sensitive the data, the higher the security requirements of the encryption algorithm. For example, for highly sensitive personal identity information, multi-layer encryption, complex key management and strict access control policies can be used; while for low-sensitivity public information, only simple symmetric encryption or even no encryption can be used.

[0070] For example, enterprise-level file sharing systems need to handle files of different sensitivity levels, from public materials to highly confidential financial reports and customer data. In order to ensure data security and operational efficiency, a dynamic encryption mechanism based on file sensitivity is implemented.

[0071] When a user uploads a file through an enterprise file sharing system, the file's metadata is first obtained, including the file type, content summary, and user-defined tags (such as "public", "internal", "confidential"). Based on this information, the sensitivity of the file is automatically assessed, that is, the risk level of the file. For example, financial reports and customer data can be marked as the most sensitive, while public materials are the least sensitive.

[0072] The encryption algorithm is dynamically selected based on the sensitivity of the file. For highly sensitive files, such as financial reports and customer data, AES-256 (Advanced Encryption Standard) will be used for symmetric encryption, which is a very secure encryption standard that can effectively protect data from attacks. For moderately sensitive files, such as internal meeting minutes, AES-192 can be selected. For low-sensitivity files, such as public materials, AES-128 can be selected to achieve a better balance between security and efficiency.

[0073] For the most sensitive files, not only is AES-256 encrypted, but the AES key is also encrypted twice using RSA (an asymmetric encryption algorithm) on top of the encryption layer to protect the key itself. This layer of encryption ensures that even if the data is intercepted during transmission, the attacker cannot easily decrypt the data because the AES key cannot be obtained without the RSA private key.

[0074] Before sending the encrypted data, the SHA-3 hash function is also used to generate a summary or hash value of the file, which is sent together with the encrypted data. After the receiver decrypts the data, he can use the same hash function to generate a summary of the decrypted file and compare it with the summary provided by the sender to verify the integrity of the data during transmission and ensure that the file has not been tampered with.

[0075] To determine the sensitivity of data, first of all, we need to make a preliminary classification based on the type of data. For example, personal identity information (such as ID number, bank account information), health information, financial records, etc. are usually considered high-sensitivity data; while some public information, statistical data, or data that has been desensitized can be classified as medium or low sensitivity.

[0076] Analyze the specific content of the data to check whether it contains sensitive personal or corporate information. For example, identify data containing sensitive information through keyword search, data pattern matching, etc.

[0077] Determine the purpose of the data, such as whether it is for public sharing, internal reference, or critical business decision making. Data with different purposes may require different levels of protection.

[0078] Analyze the risk of data leakage when appropriate protection measures are not taken. High-risk data (such as data that may cause identity theft, financial loss, etc.) is classified as high sensitivity.

[0079] Consider the life cycle of data, including the stages of data generation, storage, processing, transmission and destruction. Data may have different sensitivities at different stages of the life cycle, and targeted protection measures need to be taken.

[0080] In some embodiments, after obtaining the data to be transmitted, the method further includes the following steps: obtaining the congestion condition of the network; encrypting the data to be transmitted according to the congestion condition to obtain the encrypted data, wherein the congestion degree of the network is negatively correlated with the complexity of the encryption algorithm.

[0081] In this scheme, when the network is congested, reducing the complexity of the encryption algorithm can reduce the computational burden of data transmission, thereby reducing the delay of data transmission, avoiding the data transmission bottleneck caused by encryption processing, and more efficiently utilizing network resources.

[0082] Specifically, before data transmission, the current network status will be monitored to assess the degree of network congestion. This can be achieved by measuring network bandwidth, packet loss rate, delay time and other parameters. Generally speaking, the more severe the network congestion (e.g., low bandwidth, high delay, high packet loss rate), the lower the efficiency of data transmission.

[0083] Dynamically select encryption algorithms and their parameter configurations based on the degree of network congestion. When the network is in good condition, a more complex encryption algorithm (such as AES-256 or combined with asymmetric encryption) can be used to provide a higher level of data protection; when the network is in poor condition, a less complex encryption algorithm (such as AES-128) is selected to reduce the time and computing resources required for the encryption and decryption process, thereby reducing data transmission delays and improving transmission efficiency.

[0084] For example, real-time video streaming services (such as online conferences and live broadcast platforms) need to balance data security and transmission efficiency under different network conditions. In public Wi-Fi or mobile network environments, network congestion changes frequently, affecting the transmission quality of video streams and user experience. Therefore, it is necessary to dynamically adjust the complexity of the encryption algorithm according to the real-time congestion status of the network to ensure that stable and secure services can be provided in different network environments.

[0085] Real-time monitoring of network status, including but not limited to:

[0086] Bandwidth detection: Regularly detect available bandwidth to evaluate the current network's carrying capacity.

[0087] Packet loss rate and latency: Monitor packet loss rate and transmission latency to determine network stability and congestion levels.

[0088] Network type identification: Identify the type of network the user is currently using (such as fiber, Wi-Fi, 3G / 4G / 5G mobile network). Different types of networks may have different characteristics, such as stability, bandwidth, latency, etc.

[0089] When the network conditions are good (such as sufficient bandwidth, low packet loss rate, and short latency), the AES-256 encryption algorithm will be used. This is an advanced symmetric encryption algorithm that can provide high security protection for video streams while maintaining relatively high transmission efficiency.

[0090] When network conditions are moderate (such as low bandwidth, slight packet loss and latency), the AES-192 encryption algorithm can be selected to achieve a better balance between security and efficiency.

[0091] When network conditions are poor (such as extremely low bandwidth, high packet loss rate and high latency), the AES-128 encryption algorithm will be selected. Although the security strength of this algorithm is slightly lower than that of AES-256 and AES-192, its computational cost is also lower, which helps to reduce delays in the encryption and decryption process and ensure that video streams can still maintain basic transmission efficiency in congested network environments.

[0092] The video stream data is encrypted according to the selected encryption algorithm. The encrypted video stream data adopts different transmission strategies as the network conditions change. For example, when the network is congested, the video resolution or frame rate can be reduced to adapt to the transmission conditions of lower bandwidth.

[0093] In the specific implementation process, after obtaining the data to be transmitted, the above method also includes the following steps: obtaining the type of network, wherein the above type includes a public network or an intranet; when the above type of the above network is the above public network, using a first encryption algorithm to encrypt the above data to be transmitted to obtain the above encrypted data; when the above type of the above network is the above intranet, using a second encryption algorithm to encrypt the above data to be transmitted to obtain the above encrypted data, wherein the strength of the above first encryption algorithm is greater than the strength of the above second encryption algorithm.

[0094] In this solution, in the public network environment, the use of a high-strength first encryption algorithm can effectively resist potential attacks and threats and protect the security of data during transmission, especially in scenarios where the data involves sensitive information (such as personal privacy and commercial secrets). For intranet data transmission, since the environment is relatively safe, the use of a lower-strength second encryption algorithm can reduce the consumption of computing resources during encryption and decryption, improve the efficiency of data processing and transmission, and maintain basic data security.

[0095] Specifically, first identify the type of network where the data is transmitted, and determine whether it is a public network (such as the Internet) or an intranet (such as an enterprise internal network or a home LAN). Generally, the public network environment is more complex and uncontrollable, and there are more attacks and threats that may be encountered during data transmission. Therefore, data transmission in the public network requires higher security.

[0096] Depending on the type of network, different encryption algorithms of different strengths are selected for data encryption. In a public network environment, a first encryption algorithm with a higher strength (such as AES-256) will be selected. This algorithm has a strong anti-attack capability and can provide a higher level of protection for data transmission. In an intranet environment, since the network is relatively controllable and the risk of external attacks is low, a second encryption algorithm with a lower strength (such as AES-128) will be selected. Although the security level is slightly lower, the computing cost and transmission delay are also reduced accordingly, thereby improving the efficiency of data transmission.

[0097] For the identified network type, the data will be encrypted according to the selected encryption algorithm and then transmitted through the corresponding network. In the public network, a high-strength encryption algorithm is used, and even if the data is intercepted, it is difficult to crack, ensuring the security of the data; in the intranet, a lower-strength encryption algorithm is used to reduce the time required for encryption and decryption and improve the efficiency of data transmission.

[0098] In some embodiments, before performing multiple layers of encryption on the data to be transmitted to obtain the encrypted data, the method further includes the following steps: obtaining the key used in the process of transmitting the data; obtaining the update frequency, wherein the update frequency is the frequency of updating the key; and updating the key according to the update frequency to obtain an updated key.

[0099] In this scheme, the key update mechanism reduces the risk of long-term eavesdropping and analysis of the key by regularly changing the key. Even if an attacker intercepts the key at a certain moment, he can only decrypt the data transmitted during that period of time, but cannot decrypt the data after the key is updated, thereby enhancing the overall security of data transmission.

[0100] Specifically, first obtain the encryption key used in the current data transmission, which can be a symmetric key (such as an AES key), a public / private key pair (such as an RSA key), or other types of security keys.

[0101] Set the key update frequency, which is the periodic time or condition for key update. The update frequency can be a fixed time interval (such as once an hour), or it can be triggered by dynamic conditions such as data transmission volume, network status, security events, etc.

[0102] When the preset update frequency is reached, a new key is generated and the old key is replaced with the new key for subsequent data encryption and decryption. The updated key is immediately applied to data encryption during transmission, while the existing encrypted data continues to be decrypted using the old key, ensuring the continuity of the transmission process and the decryptability of the data.

[0103] For example, the financial industry involves a large amount of sensitive information, such as personal identity information, bank account information, transaction records, etc. These data must be strictly protected during transmission to prevent theft or tampering. However, in the Internet environment, the threats and attack methods faced by data transmission are constantly escalating, and a single long-term unchanging key cannot guarantee the long-term security of data. Therefore, designing an encryption scheme that can dynamically change keys according to the update frequency is crucial to the security and compliance of financial transactions.

[0104] When a financial transaction system is started, an initial key is generated to encrypt and decrypt the initial data transmission. This initial key can be a symmetric key (such as an AES key) or an asymmetric key pair (such as an RSA public key and private key).

[0105] The administrator sets the key update frequency based on the security policy. For example, it can be configured to automatically update every 30 minutes, or manually update when a specific event triggers it, such as when a security threat is detected, the system restarts, or a user logs in.

[0106] When the preset update frequency is reached, the key update operation will be automatically performed. Generate a new encryption key, which can be randomly generated or generated according to certain algorithms or rules. After the new key is generated, a validity check will be performed to ensure that the new key meets security requirements, such as key length, complexity, etc. In symmetric encryption schemes, the new key needs to be transmitted to the data recipient in a secure manner, such as using an asymmetric encryption algorithm (such as RSA) for key encapsulation and transmission. In asymmetric encryption schemes, the public and private key pairs are already pre-set between the two parties to the transaction, and no additional key exchange is required. Set the new key as the key used for the current transmitted data, and mark the old key as invalid, to ensure that subsequent data is encrypted with the new key.

[0107] The data sender uses the latest key to encrypt the transaction data and then transmits it to the receiver through the network. After receiving the data, the receiver uses the currently valid key to decrypt it and restore the original transaction data.

[0108] In some embodiments, before sending the encrypted data to the target terminal, the method further includes the following steps: storing the public key at the sending end and the receiving end; and storing the private key at the receiving end.

[0109] In this solution, the private key is only held by the receiving end, ensuring the uniqueness and security of data decryption. Even if the encrypted data is intercepted during transmission, the interceptor cannot decrypt the data without the private key, which provides strong security for data transmission.

[0110] Specifically, key management in multi-layer encryption methods is complex and prone to the risk of key leakage.

[0111] The first layer of keys is stored at both ends. The sender stores the original key, and the receiver stores the AES key encrypted with the RSA private key. When the receiver uses it, it is decrypted by the asymmetric algorithm public key. The receiver stores the private key, and the sender stores the public key. The receiver generates a pair of private and public keys. The public key is stored at both ends, and the private key is only stored at the receiver. Generate the hash value of the third layer of encryption and store it with the encrypted data. Introduce a dynamic key management mechanism, and push the key to the receiver and sender through service updates at regular intervals (while updating the encrypted AES key value at the receiver).

[0112] The key is updated and pushed to the sender and receiver through other services (key management module) at regular intervals. A mark is set. When the key is used for encryption and decryption, the mark is queried. The mark 0 indicates normal, and 1 indicates key update. When the key management module updates the key, it sends a message to each receiving end (the message content mainly includes the new key and the current timestamp). After receiving the message, the receiving end will return the confirmation to the key management module. When the management module receives all the confirmation information, the query mark will be changed to 0, indicating that the update is complete and the normal state is restored. When encrypting and decrypting, a request query mark is sent to the update module. If the mark is 0, normal encryption and decryption will be performed. If it is 1, it means that it is being updated. When the decryption end receives the encrypted message and is ready to decrypt, it will query the management module mark as 1. If the update notification is received at this time, the encrypted message is judged by the timestamp whether it is before or after the key update. If it is before encryption, the original key is used for decryption. If it is after, the new key is used for decryption.

[0113] The encrypted data segments, identifiers, hashes and other information are transmitted through a secure transmission protocol (such as HTTPS). The public key is stored at both the sender and receiver. In addition, the sender uses the public key to encrypt the information, and the receiver uses the private key to decrypt the message. Therefore, there will be no key leakage.

[0114] For the receiving end, the hash value generated for the third-layer encrypted information is compared with the transmission hash value of the segment to verify the integrity of the data. The second-layer encrypted data is decrypted using the RSA public key. The AES key encrypted by the private key is taken from the storage, and the encrypted information is decrypted using the RSA public key to obtain the AES key, which is then used to decrypt the data segment. The decrypted data segments are reassembled according to the identifier to restore the original data.

[0115] The above-mentioned scheme of the present application improves data security through a multi-level, multi-algorithm encryption method combined with dynamic key management and adaptive encryption algorithm selection, while optimizing the efficiency of encryption and decryption to meet the needs of different scenarios.

[0116] In summary, the above scheme of the present application improves the security of data through multi-layer encryption technology, combined with dynamic key management and adaptive encryption algorithm selection, making data more difficult to crack during transmission and storage. Through reasonable key management and segmentation processing, as well as adaptive encryption algorithm selection, the efficiency of encryption and decryption is optimized and the consumption of computing resources is reduced. It supports encryption algorithms at different levels and can be adjusted and optimized according to specific needs to adapt to different data protection needs.

[0117] The present application embodiment also provides a data encryption device. It should be noted that the data encryption device of the present application embodiment can be used to execute the encryption method for data provided by the present application embodiment. The device is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions thereof will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and contemplated.

[0118] The following is an introduction to the data encryption device provided in the embodiments of the present application.

[0119] Figure 4 is a structural block diagram of a data encryption device according to an embodiment of the present application. Figure 4 As shown, the device comprises:

[0120] A first acquisition unit 10, used to acquire initial data and network transmission rate;

[0121] Segmentation unit 20, used for segmentation unit, used for segmenting the initial data according to the network transmission rate to obtain data to be transmitted, wherein the size of the network transmission rate and the size of the data segment are positively correlated;

[0122] The first encryption unit 30 is used to perform multi-layer encryption on the data to be transmitted to obtain encrypted data;

[0123] The sending unit 40 is used to send the encrypted data to the target terminal.

[0124] Through this embodiment, in a high-speed network environment, using larger data segments can reduce the overhead of segment header information and improve transmission efficiency. In a low-speed or unstable network environment, smaller data segments help to quickly retransmit lost data packets, reduce retransmission delays, and improve transmission reliability. Through multi-layer encryption technology, data is more difficult to be cracked during transmission, thereby improving data security.

[0125] In some embodiments, the first encryption unit includes a first encryption module, a second encryption module and a third encryption module. The first encryption module is used to adopt a first encryption method to perform a first layer of encryption on the above-mentioned data to be transmitted to obtain initial encrypted data, wherein the first encryption method is encryption using the AES algorithm; the second encryption module is used to adopt a second encryption method to perform a second layer of encryption on the above-mentioned initial encrypted data to obtain intermediate encrypted data, wherein the second encryption method is encryption using the RSA algorithm; the third encryption module is used to adopt a third encryption method to perform a third layer of encryption on the above-mentioned intermediate encrypted data to obtain the above-mentioned encrypted data, wherein the third encryption method is encryption using a hash function.

[0126] In this solution, through a three-layer encryption mechanism, data is protected in multiple ways during transmission. Even if one layer is cracked, there are other layers of encryption as a backup, which greatly improves data security and the ability to resist attacks.

[0127] During the specific implementation process, the above-mentioned device also includes a second acquisition unit and a second encryption unit. The second acquisition unit is used to obtain the sensitivity of the above-mentioned data to be transmitted after obtaining the data to be transmitted, wherein the above-mentioned sensitivity is the risk level of the above-mentioned data to be transmitted; the second encryption unit is used to encrypt the above-mentioned data to be transmitted according to the above-mentioned sensitivity of the above-mentioned data to be transmitted to obtain the above-mentioned encrypted data, wherein the level of the above-mentioned sensitivity is positively correlated with the security level of the encryption algorithm.

[0128] In this solution, by dynamically selecting encryption algorithms, a balance can be found between the high security requirements of data and the high efficiency requirements of data processing. Highly sensitive data uses advanced encryption algorithms to ensure data security; low-sensitivity data uses more efficient algorithms to reduce processing delays and improve system performance. For low-sensitivity data, there is no need to use an overly high encryption security level, which can save computing resources and network bandwidth and avoid unnecessary resource waste.

[0129] In some embodiments, the above-mentioned device also includes a third acquisition unit and a third encryption unit. The third acquisition unit is used to obtain the congestion condition of the network after obtaining the data to be transmitted; the third encryption unit is used to encrypt the above-mentioned data to be transmitted according to the above-mentioned congestion condition to obtain the above-mentioned encrypted data, wherein the congestion degree of the above-mentioned network is negatively correlated with the complexity of the encryption algorithm.

[0130] In this scheme, when the network is congested, reducing the complexity of the encryption algorithm can reduce the computational burden of data transmission, thereby reducing the delay of data transmission, avoiding the data transmission bottleneck caused by encryption processing, and more efficiently utilizing network resources.

[0131] During the specific implementation process, the above-mentioned device also includes a fourth acquisition unit, a fourth encryption unit and a fifth encryption unit. The fourth acquisition unit is used to obtain the type of network after obtaining the data to be transmitted, wherein the above-mentioned type includes a public network or an intranet; the fourth encryption unit is used to, when the above-mentioned type of the above-mentioned network is the above-mentioned public network, use the first encryption algorithm to encrypt the above-mentioned data to be transmitted to obtain the above-mentioned encrypted data; the fifth encryption unit is used to, when the above-mentioned type of the above-mentioned network is the above-mentioned intranet, use the second encryption algorithm to encrypt the above-mentioned data to be transmitted to obtain the above-mentioned encrypted data, wherein the strength of the above-mentioned first encryption algorithm is greater than the strength of the above-mentioned second encryption algorithm.

[0132] In this solution, in the public network environment, the use of a high-strength first encryption algorithm can effectively resist potential attacks and threats and protect the security of data during transmission, especially in scenarios where the data involves sensitive information (such as personal privacy and commercial secrets). For intranet data transmission, since the environment is relatively safe, the use of a lower-strength second encryption algorithm can reduce the consumption of computing resources during encryption and decryption, improve the efficiency of data processing and transmission, and maintain basic data security.

[0133] In some embodiments, the above-mentioned device also includes a fifth acquisition unit, a sixth acquisition unit and an update unit. The fifth acquisition unit is used to obtain the key used in the data transmission process before performing multiple layers of encryption on the above-mentioned data to be transmitted to obtain the encrypted data; the sixth acquisition unit is used to obtain the update frequency, wherein the above-mentioned update frequency is the frequency of updating the above-mentioned key; the update unit is used to update the above-mentioned key according to the above-mentioned update frequency to obtain an updated key.

[0134] In this scheme, the key update mechanism reduces the risk of long-term eavesdropping and analysis of the key by regularly changing the key. Even if an attacker intercepts the key at a certain moment, he can only decrypt the data transmitted during that period of time, but cannot decrypt the data after the key is updated, thereby enhancing the overall security of data transmission.

[0135] In some embodiments, the above-mentioned device also includes a first storage unit and a second storage unit, the first storage unit is used to store the public key at the sending end and the receiving end before sending the above-mentioned encrypted data to the target terminal; the second storage unit is used to store the private key at the receiving end.

[0136] In this solution, the private key is only held by the receiving end, ensuring the uniqueness and security of data decryption. Even if the encrypted data is intercepted during transmission, the interceptor cannot decrypt the data without the private key, which provides strong security for data transmission.

[0137] The data encryption device includes a processor and a memory, and the first acquisition unit, the first encryption unit and the sending unit are stored in the memory as program units, and the processor executes the program units stored in the memory to implement corresponding functions. The modules are all located in the same processor; or, the modules are located in different processors in any combination.

[0138] The processor includes a kernel, which retrieves the corresponding program unit from the memory. One or more kernels can be set, and the problem of single-layer encryption methods in the prior art being easily cracked and having low data security can be solved by adjusting kernel parameters.

[0139] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0140] An embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute the data encryption method.

[0141] An embodiment of the present invention provides a processor, and the processor is used to run a program, wherein the data encryption method is executed when the program is running.

[0142] The present application also provides a data encryption system, comprising one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the one or more programs include an encryption method for executing any of the above-mentioned data.

[0143] The embodiment of the present invention provides a device, the device includes a processor, a memory and a program stored in the memory and can be run on the processor, and the processor implements at least the steps of the data encryption method when executing the program. The device in this article can be a server, a PC, a PAD, a mobile phone, etc.

[0144] A computer program product includes a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the data encryption method in each embodiment of the present application are implemented.

[0145] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0146] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0147] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0148] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0149] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0150] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0151] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0152] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0153] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0154] From the above description, it can be seen that the above embodiments of the present application achieve the following technical effects:

[0155] 1) The data encryption method of the present application, in a high-speed network environment, uses larger data segments to reduce the overhead of segment header information and improve transmission efficiency. In a low-speed or unstable network environment, smaller data segments help to quickly retransmit lost data packets, reduce retransmission delays, and improve transmission reliability. Through multi-layer encryption technology, data is more difficult to be cracked during transmission, thereby improving data security.

[0156] 2) The data encryption device of the present application, in a high-speed network environment, uses larger data segments to reduce the overhead of segment header information and improve transmission efficiency. In a low-speed or unstable network environment, smaller data segments help to quickly retransmit lost data packets, reduce retransmission delays, and improve transmission reliability. Through multi-layer encryption technology, data is more difficult to be cracked during transmission, thereby improving data security.

[0157] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A data encryption method, characterized in that: include: Get initial data and network transmission rate; According to the network transmission rate, the initial data is segmented to obtain data to be transmitted, wherein the size of the network transmission rate and the size of the data segment are positively correlated; Performing multi-layer encryption on the data to be transmitted to obtain encrypted data; The encrypted data is sent to a target terminal.

2. The method according to claim 1, characterized in that Performing multi-layer encryption on the data to be transmitted to obtain encrypted data includes: Using a first encryption method, performing a first layer of encryption on the data to be transmitted to obtain initial encrypted data, wherein the first encryption method is encryption using an AES algorithm; Using a second encryption method, performing a second layer of encryption on the initial encrypted data to obtain intermediate encrypted data, wherein the second encryption method is encryption using an RSA algorithm; A third encryption method is used to perform a third layer of encryption on the intermediate encrypted data to obtain the encrypted data, wherein the third encryption method is encryption using a hash function.

3. The method according to claim 1, characterized in that After acquiring the data to be transmitted, the method further includes: Acquire the sensitivity of the data to be transmitted, wherein the sensitivity is the risk level of the data to be transmitted; According to the sensitivity of the data to be transmitted, the data to be transmitted is encrypted to obtain the encrypted data, wherein the sensitivity is positively correlated with the security level of the encryption algorithm.

4. The method according to claim 1, characterized in that: After acquiring the data to be transmitted, the method further includes: Obtain network congestion information; The data to be transmitted is encrypted according to the congestion situation to obtain the encrypted data, wherein the congestion level of the network is negatively correlated with the complexity of the encryption algorithm.

5. The method according to claim 1, characterized in that After acquiring the data to be transmitted, the method further includes: Obtain the type of network, wherein the type includes a public network or an intranet; When the type of the network is the public network, using a first encryption algorithm to encrypt the data to be transmitted to obtain the encrypted data; When the type of the network is the intranet, a second encryption algorithm is used to encrypt the data to be transmitted to obtain the encrypted data, wherein the strength of the first encryption algorithm is greater than the strength of the second encryption algorithm.

6. The method according to claim 1, characterized in that Before performing multi-layer encryption on the data to be transmitted to obtain encrypted data, the method further includes: Get the key used in the data transmission process; Obtaining an update frequency, wherein the update frequency is a frequency of updating the key; The key is updated according to the update frequency to obtain an updated key.

7. The method according to any one of claims 1 to 6, characterized in that: Before sending the encrypted data to the target terminal, the method further includes: Store the public key on both the sender and receiver; Store the private key on the receiving end.

8. A data encryption device, characterized in that: include: A first acquisition unit, used to acquire initial data and network transmission rate; A segmentation unit, configured to segment the initial data according to the network transmission rate to obtain data to be transmitted, wherein the size of the network transmission rate and the size of the data segment are positively correlated; A first encryption unit, used for performing multi-layer encryption on the data to be transmitted to obtain encrypted data; The sending unit is used to send the encrypted data to a target terminal.

9. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the data encryption method according to any one of claims 1 to 7 are implemented.

10. A data encryption system, characterized in that: include: One or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the one or more programs include an encryption method for executing data described in any one of claims 1 to 7.

Images