System, method and apparatus for data encryption

Abstract

The embodiment of the invention discloses a system, method and device for data encryption. The system comprises the following steps: a user side encrypts original data by using a first offline key to obtain first encrypted data, generates an encryption request based on a fingerprint value of the first offline key and the first encrypted data, and sends the encryption request to an auxiliary server; the auxiliary server generates a random online key, encrypts the first encrypted data through the random online key, obtains second encrypted data, sends the second encrypted data to a data storage server, and stores the fingerprint values of the second encrypted data and the first offline key, the random online key and the corresponding relation between the random online key and the second encrypted data in a query table; and the data storage server is used for receiving and storing the second encrypted data sent by the auxiliary server and returning the second encrypted data to the auxiliary server or the user side according to the request. According to the embodiment, the security and reliability of the original data can be guaranteed, and the user key can be safely updated on the premise of not changing the encrypted data.

Description

Technical Field

[0001] Embodiments of the present disclosure relate to the field of computer technology, and in particular to a system, method, and device for data encryption. Background Art

[0002] With the rapid development of information technology, data has become increasingly important and plays an important role in various fields. However, while data brings various conveniences in the information age, it also causes many problems such as data abuse, personal privacy leakage, and corporate trade secret leakage. Therefore, in recent years, relevant national departments have successively issued relevant policies and regulations to protect privacy data, and companies have also continuously improved data security through technical means.

[0003] In some specific areas, there are situations where the encrypted data cannot be updated. In these cases, a mechanism is needed to update the encryption key without updating the encrypted data content. For example, in the blockchain field, non-fungible tokens (NFTs) are non-fungible cryptographic assets with a standard token format and unique properties. Due to transparency, proof of ownership, and traceable transactions, NFTs have broad application potential in digital artwork, music, games, and other fields. Metadata is an important part of the NFT system. NFT metadata defines NFT as an object, that is, detailed information about a digital asset. NFT metadata includes detailed information such as file name and file content. The fingerprint information of metadata (hash value, such as MD5 value) is used for indexing and verification of metadata, and the fingerprint information is stored in the blockchain system with unchangeable characteristics. Therefore, NFT metadata stored in the server cannot be changed and is accessible to the public. Traditional encryption technology must update the encrypted data at the same time as updating the key. Since the key cannot be updated, it cannot be used for encryption of NFT metadata. Because transactions will make the encryption key invalid.

[0004] In the existing technology, the use of symmetric key or asymmetric key encryption can ensure the security of data during transmission, and the use of hash algorithm encryption and zero-knowledge proof technology encryption can ensure the integrity of data. However, these technologies cannot prevent the seller from continuing to access the metadata after the transaction. If the seller continues to hold the relevant key, the metadata can be decrypted and accessed at any time. Summary of the invention

[0005] Embodiments of the present disclosure provide a method and apparatus for data encryption.

[0006] In a first aspect, an embodiment of the present disclosure provides a system for data encryption, including: a user terminal, configured to encrypt original data using a first offline key to obtain first encrypted data, generate an encryption request based on a fingerprint value of the first offline key and the first encrypted data, and send the encryption request to an auxiliary server; an auxiliary server, configured to receive the encryption request, generate a random online key, encrypt the first encrypted data using the random online key to obtain second encrypted data, send the second encrypted data to a data storage server, and store the fingerprint value of the second encrypted data, the fingerprint value of the first offline key, the random online key, and the correspondence between them in a query table; a data storage server, configured to receive and store the second encrypted data sent by the auxiliary server, and return the second encrypted data to the auxiliary server or the user terminal.

[0007] In some embodiments, the user terminal is further configured to: send a decryption request and related data to the auxiliary server, wherein the related data includes: a fingerprint value of the second encrypted data and a fingerprint value of the first offline key; the auxiliary server is further configured to: receive the decryption request and related data, and send an acquisition request including the fingerprint value of the second encrypted data to the data storage server; the data storage server is further configured to: receive the acquisition request, query the second encrypted data according to the fingerprint value of the second encrypted data and return it to the auxiliary server or the user terminal; the auxiliary server is further configured to: query the random online key corresponding to the fingerprint value of the second encrypted data and the fingerprint value of the first offline key from the query table, decrypt the second encrypted data by using the random online key to obtain the first encrypted data, and return the first encrypted data to the user terminal; the user terminal is further configured to: decrypt the first encrypted data according to the first offline key to obtain the original data.

[0008] In some embodiments, the user terminal is further configured to: send a decryption request and related data to the auxiliary server, wherein the related data includes: the second encrypted data and the fingerprint value of the first offline key; the auxiliary server is further configured to: receive the decryption request and related data, calculate the fingerprint value of the second encrypted data, query the random online key corresponding to the fingerprint value of the second encrypted data and the fingerprint value of the first offline key from the query table, decrypt the second encrypted data by using the random online key to obtain the first encrypted data, and return the first encrypted data to the user terminal; the user terminal is further configured to: decrypt the first encrypted data according to the first offline key to obtain the original data.

[0009] In some embodiments, the user terminal is further configured to: send a key update request to the auxiliary server, wherein the key update request includes: the fingerprint value of the second encrypted data, the fingerprint value of the first offline key, the fingerprint value of the second offline key, and an XOR value obtained by performing an XOR operation on the first offline key and the second offline key; the auxiliary server is further configured to: receive the key update request, perform an XOR operation on the random online key and the XOR value to obtain an updated random online key, and replace the fingerprint values ​​of the random online key and the first offline key in the query table with the fingerprint values ​​of the updated random online key and the second offline key, respectively.

[0010] In some embodiments, the auxiliary server is implemented using Python and Django frameworks, receives encryption requests, decryption requests and key update requests from the user through Web services, and calls corresponding encryption methods, decryption methods and key update methods for processing.

[0011] In some embodiments, the user terminal and the auxiliary server use at least one of the following methods to generate fingerprint values: MD5, SHA, BLAKE, RIPEMD, GOST, Whirlpool, Tiger, Skein, Haval, Snefru, Panama, JH hash fingerprint algorithm.

[0012] In some embodiments, the client sends an encryption request, a decryption request, and a key update request to the auxiliary server via a GET or POST request.

[0013] In some embodiments, the original data is metadata, and the data storage server is a metadata server.

[0014] In a second aspect, an embodiment of the present disclosure provides a method for data encryption, which is applied to an auxiliary server, comprising: receiving an encryption request from a user terminal, wherein the encryption request includes: first encrypted data and a fingerprint value of a first offline key; generating a random online key; encrypting the first encrypted data by using the random online key to obtain second encrypted data; sending the second encrypted data to a data storage server; and storing the fingerprint value of the second encrypted data, the fingerprint value of the first offline key, the random online key and the correspondence between them in a query table.

[0015] In some embodiments, the method further includes: receiving a decryption request and related data from a user terminal, wherein the related data includes: a fingerprint value of the second encrypted data and a fingerprint value of the first offline key; obtaining the second encrypted data from the data storage server according to the fingerprint value of the second encrypted data; querying the random online key corresponding to the fingerprint value of the second encrypted data and the fingerprint value of the first offline key from the query table; decrypting the second encrypted data by using the random online key to obtain the first encrypted data; and returning the first encrypted data to the user terminal.

[0016] In some embodiments, the method further includes: receiving a decryption request and related data from a user terminal, wherein the related data includes: the fingerprint value of the second encrypted data and the first offline key; calculating the fingerprint value of the second encrypted data; querying the random online key corresponding to the fingerprint value of the second encrypted data and the fingerprint value of the first offline key from the query table; decrypting the second encrypted data by using the random online key to obtain the first encrypted data; and returning the first encrypted data to the user terminal.

[0017] In some embodiments, the method further includes: receiving a key update request from a user terminal, wherein the key update request includes: the fingerprint value of the second encrypted data, the fingerprint value of the first offline key, the fingerprint value of the second offline key, and an XOR value obtained by performing an XOR operation on the first offline key and the second offline key; performing an XOR operation on the random online key and the XOR value to obtain an updated random online key; and replacing the fingerprint values ​​of the random online key and the first offline key in the query table with the fingerprint values ​​of the updated random online key and the second offline key, respectively.

[0018] In a third aspect, an embodiment of the present disclosure provides a device for data encryption, comprising: a receiving unit, configured to receive an encryption request from a user terminal, wherein the encryption request comprises: first encrypted data and a fingerprint value of a first offline key; a generating unit, configured to generate a random online key; an encrypting unit, configured to encrypt the first encrypted data by using the random online key to obtain second encrypted data; a sending unit, configured to send the second encrypted data to a data storage server; and a storage unit, configured to store the fingerprint value of the second encrypted data, the fingerprint value of the first offline key, the random online key and the correspondence between them in a query table.

[0019] In some embodiments, the device also includes a decryption unit, which is configured to: receive a decryption request and related data from a user terminal, wherein the related data includes: a fingerprint value of the second encrypted data and a fingerprint value of the first offline key; obtain the second encrypted data from the data storage server according to the fingerprint value of the second encrypted data; query the random online key corresponding to the fingerprint value of the second encrypted data and the fingerprint value of the first offline key from the query table; decrypt the second encrypted data using the random online key to obtain the first encrypted data; and return the first encrypted data to the user terminal.

[0020] In some embodiments, the device also includes a decryption unit, which is configured to: receive a decryption request and related data from a user terminal, wherein the related data includes: the fingerprint value of the second encrypted data and the first offline key; calculate the fingerprint value of the second encrypted data; query the random online key corresponding to the fingerprint value of the second encrypted data and the fingerprint value of the first offline key from the query table; decrypt the second encrypted data using the random online key to obtain the first encrypted data; and return the first encrypted data to the user terminal.

[0021] In some embodiments, the device also includes an updating unit, which is configured to: receive a key update request from a user terminal, wherein the key update request includes: the fingerprint value of the second encrypted data, the fingerprint value of the first offline key, the fingerprint value of the second offline key, and an XOR value obtained by performing an XOR operation on the first offline key and the second offline key; perform an XOR operation on the random online key and the XOR value to obtain an updated random online key; and replace the fingerprint values ​​of the random online key and the first offline key in the query table with the fingerprint values ​​of the updated random online key and the second offline key, respectively.

[0022] In a fourth aspect, an embodiment of the present disclosure provides an electronic device for data encryption, comprising: one or more processors; a storage device on which one or more computer programs are stored, and when the one or more computer programs are executed by the one or more processors, the one or more processors implement a method as described in any one of the third aspects.

[0023] In a fifth aspect, an embodiment of the present disclosure provides a computer-readable medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the method as described in any one of the third aspects.

[0024] The system, method and device for data encryption provided by the embodiments of the present disclosure realize the free update of keys without changing the data through the introduction of auxiliary servers. The present disclosure can improve the security of data, especially provide higher security and reliability for NFTs. By updating the keys, it can be ensured that the NFT metadata can effectively prevent unauthorized access after the transaction occurs, especially blocking the access rights of the former owner of the NFT. This will help protect the rights and interests of NFT owners, enhance the sense of ownership of NFT holders, and bring more trust and transparency to the NFT market.

[0025] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Other features, objects and advantages of the present disclosure will become more apparent from the detailed description of non-limiting embodiments made with reference to the following drawings:

[0027] Figure 1 is an exemplary system architecture diagram in which an embodiment of the present disclosure may be applied;

[0028] Figure 2 is a schematic diagram of an application scenario of a system for data encryption according to the present disclosure;

[0029] Figure 3 is a flow chart of an embodiment of a method for data encryption according to the present disclosure;

[0030] Figure 4 is a structural schematic diagram of an embodiment of a device for data encryption according to the present disclosure;

[0031] Figure 5 It is a structural diagram of a computer system of an electronic device suitable for implementing an embodiment of the present disclosure. DETAILED DESCRIPTION

[0032] The present disclosure is further described in detail below in conjunction with the accompanying drawings and embodiments. It is understood that the specific embodiments described herein are only used to explain the relevant invention, rather than to limit the invention. It is also necessary to explain that, for ease of description, only the parts related to the relevant invention are shown in the accompanying drawings.

[0033] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present disclosure may be combined with each other. The present disclosure will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0034] Figure 1An exemplary system architecture 100 of a system for data encryption to which the present disclosure may be applied is shown.

[0035] like Figure 1 As shown, the system architecture 100 may include user terminals 101 and 102 , an auxiliary server 103 and a data storage server 104 . Figure 1 The number of user terminals, auxiliary servers, and data storage servers is only illustrative, and can be any number of user terminals, auxiliary servers, and data storage servers. In the blockchain application scenario, the data storage server is a metadata server.

[0036] Figure 1 The blockchain is only used to verify the authenticity and ownership of the NFT, while the actual data, that is, the metadata of the NFT digital asset, is stored on an independent server. The metadata of each NFT is uniquely identified by its fingerprint value (hash value). Therefore, the NFT metadata stored in the data storage server 104 cannot be changed and is accessible to the public. Although the blockchain protects the NFT, there is currently no encryption algorithm for protecting the NFT metadata. Therefore, NFT data is often illegally disseminated and transmitted, which actually affects the scarcity associated with the value of the NFT. To solve this problem, we propose an NFT metadata encryption system, which includes offline keys and an auxiliary server 103 for offline key updates. The auxiliary server 103 is responsible for generating online keys. The offline and online keys are updated synchronously each time the NFT is traded, or when the NFT user requests to update the password, realizing the update of offline keys, that is, the user key and the abolition of the old key.

[0037] The original holder A of the NFT can encrypt the NFT metadata through the user terminal 101 and the auxiliary server 103 and store it in the data storage server 104.

[0038] After holder A transfers the NFT to holder B, holder B can use the original offline key set by holder A to decrypt the metadata of the NFT through the user terminal 102 and the auxiliary server 103. Holder B can also replace the original offline key set by holder A, and the random online key in the auxiliary server 103 is also updated accordingly. At this time, holder A cannot use the original offline key to decrypt the metadata of the NFT, and can no longer access the metadata of the NFT.

[0039] The encryption, decryption and key update process of this encryption system is Figure 2 A detailed presentation is given in .

[0040] 1. Encryption process

[0041] The user end is configured to encrypt original data using a first offline key to obtain first encrypted data, generate an encryption request based on the first encrypted data and a fingerprint value of the first offline key, and send the encryption request to an auxiliary server; wherein the original data may be metadata.

[0042] an auxiliary server configured to receive the encryption request, generate a random online key, encrypt the first encrypted data by using the random online key to obtain second encrypted data, send the second encrypted data to a data storage server, and store a corresponding relationship between a fingerprint value of the second encrypted data, a fingerprint value of the first offline key, and the random online key in a query table;

[0043] The data storage server is configured to receive and store the second encrypted data sent by the auxiliary server, and return the download address of the second encrypted data to the user terminal.

[0044] like Figure 2 As shown, the encryption process requires two steps: In the first step, the user end uses the offline key (in order to distinguish different offline keys, the offline key before the update is named the first offline key, and the offline key after the update is named the second offline key). Encrypt the original data and generate encrypted metadata α. In the second step, the auxiliary server generates a random online key, and uses the online key to further encrypt the encrypted metadata α into metadata β. In addition to storing the online key itself, the auxiliary server also stores the fingerprint value of metadata β and the fingerprint value of the offline key, but does not store the metadata β itself. The encrypted metadata β finally generated is submitted to the NFT data storage server for storage. The offline key is only held by the NFT user.

[0045] 2. Decryption process

[0046] The decryption process is divided into two types: 1) The user terminal provides the fingerprint of the second encrypted data and obtains the second encrypted data from the data storage server (such as Figure 2 2) The user terminal directly provides the second encrypted data without obtaining the second encrypted data from the data storage server.

[0047] The decryption method can be selected according to the system configuration. For example, when the user end is not suitable for uploading a large amount of data, it can be selected to only provide the fingerprint of the second encrypted data, and the auxiliary server obtains the second encrypted data from the data storage server through the fingerprint of the second encrypted data.

[0048] For the first decryption process, the user terminal is further configured to: send a decryption request and related data to the auxiliary server, wherein the related data includes: a fingerprint value of the second encrypted data and a fingerprint value of the first offline key; the auxiliary server is further configured to: receive the decryption request and related data, and send a request to obtain the second encrypted data to the data storage server; the data storage server is further configured to: receive the acquisition request, query the second encrypted data according to the fingerprint value of the second encrypted data and return it to the auxiliary server or the user terminal; the auxiliary server is further configured to: query the random online key corresponding to the fingerprint value of the second encrypted data and the fingerprint value of the first offline key from the query table, decrypt the second encrypted data by using the random online key to obtain the first encrypted data, and return the first encrypted data to the user terminal; the user terminal is further configured to: decrypt the first encrypted data according to the first offline key to obtain the original data.

[0049] In the first decryption process, the user end of the NFT holder first sends a decryption request to the auxiliary server, and sends the fingerprint value of the encrypted metadata β and the fingerprint value of the offline key to the auxiliary server at the same time. After verifying the legitimacy of the fingerprint value, the auxiliary server obtains the encrypted metadata β from the NFT data storage server through the fingerprint value of the encrypted metadata β and uses the online key to decrypt and generate encrypted metadata α. The encrypted metadata α is then sent to the user end of the NFT holder. The user end of the NFT holder uses the offline key to decrypt and obtain the original metadata.

[0050] For the second decryption process, the user terminal is further configured to: send a decryption request and related data to the auxiliary server, wherein the related data includes: the second encrypted data and the fingerprint value of the first offline key; the auxiliary server is further configured to: receive the decryption request and related data, calculate the fingerprint value of the second encrypted data, query the random online key corresponding to the fingerprint value of the second encrypted data and the fingerprint value of the first offline key from the query table, decrypt the second encrypted data by using the random online key to obtain the first encrypted data, and return the first encrypted data to the user terminal; the user terminal is further configured to: decrypt the first encrypted data according to the first offline key to obtain the original data.

[0051] In the second decryption process, the NFT holder's client first sends a decryption request (including the encrypted metadata β and the fingerprint value of the offline key) to the auxiliary server. After verifying the legitimacy of the fingerprint value, the auxiliary server uses the online key to decrypt the encrypted metadata β to generate encrypted metadata α. The encrypted metadata α is then sent to the NFT holder's client. The NFT holder's client uses the offline key to decrypt and obtain the original metadata.

[0052] 3. Key update process

[0053] The user terminal is further configured to: send a key update request to the auxiliary server, wherein the key update request includes: a fingerprint value of the second encrypted data, a fingerprint value of the first offline key, a fingerprint value of the second offline key, and an XOR value obtained by performing an XOR operation on the first offline key and the second offline key; the auxiliary server is further configured to: receive the key update request, perform an XOR operation on the random online key and the XOR value of the first offline key and the second offline key to obtain an updated random online key, and replace the fingerprint values ​​of the random online key and the first offline key in the query table with the fingerprint values ​​of the updated random online key and the second offline key, respectively.

[0054] After each NFT transaction and during the active key update process, the NFT holder first customizes a new offline key, that is, the user key. Then the XOR value of the old offline key and the new offline key is calculated. Then, the metadata β and the fingerprint values ​​of the old and new offline keys, as well as the XOR values ​​of the old and new keys are provided to the auxiliary server to request a key update. After verifying the legitimacy of the relevant information, the auxiliary server performs a new XOR operation on the old online key and the XOR values ​​of the old and new offline keys provided by the user, and uses the calculation result to replace the updated online key. Through this process, the new online key is updated synchronously with the new offline key, and the offline key, that is, the user key, can be updated without updating the encrypted metadata β.

[0055] In some optional implementations of this embodiment, the auxiliary server is implemented using Python and Django frameworks, receives encryption requests, decryption requests and key update requests from the user terminal through Web services, and calls corresponding encryption methods, decryption methods and key update methods for processing.

[0056] The implementation of the auxiliary server uses Python and the Django framework. Django is an open source web application framework based on the MVC (Model-View-Controller) design pattern, with good scalability and reusability. In order to implement online encryption and decryption operations, we implemented a web service using the Django framework. In this service, a RESTful API is provided through the HTTP protocol. Encryption, decryption, key update and other operation requests can be sent to the server through GET or POST requests, and the corresponding return results can be obtained.

[0057] You can create a new application in the Django framework. Create a view file under the application, which contains three view functions: encryption function, decryption function and update function, which are used to process encryption, decryption and key update operations respectively.

[0058] Finally, create a URL mapping file to map the requested URL to the corresponding view function. Start Django's development server on the server to listen for encryption, decryption, and key requests from NFT holders.

[0059] In some optional implementations of this embodiment, the user terminal and the auxiliary server use at least one of the following methods to generate a fingerprint value: MD5, SHA, BLAKE, RIPEMD, GOST, Whirlpool, Tiger, Skein, Haval, Snefru, Panama, and JH hash fingerprint algorithms.

[0060] MD5 is a commonly used hash fingerprint algorithm that can transform a binary value of any length into a 128-bit (32 hexadecimal digits) large integer through an algorithm. It has the characteristics of irreversibility and inability to reproduce the original data, and is very suitable for generating data fingerprints. Therefore, this embodiment selects MD5 as the fingerprint encryption algorithm. It should be pointed out that other fingerprint encryption algorithms, such as SHA, are also applicable to this system.

[0061] In some optional implementations of this embodiment, the user terminal sends an encryption request, a decryption request, and a key update request to the auxiliary server through a GET or POST request.

[0062] Encryption function: This function handles encryption requests from the user side in GET and POST methods. If it is a GET request, it will return a form in which the user can upload the encrypted metadata α that has been encrypted by the offline user password on the user side, as well as the MD5 fingerprint value of the user's offline key. The relevant calculations and information can be completed and generated by the encryption and decryption script on the user side. If it is a POST request, it will receive the encrypted metadata α from the user and the MD5 fingerprint value of the user's offline key, generate a random online key with the same length as the offline key, and perform an XOR operation on the online key and the encrypted metadata α to obtain the encrypted metadata β. Then, the metadata β will be written to the disk, and the MD5 fingerprint value of the metadata β, the MD5 fingerprint value of the offline key, and the online key will be stored in the database. Finally, the download address of the metadata β file is returned for the user to download.

[0063] Decryption function: This function handles GET and POST decryption requests from the user side. If it is a GET request, it will return a form in which the user can upload the metadata β to be encrypted and the fingerprint value of the user's offline key. If it is a POST request, it will receive the encrypted metadata β and the fingerprint value of the user's offline key. Calculate the MD5 fingerprint value of the encrypted metadata, and then use the fingerprint value of the metadata and the fingerprint value of the user's offline key to retrieve the corresponding online random key stored in the database. Then use the random key to perform an XOR operation to decrypt the encrypted metadata β to generate metadata α. The decrypted metadata α will be returned to the user. NFT holders can subsequently use the offline key to continue decrypting to obtain the original metadata.

[0064] Update function: This function handles key update requests from the user in GET and POST methods. If it is a GET request, it will return a password update form, in which the user can enter the MD5 fingerprint value of the encrypted metadata β, the MD5 fingerprint values ​​of the old offline key and the new offline key, and the XOR value of the old and new offline keys. If it is a POST request, the corresponding online random key record is retrieved through the MD5 fingerprint value of the encrypted metadata β and the MD5 fingerprint value of the old offline key, and then the MD5 value of the old key is replaced with the MD5 value of the new key. Then the XOR value of the old and new offline keys is XORed with the old online key. The calculation result is used as the new online key to replace the old online key, thereby completing the synchronous update of the online key and the offline key. The old online random key will become invalid.

[0065] Continue to refer Figure 3 , shows a process 300 of an embodiment of a method for data encryption according to the present disclosure. The method for data encryption, applied to an auxiliary server, comprises the following steps:

[0066] Step 301: receiving an encryption request from a user terminal.

[0067] In this embodiment, the execution subject of the method for data encryption (for example Figure 1 The auxiliary server shown) can receive an encryption request from the user end that the NFT holder uses to encrypt metadata through a wired connection or a wireless connection, wherein the encryption request includes: the first encrypted data and the fingerprint value of the first offline key. The user end encrypts the original data with the first offline key in advance to obtain the first encrypted data. The user end also calculates the fingerprint value of the first offline key through the MD5 algorithm. The user end then sends the first encrypted data and the fingerprint value of the first offline key to the auxiliary server, which performs secondary encryption.

[0068] Step 302, generate a random online key.

[0069] In this embodiment, the auxiliary server generates a corresponding random online key for each first encrypted data. If the first encrypted data is changed, the random online key is regenerated. The length of the random online key is consistent with the length of the first offline key.

[0070] Step 303: encrypt the first encrypted data using a random online key to obtain second encrypted data.

[0071] In this embodiment, an XOR operation is performed on the random online key and the first encrypted data to obtain the second encrypted data.

[0072] Step 304: Send the second encrypted data to the data storage server.

[0073] In this embodiment, the second encrypted data is written into a disk, which may be a disk on a data storage server or a local disk of an auxiliary server.

[0074] Step 305: store the fingerprint value of the second encrypted data, the fingerprint value of the first offline key, the random online key and the corresponding relationship between them in a lookup table.

[0075] In this embodiment, the mapping relationship between the three is stored in a query table, so as to prepare for subsequent query of the random online key according to the fingerprint value of the second encrypted data and the fingerprint value of the first offline key.

[0076] In some optional implementations of this embodiment, the method further includes: receiving a decryption request and related data from a user terminal, wherein the related data includes: the fingerprint value of the second encrypted data and the fingerprint value of the first offline key; obtaining the second encrypted data from the data storage server according to the fingerprint value of the second encrypted data; querying the random online key corresponding to the fingerprint value of the second encrypted data and the fingerprint value of the first offline key from the query table; decrypting the second encrypted data by using the random online key to obtain the first encrypted data; and returning the first encrypted data to the user terminal. After the NFT is transferred, Figure 1 As shown, the new holder B can generate the fingerprint value of the first offline key based on the first offline key provided by the original holder A. The original holder A can also provide the fingerprint value of the second encrypted data, or only provide the second encrypted data, and the fingerprint value of the second encrypted data is generated by the user terminal of holder B. If holder B wants to see the original data, he needs to send the fingerprint value of the second encrypted data and the fingerprint value of the first offline key to the auxiliary server. The auxiliary server can query the random online key that it used for encryption before based on the fingerprint value of the second encrypted data and the fingerprint value of the first offline key. The second encrypted data is obtained from the data storage server, and then decrypted using the random online key to obtain the first encrypted data. The user terminal can use the first offline key to decrypt and obtain the original data.

[0077] In some optional implementations of this embodiment, the method further includes: receiving a decryption request and related data from a user terminal, wherein the related data includes: the fingerprint value of the second encrypted data and the first offline key; calculating the fingerprint value of the second encrypted data; querying the random online key corresponding to the fingerprint value of the second encrypted data and the fingerprint value of the first offline key from the query table; decrypting the second encrypted data by the random online key to obtain the first encrypted data; and returning the first encrypted data to the user terminal. This implementation does not require obtaining the second encrypted data from the data storage server, but the second encrypted data is directly provided by the user terminal. The user terminal can choose to upload the second encrypted data or the fingerprint of the second encrypted data according to demand. The auxiliary server can perform corresponding processing according to the type of data received.

[0078] In some optional implementations of this embodiment, the method also includes: receiving a key update request from a user terminal, wherein the key update request includes: the fingerprint value of the second encrypted data, the fingerprint value of the first offline key, the fingerprint value of the second offline key, and an XOR value obtained by performing an XOR operation on the first offline key and the second offline key; performing an XOR operation on the random online key and the XOR value to obtain an updated random online key; and replacing the fingerprint values ​​of the random online key and the first offline key in the query table with the fingerprint values ​​of the updated random online key and the second offline key, respectively.

[0079] After each NFT transaction and during the active key update process, the NFT holder first customizes a new offline key, that is, the user key. Then the XOR value of the old offline key and the new offline key is calculated. Then, the metadata β and the fingerprint values ​​of the old and new offline keys, as well as the XOR values ​​of the old and new keys are provided to the auxiliary server to request a key update. After verifying the legitimacy of the relevant information, the auxiliary server performs a new XOR operation on the old online key and the XOR values ​​of the old and new offline keys provided by the user, and uses the calculation result to replace the updated online key. Through this process, the new online key is updated synchronously with the new offline key, and the offline key, that is, the user key, can be updated without updating the encrypted metadata β.

[0080] Further references Figure 4 As an implementation of the methods shown in the above figures, the present disclosure provides an embodiment of a device for data encryption. Figure 3 Corresponding to the method embodiment shown, the device can be specifically applied to various electronic devices.

[0081] like Figure 4 As shown, the apparatus 400 for data encryption of this embodiment includes: a receiving unit 401, a generating unit 402, an encrypting unit 403, a sending unit 404, and a storage unit 405. The receiving unit 401 is configured to receive an encryption request from a user terminal, wherein the encryption request includes: a fingerprint value of a first offline key and first encrypted data; the generating unit 402 is configured to generate a random online key; the encrypting unit 403 is configured to encrypt the first encrypted data by using the random online key to obtain second encrypted data; the sending unit 404 is configured to send the second encrypted data to a data storage server or the user terminal; the storage unit 405 is configured to store the corresponding relationship between the fingerprint value of the second encrypted data, the fingerprint value of the first offline key, and the random online key in a query table.

[0082] In this embodiment, the specific processing of the receiving unit 401, the generating unit 402, the encrypting unit 403, the sending unit 404, and the storage unit 405 of the device for data encryption 400 can be referred to. Figure 3 This corresponds to steps 301-305 in the embodiment.

[0083] In some optional implementations of this embodiment, the device 400 also includes a decryption unit (not shown in the drawings), which is configured to: receive a decryption request and related data from a user terminal, wherein the related data includes: a fingerprint value of the second encrypted data and a fingerprint value of the first offline key; obtain the second encrypted data from the data storage server according to the fingerprint value of the second encrypted data; query the random online key corresponding to the fingerprint value of the second encrypted data and the fingerprint value of the first offline key from the query table; decrypt the second encrypted data by using the random online key to obtain the first encrypted data; and return the first encrypted data to the user terminal.

[0084] In some embodiments, the device 400 also includes a decryption unit (not shown in the drawings), which is configured to: receive a decryption request and related data from a user terminal, wherein the related data includes: the fingerprint value of the second encrypted data and the first offline key; calculate the fingerprint value of the second encrypted data; query the random online key corresponding to the fingerprint value of the second encrypted data and the fingerprint value of the first offline key from the query table; decrypt the second encrypted data using the random online key to obtain the first encrypted data; and return the first encrypted data to the user terminal.

[0085] In some embodiments, the device 400 also includes an updating unit (not shown in the drawings), which is configured to: receive a key update request from a user terminal, wherein the key update request includes: the fingerprint value of the second encrypted data, the fingerprint value of the first offline key, the fingerprint value of the second offline key, and the XOR value obtained by performing an XOR operation on the first offline key and the second offline key; perform an XOR operation on the random online key and the XOR value to obtain an updated random online key; and replace the fingerprint values ​​of the random online key and the first offline key in the query table with the fingerprint values ​​of the updated random online key and the second offline key, respectively.

[0086] It should be noted that the collection, collection, updating, analysis, processing, use, transmission, storage and other aspects of user personal information involved in the technical solution of this disclosure are in compliance with the provisions of relevant laws and regulations, are used for legitimate purposes, and do not violate public order and good morals. Necessary measures are taken for user personal information to prevent illegal access to user personal information data and maintain the security of user personal information, network security and national security.

[0087] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device and a readable storage medium.

[0088] An electronic device comprises: one or more processors; a storage device having one or more computer programs stored thereon, wherein when the one or more computer programs are executed by the one or more processors, the one or more processors implement the method described in process 300.

[0089] A computer-readable medium stores a computer program, wherein the computer program implements the method described in process 300 when executed by a processor.

[0090] Figure 5 A schematic block diagram of an example electronic device 500 that can be used to implement an embodiment of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0091] like Figure 5 As shown, the device 500 includes a computing unit 501, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 502 or a computer program loaded from a storage unit 508 into a random access memory (RAM) 503. In the RAM 503, various programs and data required for the operation of the device 500 can also be stored. The computing unit 501, the ROM 502, and the RAM 503 are connected to each other via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0092] A number of components in the device 500 are connected to the I / O interface 505, including: an input unit 506, such as a keyboard, a mouse, etc.; an output unit 507, such as various types of displays, speakers, etc.; a storage unit 508, such as a disk, an optical disk, etc.; and a communication unit 509, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 509 allows the device 500 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0093] The computing unit 501 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 501 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 501 performs the various methods and processes described above, such as methods for data encryption. For example, in some embodiments, the method for data encryption may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 508. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 500 via ROM 502 and / or communication unit 509. When the computer program is loaded into RAM 503 and executed by the computing unit 501, one or more steps of the method for data encryption described above may be performed. Alternatively, in other embodiments, the computing unit 501 may be configured to perform a method for data encryption in any other appropriate manner (e.g., by means of firmware).

[0094] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0095] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0096] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0097] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0098] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0099] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship between the client and the server is generated by computer programs running on the respective computers and having a client-server relationship with each other. The server may be a server of a distributed system, or a server combined with a blockchain. The server may also be a cloud server, or an intelligent cloud computing server or intelligent cloud host with artificial intelligence technology. The server may be a server of a distributed system, or a server combined with a blockchain. The server may also be a cloud server, or an intelligent cloud computing server or intelligent cloud host with artificial intelligence technology.

[0100] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0101] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A system for data encryption, comprising: The client is configured to encrypt the original data using the first offline key to obtain first encrypted data, generate an encryption request based on the fingerprint value of the first offline key and the first encrypted data, and send the encryption request to the auxiliary server; an auxiliary server configured to receive the encryption request, generate a random online key, encrypt the first encrypted data by using the random online key to obtain second encrypted data, send the second encrypted data to a data storage server, store the fingerprint value of the second encrypted data, the fingerprint value of the first offline key, the random online key and the correspondence between them in a query table, and return the second encrypted data or the fingerprint value of the second encrypted data to a user; The data storage server is configured to receive and store the second encrypted data sent by the auxiliary server, and return the second encrypted data to the auxiliary server or the user terminal.

2. The system according to claim 1, wherein: The user terminal is further configured to: send a decryption request and related data to the auxiliary server, wherein the related data includes: a fingerprint value of the second encrypted data and a fingerprint value of the first offline key; The auxiliary server is further configured to: receive the decryption request and related data, and send a request to obtain the second encrypted data to the data storage server; The data storage server is further configured to: receive the acquisition request, query the second encrypted data according to the fingerprint value of the second encrypted data, and return the second encrypted data to the auxiliary server or the user terminal; The auxiliary server is further configured to: query the random online key corresponding to the fingerprint value of the second encrypted data and the fingerprint value of the first offline key from the query table, decrypt the second encrypted data by using the random online key to obtain the first encrypted data, and return the first encrypted data to the user terminal; The user terminal is further configured to: decrypt the first encrypted data according to the first offline key to obtain original data.

3. The system according to claim 1, wherein: The user terminal is further configured to: send a decryption request and related data to the auxiliary server, wherein the related data includes: the second encrypted data and the fingerprint value of the first offline key; The auxiliary server is further configured to: receive the decryption request and related data, calculate the fingerprint value of the second encrypted data, query the random online key corresponding to the fingerprint value of the second encrypted data and the fingerprint value of the first offline key from the query table, decrypt the second encrypted data by using the random online key to obtain the first encrypted data, and return the first encrypted data to the user terminal; The user terminal is further configured to: decrypt the first encrypted data according to the first offline key to obtain original data.

4. The system according to claim 1, wherein: The user terminal is further configured to: send a key update request to the auxiliary server, wherein the key update request includes: the fingerprint value of the second encrypted data, the fingerprint value of the first offline key, the fingerprint value of the second offline key, and an XOR value obtained by performing an XOR operation on the first offline key and the second offline key; The auxiliary server is further configured to: receive the key update request, perform an XOR operation on the random online key and the XOR value to obtain an updated random online key, and replace the fingerprint values ​​of the random online key and the first offline key in the query table with the updated random online key and the fingerprint values ​​of the second offline key respectively.

5. The system according to claim 1, wherein: The auxiliary server is implemented using Python and Django frameworks, receives encryption requests, decryption requests and key update requests from the user end through Web services, and calls corresponding encryption methods, decryption methods and key update methods for processing.

6. The system according to claim 1, wherein: The user terminal and the auxiliary server generate fingerprint values ​​using at least one of the following methods: MD5, SHA, BLAKE, RIPEMD, GOST, Whirlpool, Tiger, Skein, Haval, Snefru, Panama, and JH hash fingerprint algorithms.

7. The system according to claim 1, wherein: The client sends an encryption request, a decryption request and a key update request to the auxiliary server via a GET or POST request.

8. The system according to claim 1, wherein: The original data is metadata, and the data storage server is a metadata server.

9. A method for data encryption, applied to an auxiliary server, comprising: Receiving an encryption request from a user terminal, wherein the encryption request includes: first encrypted data and a fingerprint value of a first offline key; Generate a random online key; Encrypting the first encrypted data by using the random online key to obtain second encrypted data; sending the second encrypted data to a data storage server; The fingerprint value of the second encrypted data, the fingerprint value of the first offline key, the random online key and the corresponding relationship between them are stored in a query table.

10. The method according to claim 9, wherein: The method further comprises: receiving a decryption request and related data from a user terminal, wherein the related data includes: a fingerprint value of the second encrypted data and a fingerprint value of the first offline key; acquiring second encrypted data from the data storage server according to the fingerprint value of the second encrypted data; Querying the random online key corresponding to the fingerprint value of the second encrypted data and the fingerprint value of the first offline key from the query table; Decrypting the second encrypted data by using the random online key to obtain the first encrypted data; The first encrypted data is returned to the user terminal.

11. The method according to claim 9, wherein: The method further comprises: receiving a decryption request and related data from a user terminal, wherein the related data includes: the second encrypted data and a fingerprint value of the first offline key; Calculating a fingerprint value of the second encrypted data; Querying the random online key corresponding to the fingerprint value of the second encrypted data and the fingerprint value of the first offline key from the query table; Decrypting the second encrypted data by using the random online key to obtain the first encrypted data; The first encrypted data is returned to the user terminal.

12. The method according to claim 9, wherein: The method further comprises: receiving a key update request from a user terminal, wherein the key update request includes: a fingerprint value of the second encrypted data, a fingerprint value of the first offline key, a fingerprint value of the second offline key, and an XOR value obtained by performing an XOR operation on the first offline key and the second offline key; Performing an XOR operation on the random online key and the XOR value to obtain an updated random online key; The random online key and the fingerprint value of the first offline key in the query table are replaced with the updated fingerprint values ​​of the random online key and the second offline key respectively.

13. A device for data encryption, comprising: A receiving unit is configured to receive an encryption request from a user terminal, wherein the encryption request includes: first encrypted data and a fingerprint value of a first offline key; A generating unit configured to generate a random online key; an encryption unit, configured to encrypt the first encrypted data by using the random online key to obtain second encrypted data; A sending unit, configured to send the second encrypted data to a data storage server; The storage unit is configured to store the fingerprint value of the second encrypted data, the fingerprint value of the first offline key, the random online key and the correspondence between them in a query table.

14. An electronic device for data encryption, comprising: one or more processors; a storage device having one or more computer programs stored thereon, When the one or more computer programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 9 to 12.

15. A computer readable medium having a computer program stored thereon, wherein: When the computer program is executed by a processor, the method according to any one of claims 9 to 12 is implemented.

Images