Encryption method and system based on symmetric cryptographic algorithm

Abstract

The invention provides an encryption method and system based on a symmetric cryptographic algorithm, and the method comprises the steps: carrying out the data classification of obtained sensitive data, and obtaining structured sensitive data and unstructured sensitive data; selecting a key value field in the structured sensitive data, inputting the key value field into a preset Fermat element test algorithm, screening out a large prime number as a basic key element, and combining the basic key element with a preset key combination rule to generate an encryption key; encrypting the structured sensitive data based on the encryption key by adopting a symmetric cryptographic algorithm to obtain encrypted structured data; encrypting the unstructured sensitive data to obtain encrypted unstructured data; and integrating the encrypted structured data and the encrypted unstructured data to generate simulated desensitized data. According to the method and the device, optimization processing is performed according to the characteristics of the structured sensitive data, so that the security of the sensitive data is effectively protected.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to an encryption method and system based on a symmetric cryptographic algorithm. Background Art

[0002] Sensitive data is at risk of being leaked during the collection, storage, transmission and processing of data. In many industries, a large amount of sensitive data is stored and processed, including customers' personal identity information, financial data, medical records, etc. Once the above data is leaked, it will not only cause serious infringement of personal privacy, but also may cause huge economic losses to the company.

[0003] Although existing data encryption technology can protect data security to a certain extent, traditional encryption algorithms often use a general key generation method when processing structured sensitive data. They lack optimization for data characteristics, resulting in insufficient key security. Summary of the invention

[0004] The main purpose of the present invention is to provide an encryption method and system based on a symmetric cryptographic algorithm, aiming to overcome the defect that the security of the generated key is not high enough.

[0005] To achieve the above object, the present invention provides an encryption method based on a symmetric cryptographic algorithm, comprising the following steps: Classify the acquired sensitive data to obtain structured sensitive data and unstructured sensitive data; Selecting key numerical fields in the structured sensitive data, inputting them into a preset Fermat primality test algorithm, screening out large prime numbers as basic key elements, and combining the basic key elements with preset key combination rules to generate encryption keys; wherein the preset Fermat primality test algorithm pre-optimizes the number of iterations and screening range of prime number determination; Using a symmetric cryptographic algorithm, encrypt the structured sensitive data based on the encryption key to obtain encrypted structured data; Encrypting the unstructured sensitive data to obtain encrypted unstructured data; The encrypted structured data and the encrypted unstructured data are integrated to generate simulated desensitized data.

[0006] Furthermore, after generating the simulated desensitized data, the following steps are included: The simulated desensitized data is evaluated with the preset desensitized data standard to obtain an evaluation result. If the evaluation result does not meet the requirements, the number of iterations and the screening range of the Fermat primality test algorithm for prime number determination are re-optimized.

[0007] Furthermore, the unstructured sensitive data is encrypted to obtain encrypted unstructured data, including: For the unstructured sensitive data, a hash encryption key is generated using a hash function; The unstructured sensitive data is encrypted using a symmetric cryptographic algorithm based on the hash encryption key to obtain encrypted unstructured data.

[0008] Furthermore, a key numerical field in the structured sensitive data is selected and input into a preset Fermat primality test algorithm to select a large prime number as a basic key element, including: Performing data analysis on the structured sensitive data and extracting a numerical field with a key identifier as the key numerical field; Dividing the key numerical field into a plurality of numerical sub-segments, each numerical sub-segment being used as an independent input to participate in the Fermat primality test algorithm; For each numerical sub-segment, when performing the Fermat primality test, an initial base value range is set, and a modular exponentiation algorithm is used to perform the Fermat primality test calculation by multiple base transformations; When the numerical sub-segment shows a preset prime number possibility in multiple Fermat primality tests, it is marked as a large prime number candidate, the relationship between the large prime number candidate and other known prime numbers is calculated, the true large prime number is determined according to the relationship, and pseudo prime numbers are excluded; The truly large prime number is stored as a basic key element in a security key buffer area, and is uniquely identified and indexed.

[0009] Furthermore, the generating of the encryption key by combining the basic key element with a preset key combination rule includes: Using encryption transformation based on lattice cryptography theory, each of the basic key elements is mapped to a high-dimensional vector in a high-dimensional lattice space; Introducing the entangled state characteristics of quantum bits, performing quantum state encoding on each of the high-dimensional vectors, and obtaining a key element encoding; The encryption key is obtained by combining the key element codes.

[0010] Furthermore, the generating of the encryption key by combining the basic key element with a preset key combination rule includes: Performing a first quick hash on each of the basic key elements based on a lightweight hash function to obtain a preliminary hash value; wherein the hash seed is generated based on the current operating status information of the system; Perform secondary hashing on the preliminary hash value based on the Blake2b hash function to obtain a deeply obfuscated element value; Dynamically determine the bit rotation direction and number of steps according to the current system clock cycle, and rearrange the binary bits of the obfuscated element value to obtain the rearranged element value; Constructing a finite field multiplication operation based on a primitive polynomial, expanding the rearranged element value in the finite field to obtain an extended element value; wherein the coefficients of the primitive polynomial are dynamically selected according to the sensitivity level of the data to be encrypted; The extended element values ​​are sequentially combined into the encryption key.

[0011] Furthermore, for the unstructured sensitive data, a hash encryption key is generated using a hash function, including: Performing hash calculation on the unstructured sensitive data based on a hash function to obtain a hash value, using each character in the hash value as a basic element of the matrix to construct a two-dimensional matrix; Extracting sentence structure feature vectors, low-frequency feature vectors, and feature vectors of key frequency segments of the unstructured sensitive data; the unstructured sensitive data includes text, images, and audio data; Mapping the sentence structure feature vector, the low-frequency feature vector, and the feature vector of the key frequency segment to three-dimensional space respectively, and constructing a triangular mesh surface through a triangulation algorithm according to the similarity and correlation between the feature vectors; The hash encryption key is generated based on the triangular mesh surface and the two-dimensional matrix.

[0012] Further, based on the triangular mesh surface and the two-dimensional matrix, generating the hash encryption key includes: Quantizing the vertex coordinate values ​​of each triangular face of the triangular mesh surface, and establishing a mapping relationship with the elements at a preset position in the two-dimensional matrix; Based on the matrix element values ​​of the vertex coordinate mapping of each triangular face, bilinear interpolation is used to calculate the value corresponding to any point in the triangular face, and the numerical matrix is ​​obtained by combining them; Performing singular value decomposition on the numerical matrix, extracting singular values ​​therein, and reorganizing each singular value to obtain reorganized singular values; A hash operation is performed on the reorganized singular value to generate the hash encryption key.

[0013] The present invention also provides an encryption system based on a symmetric cryptographic algorithm, comprising: The classification module is used to classify the acquired sensitive data to obtain structured sensitive data and unstructured sensitive data; A generation module, for selecting key numerical fields in the structured sensitive data, inputting them into a preset Fermat primality test algorithm, screening out large prime numbers as basic key elements, and combining the basic key elements with preset key combination rules to generate an encryption key; wherein the preset Fermat primality test algorithm pre-optimizes the number of iterations and the screening range of prime number determination; A first encryption module, configured to encrypt the structured sensitive data based on the encryption key using a symmetric encryption algorithm to obtain encrypted structured data; A second encryption module, used to encrypt the unstructured sensitive data to obtain encrypted unstructured data; The integration module is used to integrate the encrypted structured data and the encrypted unstructured data to generate simulated desensitized data.

[0014] The present invention also provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of any one of the above methods when executing the computer program.

[0015] The present invention also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned methods are implemented.

[0016] The encryption method and system based on a symmetric cryptographic algorithm provided by the present invention include: classifying the acquired sensitive data to obtain structured sensitive data and unstructured sensitive data; selecting key numerical fields in the structured sensitive data, inputting them into a preset Fermat primality test algorithm, screening out large prime numbers as basic key elements, and combining the basic key elements with preset key combination rules to generate an encryption key; wherein the preset Fermat primality test algorithm pre-optimizes the number of iterations and the screening range of prime number determination; using a symmetric cryptographic algorithm to encrypt the structured sensitive data based on the encryption key to obtain encrypted structured data; encrypting the unstructured sensitive data to obtain encrypted unstructured data; integrating the encrypted structured data and the encrypted unstructured data to generate simulated desensitized data. In the present invention, by selecting key numerical fields in the structured sensitive data and inputting them into a preset Fermat primality test algorithm, large prime numbers are screened out as basic key elements, and the basic key elements are combined with preset key combination rules to generate encryption keys; the characteristics of structured sensitive data can be optimized, thereby effectively protecting the security of sensitive data and overcoming the defect that the generated key is not secure enough. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 It is a schematic diagram of the steps of an encryption method based on a symmetric cryptographic algorithm in one embodiment of the present invention; Figure 2 It is a structural block diagram of an encryption system based on a symmetric cryptographic algorithm in one embodiment of the present invention; Figure 3 It is a schematic block diagram of the structure of a computer device according to an embodiment of the present invention.

[0018] The implementation, functional features and advantages of the present invention will be further described in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0019] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0020] Reference Figure 1 In one embodiment of the present invention, an encryption method based on a symmetric cryptographic algorithm is provided, comprising the following steps: Step S1, classifying the acquired sensitive data to obtain structured sensitive data and unstructured sensitive data; Step S2, selecting a key numerical field in the structured sensitive data, inputting it into a preset Fermat primality test algorithm, screening out a large prime number as a basic key element, and combining the basic key element with a preset key combination rule to generate an encryption key; wherein the preset Fermat primality test algorithm pre-optimizes the number of iterations and the screening range of prime number determination; Step S3, using a symmetric cryptographic algorithm to encrypt the structured sensitive data based on the encryption key to obtain encrypted structured data; Step S4, encrypting the unstructured sensitive data to obtain encrypted unstructured data; Step S5, integrating the encrypted structured data and the encrypted unstructured data to generate simulated desensitized data.

[0021] In this embodiment, as described in step S1 above, sensitive data comes from a wide range of sources and in various forms, and classification can lay the foundation for subsequent targeted encryption processing measures. Different types of sensitive data have significant differences in structural characteristics, storage methods, and processing requirements. Distinguishing them helps to more accurately protect data security and achieve effective simulation desensitization.

[0022] Sensitive data is distinguished based on pre-set data structure judgment rules. For structured sensitive data, common examples include table data in a database, which has clear field definitions, data types, and fixed row and column relationships. This can be determined by identifying whether the data conforms to a pre-defined relational database model, or whether there are clear structured tags (such as XML tags and other data forms used to mark hierarchical structures). Unstructured sensitive data, such as text files, images, audio, etc., lack a unified structural format, and the organization of the data is relatively free and irregular. It is defined by determining whether the data cannot be simply presented in the form of fixed fields and records.

[0023] As described in step S2 above, first, analyze the importance of each field in the structured sensitive data in terms of business logic, data sensitivity, and data relevance, and determine the key numerical fields. For example, in financial transaction data, key numerical fields such as transaction amount and account balance often play a key role in the sensitivity and integrity of the data, and these fields will be selected first. The selected key numerical fields are input into the preset Fermat primality test algorithm. The algorithm is based on Fermat's little theorem to preliminarily determine whether a number is a prime number. However, due to the existence of pseudo-primes, the original algorithm alone is not completely reliable. In this scheme, it is optimized in advance, and unnecessary repeated tests are avoided by reasonably adjusting the number of iterations of prime number determination, thereby improving efficiency while ensuring accuracy; at the same time, the screening range is accurately determined, and the appropriate value range of large prime numbers is clarified based on factors such as cryptographic security requirements and the magnitude of the processed data, so as to more efficiently screen out large prime numbers that truly meet the requirements as basic key elements.

[0024] After obtaining the basic key elements, the encryption key is further generated according to the preset key combination rules. For example, the basic key elements are obfuscated based on the hash function, the elements are replaced and expanded using bit operations, or these elements are combined and transformed according to a specific mathematical function relationship, and finally an encryption key that meets the encryption requirements and has sufficient complexity and randomness is generated.

[0025] As described in step S3 above: a common symmetric encryption algorithm can be selected, such as the Advanced Encryption Standard (AES). Taking AES as an example, the structured sensitive data is divided according to its data block size (such as 128 bits, etc.), and then the encryption key generated in step S2 is used to encrypt each data block in turn through multiple rounds of encryption operations such as byte replacement, row shift, column confusion and round key addition, and finally all encrypted structured data is obtained, that is, encrypted structured data. During the entire encryption process, the encryption key is the same at the sender and the receiver. When decrypting, the same key is used to perform reverse operations according to the corresponding decryption algorithm process to restore the original structured sensitive data.

[0026] As described in step S4 above, according to the characteristics of unstructured sensitive data, a suitable symmetric encryption algorithm is used for encryption. For example, for text-based unstructured sensitive data, the text can be first encoded (such as UTF-8 and other encoding methods) to make it binary data, and then symmetric encryption algorithms such as DES (Data Encryption Standard) and 3DES (Triple Data Encryption Standard) are used to encrypt the binary data bit by bit using a pre-generated encryption key suitable for unstructured data (the generation method may be based on other suitable mechanisms, such as hash function generation, etc.), and finally the encrypted unstructured data is obtained, that is, encrypted unstructured data. For unstructured sensitive data such as images and audio, corresponding digital processing (such as pixel value representation of images, sampling quantization of audio, etc.) must also be performed first, and then a similar symmetric encryption algorithm and corresponding key are used for encryption.

[0027] As described in step S5 above, the encrypted structured data and encrypted unstructured data are reorganized and spliced ​​according to the overall architecture and business association logic of the original sensitive data. For example, if the original sensitive data is a document containing customer information (structured data part, such as name, contact information and other fields) and pictures and text descriptions of customer feedback (unstructured data part), then when integrating, the encrypted structured data fields and the encrypted unstructured data parts are arranged in sequence according to the original format order of the document. At the same time, some conventional means such as filling and format adjustment can also be used to make the integrated simulated desensitized data similar to the original sensitive data in appearance and data structure, but the sensitive information therein has been encrypted to achieve the purpose of desensitization and meet the data usage requirements in scenarios such as development and testing environments without causing accidental leakage of sensitive information.

[0028] In one embodiment, after generating the simulated desensitized data, the following steps are included: The simulated desensitized data is evaluated with the preset desensitized data standard to obtain an evaluation result. If the evaluation result does not meet the requirements, the number of iterations and the screening range of the Fermat primality test algorithm for prime number determination are re-optimized.

[0029] In this embodiment, the preset evaluation algorithms and tools are used to check the simulated desensitized data from different dimensions. For example, for data privacy, it can be judged by detecting whether the encrypted sensitive fields have the risk of being reverse cracked, whether there are residual traces of sensitive information, etc.; for data availability, simulate the use of simulated desensitized data in actual business scenarios (such as importing data into data analysis software for routine analysis operations) to see whether there will be problems such as format incompatibility and data logic errors; and for data consistency, compare the simulated desensitized data with the original sensitive data in terms of data structure, key identifiers, etc. The degree of matching. Combining these inspection situations, an overall evaluation result is obtained to clarify whether it meets the preset desensitized data standards.

[0030] When the evaluation results show that the simulated desensitized data does not meet the expected standards, it means that there may be room for optimization in the entire encryption and desensitization process. Since the generation of encryption keys has a key impact on the security of data encryption and the final desensitization effect, and in the process of generating encryption keys, the Fermat primality test algorithm is an important link in screening basic key elements, so re-optimizing the number of iterations and screening range of its primality determination is expected to change the characteristics of the generated encryption keys, thereby improving the quality of subsequent encrypted and desensitized data so that it can meet the preset standards.

[0031] Based on the feedback information of the current evaluation results that do not meet the requirements, analyze the possible problems, such as whether the encryption strength is not enough to cause the privacy to fail to meet the standards, or whether the unreasonable key generation affects the data consistency. Then, through mathematical analysis, simulation testing and other means, adjust the number of prime number determination iterations in the Fermat primality test algorithm, which may increase or decrease the number of iterations, so that the selected large prime numbers are more accurate and reliable when used as basic key elements; at the same time, re-examine and adjust the screening range, expand or reduce the selection interval of large prime numbers according to new security requirements and data characteristics, ensure that the encryption keys generated subsequently are better in terms of security and randomness, and then re-execute a series of encryption, integration and evaluation steps from key generation onwards, until the final generated simulated desensitized data can meet the preset desensitized data standards.

[0032] In one embodiment, encrypting the unstructured sensitive data to obtain encrypted unstructured data includes: For the unstructured sensitive data, a hash encryption key is generated using a hash function; The unstructured sensitive data is encrypted using a symmetric cryptographic algorithm based on the hash encryption key to obtain encrypted unstructured data.

[0033] In this embodiment, since unstructured sensitive data lacks a unified and fixed structural format (such as text files, images, audio and other different types of data), a method that can adapt to its characteristics is required when generating encryption keys. The use of hash functions to generate hash encryption keys mainly utilizes the one-way nature and avalanche effect of hash functions, and based on the content characteristics of unstructured sensitive data itself, generates encryption keys that are sufficiently random, unique, and difficult to reverse deduce, providing a basic guarantee for the subsequent safe and effective encryption of unstructured sensitive data.

[0034] Using the hash encryption key generated previously, the unstructured sensitive data is encrypted through a symmetric cryptographic algorithm, and the sensitive information in the original unstructured sensitive data is converted into ciphertext form, ensuring that even if the data is illegally obtained during storage, transmission, etc., the attacker cannot decipher the content without the correct key, thereby ensuring the security and privacy of the data.

[0035] For different types of unstructured sensitive data, the specific encryption operation details will be slightly different, but the overall idea is the same. For example, for text data, the encoded binary sequence will be encrypted in groups; for image data, the pixel value data will be encrypted in groups; for audio data, the integrated audio data information will be encrypted in groups. After such encryption processing, the original unstructured sensitive data will all be converted into encrypted unstructured data in the form of ciphertext, thus achieving encryption protection for unstructured sensitive data.

[0036] Through the close cooperation of the above two steps, a hash encryption key suitable for unstructured sensitive data is first generated, and then this key is used to encrypt it using a symmetric encryption algorithm. This can effectively meet the encryption needs of unstructured sensitive data and improve the overall data security protection level, especially in sensitive data processing scenarios, and play an important role in protecting data privacy.

[0037] In one embodiment, a key numerical field in the structured sensitive data is selected and input into a preset Fermat primality test algorithm to select a large prime number as a basic key element, including: Performing data analysis on the structured sensitive data and extracting a numerical field with a key identifier as the key numerical field; Dividing the key numerical field into a plurality of numerical sub-segments, each numerical sub-segment being used as an independent input to participate in the Fermat primality test algorithm; For each numerical sub-segment, when performing the Fermat primality test, an initial base value range is set, and a modular exponentiation algorithm is used to perform the Fermat primality test calculation by multiple base transformations; When the numerical sub-segment shows a preset prime number possibility in multiple Fermat primality tests, it is marked as a large prime number candidate, the relationship between the large prime number candidate and other known prime numbers is calculated, the true large prime number is determined according to the relationship, and pseudo prime numbers are excluded; The truly large prime number is stored as a basic key element in a security key buffer area, and is uniquely identified and indexed.

[0038] In this embodiment, first, the structured sensitive data is analyzed according to the pre-set analysis rules. The above rules usually take into account multiple factors. For example, from the perspective of business logic, the data fields that are at the key links in the business process are identified, such as the transaction amount, account balance and other fields in the financial transaction records, which are crucial to the integrity and confidentiality of the data; from the perspective of data sensitivity, key values ​​such as the ID card number and bank card number involving customer privacy information are often also the focus of attention.

[0039] In addition, key identifiers are determined based on factors such as data usage scenarios and the relationship between data. For example, in the data of a supply chain management system, numerical fields related to goods costs, transportation prices, etc. may be identified as having key identifiers because they involve commercial secrets. After screening and extraction through these rules, those numerical fields that meet the conditions are identified as key numerical fields, and encryption keys will be generated based on them in the future.

[0040] Directly performing Fermat primality tests on the entire key numerical field faces problems such as high computational complexity, low efficiency, and affected result accuracy. Dividing it into multiple numerical sub-segments can reduce the amount of calculation for a single test and improve the overall test efficiency. It also helps to analyze data features more carefully, screen suitable large prime numbers from different sub-segment perspectives, increase the possibility of generating high-quality basic key elements, and make the test process more flexible and controllable.

[0041] The key numeric fields are segmented according to a pre-set segmentation strategy. The above segmentation strategy can be determined based on the size range of the value, the structural characteristics of the data, or the cryptographic security strength requirements. For example, the numeric field can be segmented according to a fixed length (such as every 100 bits are divided into a sub-segment); or according to the grouping of data in a structured system (such as a key field in each row of records in a database table is split into several sub-segments according to a certain logic).

[0042] After the division is completed, each numerical sub-segment obtained will be treated as an independent individual and will be input into the Fermat primality test algorithm in turn for the corresponding prime number screening test to ensure that each sub-segment can be fully and independently analyzed and judged.

[0043] The Fermat primality test is a method to infer whether a number is prime based on Fermat's little theorem. However, in order to ensure the effectiveness, accuracy and computational efficiency of the test, it is necessary to reasonably set the base value range and use a suitable calculation algorithm. Setting the base value range can control the range and accuracy of the test, avoiding unnecessary calculations and misjudgments; using the modular exponentiation algorithm can efficiently complete the calculation, and by changing the base multiple times for testing, the primality possibility of the numerical sub-segment can be verified from multiple angles, improving the reliability of the judgment.

[0044] In this embodiment, the range of base values ​​is predetermined, and the setting of this range is usually based on comprehensive consideration of factors such as cryptographic security requirements and the numerical characteristics of the numerical sub-segment itself. For example, under certain cryptographic strength standards, a suitable integer interval is selected as the base value range based on the approximate magnitude and data type of the numerical sub-segment, and the base within this interval can be a set of common values ​​verified by cryptographic practice, or a range of values ​​randomly generated by the system and in accordance with specific rules.

[0045] Then, the modular exponentiation algorithm is used to perform the Fermat primality test calculation. The modular exponentiation algorithm can quickly calculate the result. It reduces the amount of calculation and improves the calculation speed by using some mathematical techniques (such as repeated squaring and exponentiation, optimization of modular operations, etc.). During the calculation process, the base will be changed many times, that is, different values ​​will be selected as the base within the set base value range, and the above modular exponentiation operation will be repeated. The result of each calculation is used to comprehensively judge whether the numerical sub-segment presents a high possibility of prime numbers, so as to screen the prime numbers more comprehensively and accurately.

[0046] Although the numerical sub-segments that show the possibility of prime numbers through the Fermat primality test have a high probability of being prime numbers, there are certain misjudgments in the Fermat primality test, and pseudo prime numbers will appear. By further calculating the relationship between large prime number candidates and other known prime numbers, it is possible to more accurately identify the true large prime numbers and exclude those pseudo prime numbers, thereby ensuring that the large prime numbers used as basic key elements have extremely high accuracy and reliability, laying a solid foundation for generating high-quality encryption keys.

[0047] When a numerical sub-segment is tested for Fermat primality after multiple base changes, and the results all meet the prime characteristics presented by Fermat's Little Theorem, it is first marked as a large prime candidate. Next, a specific mathematical method is used to calculate the relationship between it and other known prime numbers, such as the extended Euclidean algorithm, the Chinese remainder theorem and other mathematical tools. The extended Euclidean algorithm can be used to calculate the greatest common divisor and other relationship information between the large prime candidate and the known prime numbers, and these relationships can be used to determine whether the candidate meets the properties of a true prime number; the Chinese remainder theorem can further assist in verifying the authenticity of the large prime candidate when multiple congruence equations are involved (constructing congruence relationships with other known prime numbers). If after these relationship calculations and verifications, the numerical sub-segment does meet the criteria for determining a true prime number, then it is determined to be a true large prime number; conversely, if it is found that it does not meet the corresponding relationship requirements, it is determined to be a pseudo-prime number and is excluded, ensuring that the large prime number finally selected is accurate and reliable.

[0048] The security of the determined truly large prime numbers as the basic key elements for the subsequent generation of encryption keys is extremely important. Storing them in the secure key cache can prevent external illegal access and tampering, and ensure the integrity and confidentiality of these key elements; unique identification and indexing facilitates the accurate and rapid call and management of these basic key elements when generating encryption keys, improving the efficiency and reliability of the entire key generation and encryption process.

[0049] When storing truly large prime numbers, a unique identifier is assigned to each large prime number. This identifier can be determined based on the order in which it is generated, the associated characteristics with the data, or generated through a specific hash algorithm, so that it can be uniquely distinguished in the cache area. At the same time, a corresponding indexing mechanism is established, such as using a tree structure (such as a binary search tree, etc.) or a hash table and other data structures to record the correspondence between large prime numbers and their identifiers, which is convenient for quick search and positioning. In this way, when these basic key elements need to be used to generate encryption keys according to the preset key combination rules in the future, the corresponding large prime numbers can be obtained efficiently and accurately to ensure the smooth progress of the entire encryption process.

[0050] In one embodiment, the step of combining the basic key element with a preset key combination rule to generate an encryption key includes: Using encryption transformation based on lattice cryptography theory, each of the basic key elements is mapped to a high-dimensional vector in a high-dimensional lattice space; Introducing the entangled state characteristics of quantum bits, performing quantum state encoding on each of the high-dimensional vectors, and obtaining a key element encoding; The encryption key is obtained by combining the key element codes.

[0051] In this embodiment, the lattice cryptography theory has a unique security advantage. Encryption transformation based on it can utilize the complex mathematical structure of the lattice space to enhance the security and complexity of the basic key elements. By mapping the basic key elements to high-dimensional vectors in the high-dimensional lattice space, the originally relatively simple key elements can be integrated into the characteristics of the lattice space, providing a richer mathematical structure foundation for subsequent further encryption processing, and increasing the difficulty for attackers to crack.

[0052] First, the corresponding lattice structure is constructed based on the lattice cryptography theory. The lattice is usually generated by a set of linearly independent vectors (lattice basis), which defines the basic framework of the lattice space. In actual operation, the appropriate lattice basis vectors and lattice dimensions and other parameters are determined according to the cryptographic security strength requirements and the number and characteristics of the basic key elements. For example, a specific integer vector is selected as the lattice basis, and the element values, vector lengths, and linear relationships of these lattice basis vectors are carefully designed to meet the cryptographic trade-off between security and computational efficiency.

[0053] Then, each basic key element is used as input, and the pre-built lattice structure is used to convert it into a high-dimensional vector in the high-dimensional lattice space through a preset mathematical mapping relationship. This mapping process involves a series of complex linear transformations, coordinate conversions and other operations. For example, according to the linear combination operation of the lattice basis vector and the basic key element, the corresponding coordinate value in the high-dimensional lattice space is calculated according to the established rules, thereby determining its high-dimensional vector representation. These high-dimensional vectors not only contain the information of the original basic key element, but also incorporate the unique mathematical structure and security characteristics given by the lattice space.

[0054] The entangled state characteristics of quantum bits are a unique phenomenon in quantum mechanics, which makes a non-classical connection between multiple particles in a quantum system exist. This connection is highly complex and non-clonable. Introducing it into the processing of high-dimensional vectors can further enhance the security and uniqueness of key element encoding with the help of these special properties of quantum states. Through quantum state encoding, high-dimensional vectors are converted into a representation based on quantum states, so that key elements have quantum information protection, which is fundamentally different from traditional encoding methods and greatly increases the difficulty for attackers to obtain and crack key information.

[0055] For each high-dimensional vector, the information of each dimension is associated with the state of the quantum bit. By utilizing the entangled state characteristics of the quantum bit, the entangled state is constructed through specific quantum gate operations (such as Hadamard gate, CNOT gate, etc., which can realize the change and control of the quantum bit state), so that a complex correlation relationship is generated between different quantum bits, thereby encoding the high-dimensional vector. For example, the value of a certain dimension in a high-dimensional vector can be represented by a specific superposition state of the quantum bit. Multiple quantum bits are entangled to form an overall quantum state, and this quantum state is used as the key element encoding corresponding to the high-dimensional vector.

[0056] In the above process, the specific rules of encoding and the order and parameters of quantum gate operations are carefully designed based on cryptographic security requirements and quantum information theory to ensure that the generated key element encoding fully utilizes the characteristics of the entangled state of quantum bits, has a high degree of randomness, unpredictability and anti-interference ability, and can effectively resist attacks based on classical computing or even potential quantum computing.

[0057] The key elements are encoded and integrated according to the preset combination rules. The above combination rules can be formulated based on mathematical logic, cryptographic algorithms or specific business needs.

[0058] In one embodiment, the step of combining the basic key element with a preset key combination rule to generate an encryption key includes: Performing a first quick hash on each of the basic key elements based on a lightweight hash function to obtain a preliminary hash value; wherein the hash seed is generated based on the current operating status information of the system; Perform secondary hashing on the preliminary hash value based on the Blake2b hash function to obtain a deeply obfuscated element value; Dynamically determine the bit rotation direction and number of steps according to the current system clock cycle, and rearrange the binary bits of the obfuscated element value to obtain the rearranged element value; Constructing a finite field multiplication operation based on a primitive polynomial, expanding the rearranged element value in the finite field to obtain an extended element value; wherein the coefficients of the primitive polynomial are dynamically selected according to the sensitivity level of the data to be encrypted; The extended element values ​​are sequentially combined into the encryption key.

[0059] In this embodiment, the lightweight hash function (MurmurHash) is used for the first hash processing, mainly to preliminarily disrupt the original information structure of the basic key element and increase its randomness and unpredictability under the premise of ensuring a certain computing efficiency. By generating a hash seed based on the current operating status information of the system, each generated hash result can be associated with the current specific state of the system. Even if the same basic key element is hashed at different times, different preliminary hash values ​​will be obtained, further improving the dynamics and security of the key generation process and preventing attackers from inferring key information through fixed patterns. For example, a partial value of the timestamp and the CPU usage rate can be subjected to simple mathematical operations (such as addition, multiplication, and modulus operations) to obtain a suitable integer as a hash seed.

[0060] The basic key elements and the generated hash seed are input into the selected lightweight hash function. The hash function calculates each basic key element according to its internal established operation logic (usually involving multiple iterative processing of input data, bit operations, etc.), and outputs the corresponding preliminary hash value. Compared with the original basic key elements, the information of these preliminary hash values ​​has been initially obfuscated and transformed.

[0061] The Blake2b hash function has high security and strong obfuscation capabilities. After the initial hash value is obtained through the first quick hash, it is used for secondary hashing to further enhance the obfuscation of the key element information, making it more difficult to reverse deduce and crack.

[0062] The preliminary hash value obtained in the previous step is used as input data and input into the Blake2b hash function. The Blake2b hash function has a rigorous structure and complex operation process. It will perform multiple rounds of compression, permutation, expansion and other operations on the input preliminary hash value. For example, in each round of operation, nonlinear function operations and bit mixing operations will be performed according to specific round constants, message words (here is the binary data block corresponding to the preliminary hash value) and state vectors. After multiple rounds of such processing, the deeply obfuscated element values ​​are output. These element values ​​are already quite different from the original basic key elements at the information level, hiding the original key information and having higher confidentiality.

[0063] The system clock cycle, a dynamically changing factor, is used to determine the direction and number of steps of bit rotation, and the binary bits of the element values ​​that have been hashed are rearranged in order to introduce more dynamic randomness into the key generation process. This dynamically changing bit arrangement makes it difficult for an attacker to analyze and restore the original key information through a fixed pattern even if he obtains some of the obfuscated element values, greatly enhancing the key's anti-analysis capability and security, making it more in line with the cryptography requirements for key complexity and unpredictability.

[0064] First, obtain the current system clock cycle information. You can use the clock function or related time acquisition interface provided by the system to obtain the clock cycle value with a certain time granularity (such as milliseconds, microseconds, etc.). Then, according to the preset algorithm, determine the bit rotation direction (for example, if a bit in the clock cycle is an even number, set it to rotate clockwise, if it is an odd number, set it to rotate counterclockwise, etc.) and the number of steps (the number of steps can be obtained by taking the clock cycle value after performing modulo operations such as taking a modulo operation to obtain a suitable integer).

[0065] Next, the binary bits of the obfuscated element value are rotated according to the determined rotation direction and number of steps, that is, each binary bit is moved within the byte or word in which it is located according to the corresponding rules. For example, for an 8-bit byte data, if it is set to rotate clockwise for 3 steps, the binary bit originally at the lowest position will move to the 3rd position, and so on. After completing such rearrangement operations on the binary bits of all obfuscated element values, the rearranged element value is obtained.

[0066] The rearranged element values ​​are expanded by finite field multiplication operations based on primitive polynomials. On the one hand, this increases the amount of information and complexity of the key elements so that the generated encryption key can have richer cryptographic properties. On the other hand, the coefficients of the primitive polynomials are dynamically selected according to the sensitivity level of the data to be encrypted, which can achieve the adaptation of the key to the data sensitivity. For data with higher sensitivity, stronger and more complex encryption keys can be generated, thereby better ensuring data security and achieving flexible and effective data encryption protection.

[0067] First, to construct a finite field, it is necessary to determine the appropriate primitive polynomial. The primitive polynomial is a key element in the construction of a finite field, and the selection of its coefficients is based on the sensitivity level of the data to be encrypted. For example, for data with a high sensitivity level, a primitive polynomial with a higher power and a more complex coefficient distribution is selected, while for data with a lower sensitivity, a relatively simple primitive polynomial that still meets the security requirements of cryptography can be selected. These primitive polynomials can be defined and stored in advance according to different sensitivity levels, and dynamically called according to the specific data sensitivity when actually generating the key.

[0068] Then, the rearranged element values ​​are regarded as elements in the finite field, and are expanded through finite field multiplication operations. Finite field multiplication operations have strict operation rules. They are different from ordinary multiplication operations and need to follow the characteristics of the finite field for calculation. Specifically, during the operation, the selected primitive polynomial and the addition (generally implemented by XOR operation) and multiplication rules of the finite field are combined to perform multiple multiplication, addition and other operations on the rearranged element values ​​to expand them into extended element values ​​containing more information. For example, by continuously performing multiplication operations with specific elements in the finite field (determined by the primitive polynomial and operation rules), and combining the intermediate results for addition operations, etc., the extended element values ​​that meet the requirements are gradually generated, so that they have stronger cryptographic characteristics and richer information carrying capacity under the framework of the finite field.

[0069] After a series of previous processing, each basic key element has been converted into an extended element value with high security, complexity and adaptability. They are combined in sequence to form a complete encryption key. This encryption key combines the cryptographic advantages given by the previous steps and can be used for subsequent encryption operations on sensitive data based on symmetric encryption algorithms to ensure the confidentiality and integrity of data in various application scenarios.

[0070] Through the above steps, using a variety of innovative technical means and dynamic parameter selection mechanisms, the basic key elements are gradually transformed into encryption keys with high security and adaptability, providing strong protection for the encryption of sensitive data based on symmetric cryptographic algorithms.

[0071] In one embodiment, for the unstructured sensitive data, a hash encryption key is generated using a hash function, including: Performing hash calculation on the unstructured sensitive data based on a hash function to obtain a hash value, using each character in the hash value as a basic element of the matrix to construct a two-dimensional matrix; Extracting sentence structure feature vectors, low-frequency feature vectors, and feature vectors of key frequency segments of the unstructured sensitive data; the unstructured sensitive data includes text, images, and audio data; Mapping the sentence structure feature vector, the low-frequency feature vector, and the feature vector of the key frequency segment to three-dimensional space respectively, and constructing a triangular mesh surface through a triangulation algorithm according to the similarity and correlation between the feature vectors; The hash encryption key is generated based on the triangular mesh surface and the two-dimensional matrix.

[0072] In this embodiment, the hash function (SHA-256, SHA-512) is first used to process the unstructured sensitive data because the hash function has the characteristics of unidirectionality and avalanche effect, and can convert unstructured sensitive data of any length into a hash value of fixed length. This hash value can be regarded as a characteristic representation of the original data, while hiding the specific content of the original data to ensure a certain degree of confidentiality. The characters in the hash value are used as the basic elements of the matrix to construct a two-dimensional matrix, aiming to further convert the hash value into a data form with a certain structure, so as to facilitate the subsequent fusion processing with other features extracted from the data, so as to generate a more complex and secure hash encryption key.

[0073] Each character in the above hash value (usually a character represented in hexadecimal, etc.) is used as a basic element of the matrix, and a two-dimensional matrix is ​​constructed according to a pre-set matrix construction rule. For example, these character elements can be allocated according to a fixed number of rows and columns, and the characters in the hash value are filled into the corresponding positions of the matrix in turn, thereby constructing a two-dimensional matrix structure. This matrix carries the characteristic information about the original unstructured sensitive data contained in the hash value, and has a structured form that is convenient for subsequent operations.

[0074] Different types of unstructured sensitive data (text, images, audio) contain their own unique intrinsic characteristics. By extracting these feature vectors of different dimensions, we can capture the essential information of the data more comprehensively and deeply, and provide rich materials for the subsequent generation of hash encryption keys that are closely related to the data and have high security. Sentence structure feature vectors help to grasp the grammatical and logical structure characteristics of text data; low-frequency feature vectors can mine relatively less significant but potentially unique features in image data; and feature vectors in key frequency bands focus on the characteristics of data within certain important frequency ranges. These features combined can better reflect the diversity and complexity of unstructured sensitive data.

[0075] Natural language processing technology can be used to extract sentence structure feature vectors from text data; image perception algorithms can be used to extract low-frequency feature vectors from image data; and audio recognition technology can be used to extract feature vectors of key frequency bands from audio data.

[0076] Mapping the feature vectors extracted from different dimensions into three-dimensional space is to present these features in an intuitive way that is easy to analyze the relationship between them. Using the triangulation algorithm to construct a triangular mesh surface is to further integrate and visualize these features to form a continuous surface with a geometric structure. This surface can comprehensively reflect the intrinsic connection between various features of unstructured sensitive data, and lay the foundation for fusion processing with the previously constructed two-dimensional matrix to generate keys. At the same time, this geometric structure form also increases the complexity and uniqueness of the key generation process and improves security.

[0077] First, the values ​​of each dimension of the sentence structure feature vector, low-frequency feature vector, and feature vector of the key frequency segment are mapped to the coordinate axes of the three-dimensional space, so that each feature vector has a corresponding coordinate point in the three-dimensional space. Then, the similarity and correlation between these coordinate points are analyzed. The similarity can be measured by calculating the distance between vectors (such as Euclidean distance, cosine similarity, etc.), and the correlation can be judged based on the logical relationship and mutual influence of the features represented by the feature vectors in the data.

[0078] Based on these similarities and associations, a triangulation algorithm (such as the Delaunay triangulation algorithm) is used to construct a triangular mesh surface. The algorithm will find a suitable point combination based on the distribution of the point set, so that the triangles formed by these points meet certain geometric rules (such as ensuring that the minimum internal angle of the triangle is maximized as much as possible), and connect these triangles to form a triangular mesh surface covering all points. This surface contains the complex relationship information between the feature vectors of unstructured sensitive data, and is presented in a geometric form, providing a unique structural basis for subsequent key generation operations.

[0079] A hash encryption key is generated by fusing the multi-dimensional feature relationship information of unstructured sensitive data represented by the triangular mesh surface and the hash value feature information carried by the two-dimensional matrix. The key can fully combine the various inherent characteristics of unstructured sensitive data, and has the advantages of unidirectionality and confidentiality based on hash functions, and incorporates the rich feature information of the data itself, thereby generating a hash encryption key that is highly secure, closely related to the original data and difficult to crack, which is used for subsequent encryption protection of unstructured sensitive data.

[0080] There are many ways to fuse and generate keys. One possible operation is to first quantize the triangular mesh surface, such as extracting the vertex coordinate values ​​of the surface, the area of ​​the triangle, the length of the edge and other geometric parameters, and combining these parameters with the elements in the two-dimensional matrix according to certain rules. For example, the geometric parameters of the triangular mesh surface and the elements in the two-dimensional matrix are alternately selected in a certain order to form a new one-dimensional data sequence. Then, some additional encryption processing methods are applied to this new data sequence, such as re-hashing through a specific hash function (which can be a hash function different from the previous one with higher security requirements, such as Blake2b, etc.), or using bit-based operations (such as XOR, shift, etc.) to confuse and expand the data sequence, and finally generate a hash encryption key that meets the requirements of cryptography.

[0081] In one embodiment, generating the hash encryption key based on the triangular mesh surface and the two-dimensional matrix includes: Quantizing the vertex coordinate values ​​of each triangular face of the triangular mesh surface, and establishing a mapping relationship with the elements at a preset position in the two-dimensional matrix; Based on the matrix element values ​​of the vertex coordinate mapping of each triangular face, bilinear interpolation is used to calculate the value corresponding to any point in the triangular face, and the numerical matrix is ​​obtained by combining them; Performing singular value decomposition on the numerical matrix, extracting singular values ​​therein, and reorganizing each singular value to obtain reorganized singular values; A hash operation is performed on the reorganized singular value to generate the hash encryption key.

[0082] In this embodiment, the triangular mesh surface contains the correlation information between the multi-dimensional features of unstructured sensitive data, and the vertex coordinate values ​​of the triangular face are the key geometric feature data. The quantization of these coordinate values ​​is to convert them into discrete numerical forms that are convenient for subsequent calculation and processing, so that they can be better integrated with the feature information based on hash values ​​carried by the two-dimensional matrix. The establishment of a mapping relationship is intended to build a bridge of communication between the two, so that the geometric features of the surface and the element information of the matrix can be correlated and synergistic, providing richer and more intrinsically logical materials for generating hash encryption keys.

[0083] First, for each triangular face of the triangular mesh surface, obtain the coordinate values ​​of its vertices (the coordinates in three-dimensional space, usually expressed in real number form). During quantization, each dimension of the coordinate value is converted into a discrete integer value according to the pre-set accuracy requirements and quantization range. For example, it can be stipulated that the range of coordinate values ​​is divided into several intervals, each interval corresponds to a specific integer code, and the code corresponding to the interval where the coordinate value is located is used as its quantized value.

[0084] Then, determine the elements at the preset positions in the two-dimensional matrix and establish a mapping relationship with these quantized vertex coordinate values. The selection of the preset positions can be based on certain rules, such as starting from the upper left corner of the matrix and selecting elements in a certain scanning order (such as row priority or column priority); or determine the position corresponding to the vertex coordinate value according to certain attributes of the matrix elements themselves (such as the parity of the element value, size order, etc.). For example, the three vertex coordinate values ​​of the first triangular face in the triangular mesh surface are mapped to the elements of the first row and first column, the second row and third column, and the third row and fifth column of the two-dimensional matrix, and so on. For each triangular face, a mapping is established with the two-dimensional matrix elements, so that the geometric features of the surface can be associated with the element information of the matrix through this mapping.

[0085] The purpose of calculating the value corresponding to any point in the triangle surface through bilinear interpolation is to make full use of the matrix element value information mapped by the triangle surface vertices, expand it to the entire triangle surface, further enrich and refine the data feature representation, and make the information fused from the triangle mesh surface and the two-dimensional matrix more continuous and complete. Combining these values ​​to form a numerical matrix is ​​to organize these refined information into a structured form that is convenient for subsequent mathematical processing (such as singular value decomposition, etc.) so as to mine more cryptographically valuable features to generate hash encryption keys.

[0086] For each triangle face in the triangular mesh surface, the two-dimensional matrix element values ​​mapped by the three vertex coordinates are known. Take any point in the triangle face and use the bilinear interpolation formula to calculate the value corresponding to the point. The basic principle of bilinear interpolation is based on the extension of linear interpolation in two directions. First, linear interpolation is performed on the two sides of the triangle, and then linear interpolation is performed on the interpolated result.

[0087] Such bilinear interpolation calculation is performed on multiple sampling points in the triangular face (a sufficient number of points can be selected according to a preset sampling strategy, such as uniform sampling, etc.) to obtain a series of values. The values ​​calculated in this way for all triangular faces are arranged and combined in a certain order (for example, according to the arrangement order of the triangular faces in the surface, or based on a logical order related to the data features) to construct a numerical matrix. This numerical matrix integrates the rich information of the fusion of the triangular mesh surface and the two-dimensional matrix, and presents it in a structured form.

[0088] Singular value decomposition (SVD) is an important matrix analysis tool. Singular value decomposition of numerical matrices can dig out the intrinsic structure and main characteristic information of matrix data. The extracted singular values ​​represent the importance of the matrix in different dimensions. By reorganizing these singular values, the original characteristic information structure can be further disrupted and transformed, increasing the complexity and randomness of the data, making it more suitable for generating highly secure hash encryption keys. At the same time, some information that may be redundant or not conducive to key security can be removed, and key cryptographic features can be extracted.

[0089] After the singular values ​​are extracted, they are operated according to the pre-set recombination rules. The recombination rules can be formulated according to the cryptographic security requirements and the characteristics of the data itself. For example, the singular values ​​can be grouped in order of size, and then the singular values ​​of different groups can be recombined in a cross-arrangement manner; or the new order of the singular values ​​can be determined according to a certain random number sequence (the random number sequence can be generated by the system and is associated with the current data processing environment information, such as the system timestamp, process ID, etc.), and they are rearranged and combined into recombined singular values. Such a recombination operation makes the characteristic information contained in the singular value reconstructed, making it more difficult to analyze and restore, laying the foundation for the subsequent generation of secure hash encryption keys.

[0090] After a series of previous processing, the reorganized singular values ​​have integrated the complex feature information about unstructured sensitive data contained in the triangular mesh surface and the two-dimensional matrix, and have undergone transformations such as quantization, interpolation, singular value decomposition and reorganization, and have a certain degree of randomness and complexity. Performing hash operations on them is to use the one-way and avalanche effect of hash functions to further convert these feature information into a fixed-length, highly confidential hash encryption key, making it difficult to reversely deduce the final generated key, which can effectively ensure the security of unstructured sensitive data during the encryption process.

[0091] After generating the hash encryption key, some necessary verification and validation operations can also be performed on it, such as checking whether the length of the key meets the requirements of cryptographic standards, evaluating whether its randomness is sufficient by calculating the entropy value of the key (generally, it is hoped that the entropy value is high enough, indicating that the key has good unpredictability), etc. If the corresponding requirements are not met, it may be necessary to go back to the previous steps, such as adjusting the rules for establishing the mapping relationship between the triangular mesh surface and the two-dimensional matrix, the sampling strategy of bilinear interpolation, or the rules for singular value recombination, and re-execute the relevant operations until a hash encryption key that meets the cryptographic security standards is generated to ensure that it can be reliably used in the encryption protection process of unstructured sensitive data.

[0092] In one embodiment, the step of using a hash function to generate a hash encryption key for the unstructured sensitive data includes: Use a fast hash algorithm (such as MurmurHash) to perform preliminary hash calculations on unstructured sensitive data to obtain a hash value set, convert it into a two-dimensional array form, and construct a basic matrix. The number of rows and columns of the basic matrix is ​​determined according to the size of the hash value set and specific cryptographic rules, such as determining the prime number combination of the number of rows and columns according to the data sensitivity level; For unstructured sensitive data, we extract word frequency-inverse document frequency feature vectors for text data, extract scale-invariant feature transformation feature point sets for image data, and extract Mel frequency cepstral coefficient feature vectors for audio data; A curve represented by a hidden Markov chain model (HMM) is constructed based on each extracted feature vector. The number of states and transition probability of the HMM are determined by the dimension and distribution of the feature vector. For example, the number of states is related to the number of principal components of the feature vector, and the transition probability is related to the strength of the correlation of the features. This allows the curve to reflect the inherent structure of unstructured sensitive data from the perspective of probability distribution. The basic matrix is ​​fused with the HMM curve; specifically, the following steps are performed: according to the state transition probability distribution of the HMM curve, the elements in the basic matrix are selectively weighted and adjusted. For the matrix area corresponding to the state with high transition probability, a larger weight coefficient (the coefficient is determined by the cryptographic security key space requirement) is used for weighting. The weight coefficient is obtained by performing a hash operation with the current system timestamp and then taking the modulus to ensure that the weight generated each time is random and unpredictable. The weighted matrix is ​​transformed based on singular value decomposition (SVD). By performing SVD decomposition on the matrix, its main singular values ​​and corresponding singular vectors are retained. The number of retained singular values ​​is determined according to the preset cryptographic security parameters. The matrix is ​​reconstructed using the retained singular values ​​and vectors to obtain a compressed and transformed matrix, thereby enhancing the security and complexity of the data. Serialize the reconstructed matrix, convert the matrix elements into a one-dimensional data sequence in row-first or column-first order, and then use a secure hash algorithm (such as SHA-256) to perform a final hash operation on the sequence to generate a hash encryption key; Perform a key strength assessment on the generated hash encryption key by calculating the key collision probability and key space size, and comparing them with the preset cryptographic strength index. If the assessment result does not meet the requirements, readjust the feature extraction method, matrix construction and transformation parameters, HMM curve construction rules, etc., and execute the above steps again until a hash encryption key that meets the strength requirements is generated.

[0093] Reference Figure 2In one embodiment of the present invention, an encryption system based on a symmetric encryption algorithm is provided, comprising: The classification module is used to classify the acquired sensitive data to obtain structured sensitive data and unstructured sensitive data; A generation module, for selecting key numerical fields in the structured sensitive data, inputting them into a preset Fermat primality test algorithm, screening out large prime numbers as basic key elements, and combining the basic key elements with preset key combination rules to generate an encryption key; wherein the preset Fermat primality test algorithm pre-optimizes the number of iterations and the screening range of prime number determination; A first encryption module, configured to encrypt the structured sensitive data based on the encryption key using a symmetric encryption algorithm to obtain encrypted structured data; A second encryption module, used to encrypt the unstructured sensitive data to obtain encrypted unstructured data; The integration module is used to integrate the encrypted structured data and the encrypted unstructured data to generate simulated desensitized data.

[0094] In this embodiment, for the specific implementation of each module in the above system embodiment, please refer to the above method embodiment, which will not be repeated here.

[0095] Reference Figure 3 In an embodiment of the present invention, a computer device is also provided. The computer device may be a server, and its internal structure may be as follows: Figure 3 As shown. The computer device includes a processor, a memory, a display screen, an input device, a network interface and a database connected through a system bus. Among them, the processor designed by the computer is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store the corresponding data in this embodiment. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, the above method is implemented.

[0096] Those skilled in the art will understand that Figure 3 The structure shown in the figure is merely a block diagram of a portion of the structure related to the solution of the present invention, and does not constitute a limitation on the computer device to which the solution of the present invention is applied.

[0097] An embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the above method is implemented. It can be understood that the computer-readable storage medium in this embodiment can be a volatile readable storage medium or a non-volatile readable storage medium.

[0098] In summary, the encryption method and system based on the symmetric cryptographic algorithm provided in the embodiments of the present invention include: classifying the acquired sensitive data to obtain structured sensitive data and unstructured sensitive data; selecting key numerical fields in the structured sensitive data, inputting them into a preset Fermat primality test algorithm, screening out large prime numbers as basic key elements, and combining the basic key elements with preset key combination rules to generate an encryption key; wherein the preset Fermat primality test algorithm pre-optimizes the number of iterations and the screening range of prime number judgment; using a symmetric cryptographic algorithm to encrypt the structured sensitive data based on the encryption key to obtain encrypted structured data; encrypting the unstructured sensitive data to obtain encrypted unstructured data; integrating the encrypted structured data and the encrypted unstructured data to generate simulated desensitized data. In the present invention, by selecting key numerical fields in the structured sensitive data and inputting them into a preset Fermat primality test algorithm, large prime numbers are screened out as basic key elements, and the basic key elements are combined with preset key combination rules to generate encryption keys; the characteristics of structured sensitive data can be optimized, thereby effectively protecting the security of sensitive data and overcoming the defect that the generated key is not secure enough.

[0099] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media provided by the present invention and used in the embodiments may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double-speed data rate SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM.

[0100] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, device, article or method including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, device, article or method. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the presence of other identical elements in the process, device, article or method including the element.

[0101] The above description is only a preferred embodiment of the present invention, and does not limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made by using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. An encryption method based on a symmetric cryptographic algorithm, characterized in that: The following steps are involved: Classify the acquired sensitive data to obtain structured sensitive data and unstructured sensitive data; Selecting key numerical fields in the structured sensitive data, inputting them into a preset Fermat primality test algorithm, screening out large prime numbers as basic key elements, and combining the basic key elements with preset key combination rules to generate encryption keys; wherein the preset Fermat primality test algorithm pre-optimizes the number of iterations and screening range of prime number determination; Using a symmetric cryptographic algorithm, encrypt the structured sensitive data based on the encryption key to obtain encrypted structured data; Encrypting the unstructured sensitive data to obtain encrypted unstructured data; The encrypted structured data and the encrypted unstructured data are integrated to generate simulated desensitized data.

2. The encryption method based on the symmetric cryptographic algorithm according to claim 1, characterized in that: After the simulation desensitized data is generated, the following steps are included: The simulated desensitized data is evaluated with the preset desensitized data standard to obtain an evaluation result. If the evaluation result does not meet the requirements, the number of iterations and the screening range of the Fermat primality test algorithm for prime number determination are re-optimized.

3. The encryption method based on the symmetric cryptographic algorithm according to claim 1, characterized in that: The unstructured sensitive data is encrypted to obtain encrypted unstructured data, including: For the unstructured sensitive data, a hash encryption key is generated using a hash function; The unstructured sensitive data is encrypted using a symmetric cryptographic algorithm based on the hash encryption key to obtain encrypted unstructured data.

4. The encryption method based on the symmetric cryptographic algorithm according to claim 1, characterized in that: Select key numerical fields in the structured sensitive data and input them into a preset Fermat primality test algorithm to select large prime numbers as basic key elements, including: Performing data analysis on the structured sensitive data and extracting a numerical field with a key identifier as the key numerical field; Dividing the key numerical field into a plurality of numerical sub-segments, each numerical sub-segment being used as an independent input to participate in the Fermat primality test algorithm; For each numerical sub-segment, when performing the Fermat primality test, an initial base value range is set, and a modular exponentiation algorithm is used to perform the Fermat primality test calculation by multiple base transformations; When the numerical sub-segment shows a preset prime number possibility in multiple Fermat primality tests, it is marked as a large prime number candidate, the relationship between the large prime number candidate and other known prime numbers is calculated, the true large prime number is determined according to the relationship, and pseudo prime numbers are excluded; The truly large prime number is stored as a basic key element in a security key buffer area, and is uniquely identified and indexed.

5. The encryption method based on the symmetric cryptographic algorithm according to claim 1, characterized in that: The step of combining the basic key element with a preset key combination rule to generate an encryption key includes: Using encryption transformation based on lattice cryptography theory, each of the basic key elements is mapped to a high-dimensional vector in a high-dimensional lattice space; Introducing the entangled state characteristics of quantum bits, performing quantum state encoding on each of the high-dimensional vectors, and obtaining a key element encoding; The encryption key is obtained by combining the key element codes.

6. The encryption method based on the symmetric cryptographic algorithm according to claim 1, characterized in that: The step of combining the basic key element with a preset key combination rule to generate an encryption key includes: Performing a first quick hash on each of the basic key elements based on a lightweight hash function to obtain a preliminary hash value; wherein the hash seed is generated based on the current operating status information of the system; Perform secondary hashing on the preliminary hash value based on the Blake2b hash function to obtain a deeply obfuscated element value; Dynamically determine the bit rotation direction and number of steps according to the current system clock cycle, and rearrange the binary bits of the obfuscated element value to obtain the rearranged element value; Constructing a finite field multiplication operation based on a primitive polynomial, expanding the rearranged element value in the finite field to obtain an extended element value; wherein the coefficients of the primitive polynomial are dynamically selected according to the sensitivity level of the data to be encrypted; The extended element values ​​are sequentially combined into the encryption key.

7. The encryption method based on the symmetric cryptographic algorithm according to claim 3, characterized in that: For the unstructured sensitive data, a hash encryption key is generated using a hash function, including: Performing hash calculation on the unstructured sensitive data based on a hash function to obtain a hash value, using each character in the hash value as a basic element of the matrix to construct a two-dimensional matrix; Extracting sentence structure feature vectors, low-frequency feature vectors, and feature vectors of key frequency segments of the unstructured sensitive data; the unstructured sensitive data includes text, images, and audio data; Mapping the sentence structure feature vector, the low-frequency feature vector, and the feature vector of the key frequency segment to three-dimensional space respectively, and constructing a triangular mesh surface through a triangulation algorithm according to the similarity and correlation between the feature vectors; The hash encryption key is generated based on the triangular mesh surface and the two-dimensional matrix.

8. The encryption method based on the symmetric cryptographic algorithm according to claim 7, characterized in that: Generating the hash encryption key based on the triangular mesh surface and the two-dimensional matrix includes: Quantizing the vertex coordinate values ​​of each triangular face of the triangular mesh surface, and establishing a mapping relationship with the elements at a preset position in the two-dimensional matrix; Based on the matrix element values ​​of the vertex coordinate mapping of each triangular face, bilinear interpolation is used to calculate the value corresponding to any point in the triangular face, and the numerical matrix is ​​obtained by combining them; Performing singular value decomposition on the numerical matrix, extracting singular values ​​therein, and reorganizing each singular value to obtain reorganized singular values; A hash operation is performed on the reorganized singular value to generate the hash encryption key.

9. An encryption system based on a symmetric cryptographic algorithm, characterized in that: include: The classification module is used to classify the acquired sensitive data to obtain structured sensitive data and unstructured sensitive data; A generation module, for selecting key numerical fields in the structured sensitive data, inputting them into a preset Fermat primality test algorithm, screening out large prime numbers as basic key elements, and combining the basic key elements with preset key combination rules to generate an encryption key; wherein the preset Fermat primality test algorithm pre-optimizes the number of iterations and the screening range of prime number determination; A first encryption module, configured to encrypt the structured sensitive data based on the encryption key using a symmetric encryption algorithm to obtain encrypted structured data; A second encryption module, used to encrypt the unstructured sensitive data to obtain encrypted unstructured data; The integration module is used to integrate the encrypted structured data and the encrypted unstructured data to generate simulated desensitized data.

10. A computer device comprising a memory and a processor, wherein a computer program is stored in the memory, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 8 are implemented.

Images