Data encryption method and device, computer equipment, storage medium and program product

Abstract

The invention relates to a data encryption method and device, computer equipment, a storage medium and a program product. The method comprises the following steps: acquiring data sensitivity information and current threat level information of to-be-encrypted data, and system resource use condition information of a data encryption system; the data encryption system is used for encrypting data; in a preset rule base, according to the data sensitivity information, the current threat level information and the system resource use condition information, encryption strategy information for the to-be-encrypted data is determined; the encryption strategy information represents an encryption algorithm, an encryption key and encryption strength for the to-be-encrypted data; and encrypting the to-be-encrypted data through the data encryption system according to the encryption strategy information. By adopting the method, corresponding encryption modes such as an encryption algorithm, an encryption key and encryption strength can be adaptively determined from multiple angles such as data sensitivity, threat level and system resources, flexible encryption of information is realized, and the flexibility of data encryption is improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a data encryption method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Art

[0002] In the field of network security technology, data encryption protects data confidentiality by converting information into ciphertext to prevent unauthorized access; at the same time, it ensures data integrity and authenticity to prevent data tampering or forgery; it supports identity authentication and non-repudiation to ensure the authenticity of the identities of both communicating parties and traceability of their behaviors, which is conducive to maintaining information security, protecting privacy and ensuring the reliability of network services.

[0003] Traditional technologies mainly implement data encryption by uniformly encrypting all data in a unified manner. This cannot cope with diverse attacks and ever-changing security requirements, and is not conducive to improving the flexibility of data encryption. Summary of the invention

[0004] Based on this, it is necessary to provide a data encryption method, apparatus, computer device, computer-readable storage medium and computer program product that can improve the flexibility of data encryption in response to the above technical problems.

[0005] In a first aspect, the present application provides a data encryption method, comprising:

[0006] Acquiring data sensitivity information and current threat level information of the data to be encrypted, as well as system resource usage information of a data encryption system; the data encryption system is used to encrypt the data;

[0007] Determining encryption policy information for the data to be encrypted in a preset rule base according to the data sensitivity information, the current threat level information and the system resource usage information; the encryption policy information represents the encryption algorithm, encryption key and encryption strength for the data to be encrypted;

[0008] The data to be encrypted is encrypted by the data encryption system according to the encryption policy information.

[0009] In one embodiment, the preset rule base includes fuzzy rules, and the fuzzy rules represent the corresponding relationship between data sensitivity, current threat level, system resource usage and encryption policy. The encryption policy information for the data to be encrypted is determined in the preset rule base according to the data sensitivity information, the current threat level information and the system resource usage information, including:

[0010] According to the data sensitivity information, the current threat level information and the system resource usage information, a target fuzzy rule is screened out from the fuzzy rules in the preset rule base; the data sensitivity, current threat level and system resource usage corresponding to the target fuzzy rule match the data sensitivity information, the current threat level information and the system resource usage information;

[0011] Determine that the encryption policy corresponding to the target fuzzy rule is encryption policy information for the data to be encrypted.

[0012] In one embodiment, the step of selecting a target fuzzy rule from the fuzzy rules in the preset rule base according to the data sensitivity information, the current threat level information and the system resource usage information includes:

[0013] Comparing the data sensitivity, current threat level and system resource usage corresponding to the fuzzy rules in the preset rule base with the data sensitivity information, the current threat level information and the system resource usage information one by one;

[0014] The fuzzy rules in the preset rule base whose data sensitivity is consistent with the data sensitivity information, whose current threat level is consistent with the current threat level information, and whose system resource usage is consistent with the system resource usage information are taken as target fuzzy rules.

[0015] In one embodiment, the step of selecting a target fuzzy rule from the fuzzy rules in the preset rule base according to the data sensitivity information, the current threat level information and the system resource usage information includes:

[0016] Determining data sensitivity interval information of the fuzzy rules according to data sensitivity corresponding to the fuzzy rules in the preset rule base, determining current threat level interval information of the fuzzy rules according to current threat levels corresponding to the fuzzy rules in the preset rule base, and determining system resource usage interval information of the fuzzy rules according to system resource usage corresponding to the fuzzy rules in the preset rule base;

[0017] The data sensitivity information is compared with the data sensitivity interval information of the fuzzy rule, the current threat level information is compared with the previous threat level interval information of the fuzzy rule, and the system resource usage information is compared with the system resource usage interval information of the fuzzy rule, and the target fuzzy rule is selected from the fuzzy rules in the preset rule base.

[0018] In one embodiment, the step of comparing the data sensitivity information with the data sensitivity interval information of the fuzzy rule, the current threat level information with the previous threat level interval information of the fuzzy rule, and the system resource usage information with the system resource usage interval information of the fuzzy rule one by one, and selecting the target fuzzy rule from the fuzzy rules in the preset rule base includes:

[0019] Generate a first fuzzy rule set according to the fuzzy rule that the data sensitivity interval information in the fuzzy rules includes the data sensitivity information;

[0020] generating a second fuzzy rule set according to the fuzzy rule that the current threat level interval information in the fuzzy rules includes the current threat level information;

[0021] generating a third fuzzy rule set according to the fuzzy rule that the system resource usage interval information in the fuzzy rules includes the system resource usage information;

[0022] The target fuzzy rule is determined according to an intersection among the first fuzzy rule set, the second fuzzy rule set and the third fuzzy rule set.

[0023] In one embodiment, after the step of encrypting the data to be encrypted according to the encryption policy information by the data encryption system, the method further includes:

[0024] Obtaining encrypted data corresponding to the data to be encrypted;

[0025] Obtaining a storage location and / or a transmission location corresponding to the encrypted data;

[0026] The encrypted data is stored in the storage location, and / or the encrypted data is sent to the transmission location.

[0027] In a second aspect, the present application also provides a data encryption device, comprising:

[0028] An acquisition module, used to acquire data sensitivity information and current threat level information of the data to be encrypted, and system resource usage information of a data encryption system; the data encryption system is used to encrypt the data;

[0029] A determination module, configured to determine encryption policy information for the data to be encrypted in a preset rule base according to the data sensitivity information, the current threat level information, and the system resource usage information; the encryption policy information represents an encryption algorithm, an encryption key, and an encryption strength for the data to be encrypted;

[0030] An encryption module is used to encrypt the data to be encrypted according to the encryption policy information through the data encryption system.

[0031] In a third aspect, the present application further provides a computer device, wherein the computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the steps of the above method are implemented.

[0032] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the steps of the above method when executed by a processor.

[0033] In a fifth aspect, the present application further provides a computer program product, wherein the computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the above method are implemented.

[0034] The above-mentioned data encryption method, apparatus, computer device, computer-readable storage medium and computer program product obtain data sensitivity information and current threat level information of the data to be encrypted, as well as system resource usage information of the data encryption system; the data encryption system is used to encrypt data, thereby accurately analyzing the data sensitivity, current threat level and resource usage of the data encryption system of the data to be encrypted, so as to subsequently accurately determine the encryption method for the data to be encrypted from multiple angles such as data sensitivity, threat level and system resources; determine the encryption policy information for the data to be encrypted in a preset rule base according to the data sensitivity information, current threat level information and system resource usage information. Information; encryption policy information represents the encryption algorithm, encryption key and encryption strength for the data to be encrypted; thereby combining multiple angles such as data sensitivity, threat level and system resources, based on the rule base, accurately analyzes the encryption algorithm, encryption key and encryption strength suitable for encrypting the data to be encrypted, thereby improving the accuracy of the encryption policy information; through the data encryption system, the encrypted data is encrypting according to the encryption policy information, and the corresponding encryption algorithm, encryption key and encryption strength can be adaptively determined from multiple angles such as data sensitivity, threat level and system resources, thereby realizing flexible encryption of information, avoiding the problem of decreased data security due to unified encryption of all data, and improving the flexibility of data encryption. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0036] Figure 1 An application environment diagram of a data encryption method in an embodiment;

[0037] Figure 2 A schematic diagram of a flow chart of a data encryption method in an embodiment;

[0038] Figure 3 is a schematic diagram of the architecture of an adaptive data encryption system based on fuzzy logic in one embodiment;

[0039] Figure 4 is a structural block diagram of a data encryption device in one embodiment;

[0040] Figure 5 The figure is a diagram of the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0042] The data encryption method provided in the embodiment of the present application can be applied to Figure 1In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. The server 104 obtains the data sensitivity information and current threat level information of the data to be encrypted, as well as the system resource usage information of the data encryption system; the data encryption system is used to encrypt the data; the server 104 determines the encryption policy information for the data to be encrypted in the preset rule library according to the data sensitivity information, the current threat level information and the system resource usage information; the encryption policy information represents the encryption algorithm, encryption key and encryption strength for the data to be encrypted; the server 104 encrypts the encrypted data according to the encryption policy information through the data encryption system. Among them, the terminal 102 can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, Internet of Things devices and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car devices, projection devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The head mounted device may be a virtual reality (VR) device, an augmented reality (AR) device, smart glasses, etc. The server 104 may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0043] In an exemplary embodiment, Figure 2 As shown, a data encryption method is provided, and the method is applied to a server as an example for explanation, including the following steps S202 to S206. Among them:

[0044] Step S202, obtaining data sensitivity information and current threat level information of the data to be encrypted, as well as system resource usage information of the data encryption system; the data encryption system is used to encrypt the data.

[0045] The data to be encrypted may refer to data that needs to be encrypted. In practical applications, the data to be encrypted may come from any source (such as business data, user data, etc.), and is not limited to a specific industry, application, or data generation environment. The data types of the data to be encrypted may include, but are not limited to, text, images, audio, video, database records, network transmission data packets, and any combination of these forms.

[0046] Data sensitivity information refers to the degree of security protection required for the encrypted data, and can reflect the potential harm that may be caused by unauthorized access, use, disclosure, loss or modification of the encrypted data. The level of data sensitivity represented by the data sensitivity information determines the level of protection measures that need to be taken to ensure data security.

[0047] The current threat level information may refer to information characterizing the severity of a data security incident for the data to be encrypted. In practical applications, the data security incident for the data to be encrypted may include data leakage of the data to be encrypted.

[0048] The data encryption system may refer to a system for encrypting data.

[0049] The system resource usage information may refer to information representing the current usage status of various resources (such as CPU, memory, disk, network, etc.) of the data encryption system.

[0050] As an example, the server can perform data encryption through a data encryption system. When the server obtains the data to be encrypted, the server can analyze the data sensitivity and the current threat level of the data to be encrypted, and determine the data sensitivity information and the current threat level information of the data to be encrypted. At the same time, since the resource usage of the data encryption system will affect the performance of the data encryption system, and the performance of the data encryption system will affect whether the data encryption operation is completed accurately, the server can also obtain system resource usage information used to characterize the resource usage of the data encryption system at the current moment, so as to subsequently combine the data sensitivity information, the current threat level information and the system resource usage information to determine the data encryption method for the data to be encrypted.

[0051] Step S204, determining encryption policy information for the data to be encrypted in a preset rule base according to data sensitivity information, current threat level information and system resource usage information; the encryption policy information represents the encryption algorithm, encryption key and encryption strength for the data to be encrypted.

[0052] The preset rule base may refer to a pre-set database containing a number of preset rules. In practical applications, each preset rule may be used to describe specific data sensitivity information, current threat level information, and system resource usage information.

[0053] The encryption policy information may refer to information characterizing the encryption algorithm, encryption key, and encryption strength for the data to be encrypted. In practical applications, each preset rule may have corresponding encryption policy information.

[0054] As an example, in order to determine the data encryption method to be used when encrypting data to be encrypted, the server can obtain a preset rule library, which contains several preset rules. Since each preset rule can describe specific data sensitivity information, current threat level information, and system resource usage information, the server can compare each preset rule with the data sensitivity information, current threat level information, and system resource usage information obtained by the server, and use the encryption policy corresponding to the screened preset rule as the encryption policy information for the data to be encrypted, thereby determining the data encryption method for the data to be encrypted based on the encryption policy information for the data to be encrypted.

[0055] Step S206: encrypt the data to be encrypted according to the encryption policy information through the data encryption system.

[0056] As an example, the server can analyze the encryption algorithm, encryption key and encryption strength described / characterized by the encryption policy information for the data to be encrypted based on the encryption policy information for the data to be encrypted. Then, the server can encrypt the data to be encrypted using the encryption algorithm described / characterized by the encryption policy information for the data to be encrypted according to the encryption key and encryption strength described / characterized by the encryption policy information for the data to be encrypted.

[0057] In the above data encryption method, by obtaining data sensitivity information and current threat level information of the data to be encrypted, as well as system resource usage information of the data encryption system; the data encryption system is used to encrypt the data, so as to accurately analyze the data sensitivity of the data to be encrypted, the current threat level and the resource usage of the data encryption system, so as to subsequently accurately determine the encryption method for the data to be encrypted from multiple angles such as data sensitivity, threat level and system resources; in a preset rule base, encryption policy information for the data to be encrypted is determined according to the data sensitivity information, the current threat level information and the system resource usage information; the encryption policy information represents the encryption algorithm, encryption key and encryption strength for the data to be encrypted; thereby combining multiple angles such as data sensitivity, threat level and system resources, based on the rule base, the encryption algorithm, encryption key and encryption strength suitable for encrypting the data to be encrypted are accurately analyzed to improve the accuracy of the encryption policy information; the data encryption system encrypts the data to be encrypted according to the encryption policy information, and can adaptively determine the corresponding encryption algorithm, encryption key and encryption strength from multiple angles such as data sensitivity, threat level and system resources, so as to realize flexible encryption of information, avoid the problem of reduced data security caused by unified encryption of all data, and improve the flexibility of data encryption.

[0058] In an exemplary embodiment, a preset rule base includes fuzzy rules, which characterize the correspondence between data sensitivity, current threat level and system resource usage and encryption policy. In the preset rule base, encryption policy information for the data to be encrypted is determined based on the data sensitivity information, current threat level information and system resource usage information, including: screening out target fuzzy rules from the fuzzy rules in the preset rule base based on the data sensitivity information, current threat level information and system resource usage information; matching the data sensitivity, current threat level and system resource usage corresponding to the target fuzzy rule with the data sensitivity information, current threat level information and system resource usage information; determining that the encryption policy corresponding to the target fuzzy rule is the encryption policy information for the data to be encrypted.

[0059] The fuzzy rule may refer to information that characterizes the corresponding relationship between data sensitivity, current threat level, system resource usage, and encryption policy. In practical applications, each fuzzy rule may have a corresponding encryption policy. In a specific implementation, the fuzzy rules in the preset rule base may be updated in real time.

[0060] Among them, the target fuzzy rule may refer to a fuzzy rule in a preset rule base that matches the data sensitivity, current threat level and system resource usage information with the data sensitivity information, current threat level information and system resource usage information.

[0061] As an example, the preset rule base may include several fuzzy rules, each of which may be used to characterize the correspondence between data sensitivity, current threat level, system resource usage, and encryption policy. For example, fuzzy rule M1 may be used to characterize the correspondence between data sensitivity A1, current threat level B1, system resource usage C1, and encryption policy D1, and fuzzy rule M2 may be used to characterize the correspondence between data sensitivity A2, current threat level B2, system resource usage C2, and encryption policy D2. Therefore, in order to accurately analyze the encryption method suitable for the data to be encrypted, the server may select the fuzzy rules that match the data sensitivity, current threat level, and system resource usage with the data sensitivity information, current threat level information, and system resource usage information from the fuzzy rules in the preset rule base according to the data sensitivity information, current threat level information, and system resource usage information obtained by the server as the target fuzzy rules, and determine the encryption policy corresponding to the target fuzzy rule as the encryption policy information for the data to be encrypted.

[0062] In the present embodiment, a target fuzzy rule is screened out from the fuzzy rules in a preset rule base according to data sensitivity information, current threat level information and system resource usage information; the data sensitivity, current threat level and system resource usage corresponding to the target fuzzy rule are matched with the data sensitivity information, current threat level information and system resource usage information; the encryption policy corresponding to the target fuzzy rule is determined to be the encryption policy information for the data to be encrypted, and the target fuzzy rule can be accurately screened out from the fuzzy rules in the preset rule base based on the data sensitivity information, current threat level information and system resource usage information, and the encryption policy corresponding to the target fuzzy rule is determined as the encryption policy information for the data to be encrypted, thereby improving the accuracy of the encryption policy information, so as to adaptively encrypt the data to be encrypted based on the encryption policy information, thereby improving the flexibility of data encryption.

[0063] In some embodiments, target fuzzy rules are screened out from fuzzy rules in a preset rule base based on data sensitivity information, current threat level information and system resource usage information, including: comparing the data sensitivity, current threat level and system resource usage corresponding to the fuzzy rules in the preset rule base with the data sensitivity information, current threat level information and system resource usage information one by one; and taking the fuzzy rules in the preset rule base whose data sensitivity is consistent with the data sensitivity information, the current threat level is consistent with the current threat level information, and the system resource usage is consistent with the system resource usage information as the target fuzzy rules.

[0064] As an example, the accuracy of the data sensitivity, current threat level and system resource usage described / characterized by the fuzzy rules will affect the screening method of the target fuzzy rules. In actual applications, when the accuracy of the data sensitivity, current threat level and system resource usage described / characterized by the fuzzy rules meets the first accuracy requirement (such as each fuzzy rule only describes / characterizes a specific data sensitivity information, a specific current threat level information and a specific system resource usage information), at this time, the server can compare the data sensitivity, current threat level and system resource usage corresponding to the fuzzy rules in the preset rule base with the data sensitivity information, current threat level information and system resource usage information one by one, and use the fuzzy rules in the preset rule base whose data sensitivity is consistent with the data sensitivity information, the current threat level is consistent with the current threat level information, and the system resource usage is consistent with the system resource usage information as the target fuzzy rules. For example, the server can construct a virtual fuzzy rule based on the data sensitivity information, current threat level information, and system resource usage information obtained by the server, and search in the preset rule base whether there is a fuzzy rule with the same content as the virtual fuzzy rule. If there is a fuzzy rule with the same content as the virtual fuzzy rule in the preset rule base, the server can use the fuzzy rule as the target fuzzy rule.

[0065] In this embodiment, by comparing the data sensitivity, current threat level and system resource usage corresponding to the fuzzy rules in the preset rule base with the data sensitivity information, current threat level information and system resource usage information one by one; the fuzzy rules in the preset rule base whose data sensitivity is consistent with the data sensitivity information, the current threat level is consistent with the current threat level information, and the system resource usage is consistent with the system resource usage information are taken as target fuzzy rules, the target fuzzy rules can be accurately screened out from the preset rule base, and the accuracy of the target fuzzy rules can be improved, so as to determine accurate encryption policy information based on the target fuzzy rules, thereby improving the flexibility of data encryption.

[0066] In some embodiments, target fuzzy rules are screened out from the fuzzy rules in a preset rule base based on data sensitivity information, current threat level information and system resource usage information, including: determining data sensitivity interval information of the fuzzy rules based on the data sensitivity corresponding to the fuzzy rules in the preset rule base, and determining current threat level interval information of the fuzzy rules based on the current threat level corresponding to the fuzzy rules in the preset rule base, and determining system resource usage interval information of the fuzzy rules based on the system resource usage corresponding to the fuzzy rules in the preset rule base; comparing the data sensitivity information with the data sensitivity interval information of the fuzzy rules, the current threat level information with the previous threat level interval information of the fuzzy rules, and the system resource usage information with the system resource usage interval information of the fuzzy rules one by one, and screening out the target fuzzy rules from the fuzzy rules in the preset rule base.

[0067] The data sensitivity interval information may refer to information characterizing the range of data sensitivity corresponding to / described by the fuzzy rule.

[0068] The current threat level interval information may refer to information representing the range of the current threat level corresponding to / described by the fuzzy rule.

[0069] The system resource usage interval information may refer to information characterizing the range of the system resource usage corresponding to / described by the fuzzy rule.

[0070] As an example, the accuracy of the data sensitivity, current threat level, and system resource usage described / characterized by the fuzzy rules will affect the screening method of the target fuzzy rules. In practical applications, when the accuracy of the data sensitivity, current threat level, and system resource usage described / characterized by the fuzzy rules meets the second accuracy requirement (such as each fuzzy rule only describes / characterizes a data sensitivity range, a current threat level range, and a system resource usage range), at this time, the server can first analyze the range of data sensitivity, current threat level, and system resource usage described / characterized by each fuzzy rule in the preset rule base, and then select the target fuzzy rule based on the data sensitivity described / characterized by the fuzzy rules. The server can also determine the current threat level interval information of the fuzzy rule based on the range of the current threat level described / characterized by the fuzzy rule. The server can also determine the system resource usage interval information of the fuzzy rule based on the range of the system resource usage described / characterized by the fuzzy rule. After that, the server can compare the data sensitivity information obtained by the server with the data sensitivity interval information of the fuzzy rule, the current threat level information with the previous threat level interval information of the fuzzy rule, and the system resource usage information with the system resource usage interval information of the fuzzy rule, and filter out the target fuzzy rule from the fuzzy rules in the preset rule base.

[0071] In this embodiment, the data sensitivity interval information of the fuzzy rules is determined according to the data sensitivity corresponding to the fuzzy rules in the preset rule base, the current threat level interval information of the fuzzy rules is determined according to the current threat level corresponding to the fuzzy rules in the preset rule base, and the system resource usage interval information of the fuzzy rules is determined according to the system resource usage corresponding to the fuzzy rules in the preset rule base; the data sensitivity information is compared with the data sensitivity interval information of the fuzzy rules, the current threat level information is compared with the previous threat level interval information of the fuzzy rules, and the system resource usage information is compared with the system resource usage interval information of the fuzzy rules. The target fuzzy rules are screened out from the fuzzy rules in the preset rule base, and the intervals described / characterized by each fuzzy rule can be accurately analyzed. In combination with the data sensitivity information, the current threat level information and the system resource usage information, accurate target fuzzy rules are screened out from the preset rule base, thereby improving the accuracy of the target fuzzy rules, so as to determine accurate encryption policy information based on the target fuzzy rules, thereby improving the flexibility of data encryption.

[0072] In some embodiments, data sensitivity information is compared with data sensitivity interval information of fuzzy rules, current threat level information is compared with previous threat level interval information of fuzzy rules, and system resource usage information is compared with system resource usage interval information of fuzzy rules, and target fuzzy rules are screened out from fuzzy rules in a preset rule base, including: generating a first fuzzy rule set according to fuzzy rules whose data sensitivity interval information contains data sensitivity information in fuzzy rules; generating a second fuzzy rule set according to fuzzy rules whose current threat level interval information contains current threat level information in fuzzy rules; generating a third fuzzy rule set according to fuzzy rules whose system resource usage interval information contains system resource usage information in fuzzy rules; and determining the target fuzzy rule according to the intersection of the first fuzzy rule set, the second fuzzy rule set and the third fuzzy rule set.

[0073] The first fuzzy rule set may refer to a set of fuzzy rules in which data sensitivity interval information in a preset rule base includes data sensitivity information.

[0074] The second fuzzy rule set may refer to a set of fuzzy rules in which the current threat level interval information includes the current threat level information in the fuzzy rules in the preset rule base.

[0075] The third fuzzy rule set may refer to a set of fuzzy rules in which the system resource usage interval information in the fuzzy rules in the preset rule base includes the system resource usage information.

[0076] As an example, the server may first filter out the fuzzy rules whose data sensitivity interval information contains data sensitivity information in the fuzzy rules to generate a first fuzzy rule set, and then the server may filter out the fuzzy rules whose current threat level interval information contains current threat level information in the fuzzy rules to generate a second fuzzy rule set, and then the server may filter out the fuzzy rules whose system resource usage interval information contains system resource usage information in the fuzzy rules to generate a third fuzzy rule set, and then the server may calculate the intersection of the first fuzzy rule set, the second fuzzy rule set and the third fuzzy rule set, and the fuzzy rules in the intersection may be used as target fuzzy rules. In actual applications, in the process of filtering fuzzy rules and generating a fuzzy rule set based on data sensitivity information, current threat level information and system resource usage information, the server can also first filter out the fuzzy rules whose current threat level interval information contains the current threat level information in the fuzzy rules to generate a fourth fuzzy rule set, and then the server can filter out the fuzzy rules whose data sensitivity interval information contains the data sensitivity information in the fuzzy rules to generate a fifth fuzzy rule set, and then the server can filter out the fuzzy rules whose system resource usage interval information contains the system resource usage information in the fuzzy rules to generate a sixth fuzzy rule set, and then the server can calculate the intersection between the fourth fuzzy rule set, the fifth fuzzy rule set and the sixth fuzzy rule set, and the fuzzy rules in the intersection can be used as the target fuzzy rules. It can be understood that in the process of filtering fuzzy rules and generating a fuzzy rule set based on data sensitivity information, current threat level information and system resource usage information, the order of filtering data sensitivity information, current threat level information and system resource usage information can be flexibly adjusted.

[0077] In this embodiment, a first fuzzy rule set is generated according to a fuzzy rule that data sensitivity interval information in the fuzzy rules contains data sensitivity information; a second fuzzy rule set is generated according to a fuzzy rule that current threat level interval information in the fuzzy rules contains current threat level information; a third fuzzy rule set is generated according to a fuzzy rule that system resource usage interval information in the fuzzy rules contains system resource usage information; a target fuzzy rule is determined according to the intersection of the first fuzzy rule set, the second fuzzy rule set and the third fuzzy rule set. The fuzzy rule sets can be first screened out, and the intersection between the fuzzy rule sets can be calculated to determine the target fuzzy rule, thereby improving the accuracy of the target fuzzy rule, so as to determine accurate encryption policy information based on the target fuzzy rule, thereby improving the flexibility of data encryption.

[0078] In some embodiments, after the step of encrypting the data to be encrypted according to the encryption policy information through the data encryption system, the above method also includes: obtaining encrypted data corresponding to the data to be encrypted; obtaining the storage location and / or transmission location corresponding to the encrypted data; storing the encrypted data in the storage location, and / or sending the encrypted data to the transmission location.

[0079] The encrypted data may refer to data obtained by encrypting the data to be encrypted using an encryption algorithm described / characterized by the encryption policy information for the data to be encrypted, according to the encryption key and encryption strength described / characterized by the encryption policy information for the data to be encrypted.

[0080] The storage location may refer to a location for storing encrypted data.

[0081] The transmission location may refer to a location for receiving encrypted data.

[0082] As an example, the server encrypts the data to be encrypted according to the encryption key and encryption strength described / characterized by the encryption policy information for the data to be encrypted, and adopts the encryption algorithm described / characterized by the encryption policy information for the data to be encrypted, to obtain the encrypted data. The server can then obtain the processing method information for the encrypted data (such as storage and transmission, etc.). If the encrypted data needs to be stored, the server can obtain the storage location corresponding to the encrypted data, and store the encrypted data in the storage location corresponding to the encrypted data. If the encrypted data needs to be transmitted, the server can obtain the transmission location / transmission object corresponding to the encrypted data, and transmit / send the encrypted data to the storage location / transmission object corresponding to the encrypted data.

[0083] In this embodiment, by obtaining the encrypted data corresponding to the data to be encrypted; obtaining the storage location and / or transmission location corresponding to the encrypted data; storing the encrypted data in the storage location, and / or sending the encrypted data to the transmission location, it is possible to ensure that the encrypted data is securely stored or transmitted, thereby ensuring the security of the encrypted data.

[0084] In some embodiments, an adaptive data encryption system based on fuzzy logic can be used to implement data encryption, such as Figure 3As shown, a schematic diagram of the architecture of an adaptive data encryption system based on fuzzy logic is provided. The adaptive data encryption system based on fuzzy logic can include an input module, a fuzzy logic controller, an encryption module and an output module, wherein the functions of the input module include receiving and processing raw data, extracting and transmitting key information such as data type and sensitivity. The input module is the starting point of the entire system, responsible for collecting data to be encrypted, and performing preliminary processing on the data to extract key information such as data type and sensitivity level. This information will serve as the basis for subsequent fuzzy logic controllers to make decisions. The functions of the fuzzy logic controller include dynamically adjusting encryption strategies and parameters based on the information provided by the input module. The fuzzy logic controller is the core component of the system. The fuzzy logic controller receives the data provided by the input module, and dynamically adjusts the encryption strategies and parameters based on the predefined fuzzy rule base through fuzzy logic reasoning, including selecting appropriate encryption algorithms and key lengths. The functions of the encryption module include performing actual data encryption operations. The encryption module selects the encryption algorithm (such as AES, RSA, etc.) and key length that best suits the current data characteristics and security requirements based on the output of the fuzzy logic controller, performs data encryption operations, and ensures the security of data during storage and transmission. The output module's functions include outputting encrypted data and storing or transmitting it. The output module is responsible for receiving the encrypted data generated by the encryption module and outputting it to a specified location or transmitting it securely. The output module is also responsible for the management and monitoring of encrypted data to ensure the security of the data throughout the storage and transmission process.

[0085] The input variables of the fuzzy logic controller include: data sensitivity, current threat level, system resource usage, etc. The input variables of the fuzzy logic controller are the basis for the fuzzy logic controller to make decisions. Data sensitivity determines the importance of the data, the current threat level reflects the security status of the current network environment, and the system resource usage affects the performance requirements of the system when performing encryption operations. The fuzzy logic controller is equipped with a fuzzy rule base, which is used to define fuzzy rules based on input variables and determine encryption strategies and parameters. The fuzzy rule base contains a series of predefined fuzzy rules, which determine the corresponding encryption strategies and parameters according to different combinations of input variables. For example, when the data sensitivity is high and the current threat level is high, a high-strength encryption algorithm and a longer key are selected. The output variables of the fuzzy logic controller include encryption algorithm selection, key length, encryption strength, etc. The output variables of the fuzzy logic controller determine the specific operation content of the encryption module. According to the reasoning results of the fuzzy rule base, appropriate encryption algorithms and parameters are dynamically generated to perform effective encryption operations.

[0086] The steps of implementing data encryption in an adaptive data encryption system based on fuzzy logic may include: (1) Data collection and preparation: Collect and prepare the data to be encrypted, extract the data type and sensitivity information. This step ensures that the system obtains enough information to make accurate encryption decisions. (2) Input variable evaluation: Evaluate input variables such as data sensitivity and current threat level through fuzzy logic. This step evaluates current security requirements and environmental conditions and provides basic data for fuzzy reasoning. (3) Fuzzy reasoning: Use fuzzy logic controller and rule base to perform fuzzy reasoning to determine encryption strategies and parameters. Through fuzzy reasoning, the system can select the best encryption scheme under different circumstances. (4) Encryption operation: According to the results of fuzzy reasoning, select the appropriate encryption algorithm (such as AES, RSA, etc.) and key length to encrypt the data. Perform specific encryption operations to ensure the security of data during storage and transmission. (5) Output processing: Output the encrypted data and store or transmit it. Ensure that the encrypted data is securely stored or transmitted to the target location to prevent data leakage or tampering.

[0087] In practical applications, the adaptive data encryption system based on fuzzy logic can also manage encryption keys. Specifically, the adaptive data encryption system based on fuzzy logic can dynamically generate encryption keys based on the fuzzy logic evaluation results. The key generation process is based on the output of the fuzzy logic controller to ensure that the key length and complexity match the current security requirements. The adaptive data encryption system based on fuzzy logic can also securely store and distribute encryption keys to ensure the security of the keys. The key management system needs to ensure that the keys are not accessed by unauthorized persons during generation, storage, and use.

[0088] In the specific implementation, the adaptive data encryption system based on fuzzy logic can be used for secure encryption of cloud storage systems. By dynamically adjusting the encryption strategy, the security and privacy of cloud storage data can be ensured, and secure encryption of cloud storage can be achieved. The adaptive data encryption system based on fuzzy logic can also be used for data protection of mobile devices. Through adaptive encryption, the defense capability of mobile devices against diversified attacks can be improved, and data protection of mobile devices can be achieved. The adaptive data encryption system based on fuzzy logic can also implement adaptive data encryption in Internet of Things devices (IoT) to enhance the overall security of the IoT system. The adaptive data encryption system based on fuzzy logic can also apply adaptive encryption methods on e-commerce platforms to protect the security of transaction data, prevent data leakage and tampering, and ensure the security of e-commerce transactions. The adaptive data encryption system based on fuzzy logic can also be used for sensitive data protection of enterprises and other objects. Through intelligent encryption methods, data security and management efficiency are improved to ensure enterprise data security.

[0089] In this embodiment, by dynamically adjusting the encryption strategy, the encryption strategy can be dynamically selected and adjusted according to factors such as real-time data type, sensitivity, current threat level, etc., so as to automatically optimize its operation in different environments to cope with various security challenges; whether facing sudden high-threat attacks or daily low-threat environments, its security measures can be automatically adjusted to ensure that the most appropriate encryption protection is always provided, thereby improving adaptability to environmental changes; by introducing fuzzy logic, it can handle the uncertainty and complexity that traditional encryption methods are difficult to cope with, and can more accurately evaluate threats and data sensitivity, thereby formulating more intelligent encryption strategies, thereby handling uncertainty based on fuzzy logic; the fuzzy logic controller can adjust the input variables (such as data The system can adjust encryption parameters (such as encryption algorithm and key length) in real time based on the sensitivity and threat level of the threat, realize intelligent encryption management, improve overall security performance, and realize intelligent parameter management; on the premise of ensuring security, through intelligent encryption strategy selection, optimize resource use to the maximum extent, such as reducing encryption strength in a low-threat environment to save computing resources and time, thereby optimizing resource use; by selecting the most appropriate encryption method and key length, ensure that encryption and decryption operations can be performed with the highest efficiency in different situations, reduce processing time, improve system performance, and improve encryption and decryption efficiency; combine multiple encryption methods (such as symmetric encryption and asymmetric encryption) and fuzzy logic technology to provide multi-level security protection. Under different data and environmental conditions, these technologies can be flexibly combined to maximize data security and realize multi-level security protection; through the intelligent judgment and dynamic adjustment of the fuzzy logic system, it can effectively respond to various known and unknown attacks, increasing the difficulty for attackers to break through the security line of defense.

[0090] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0091] Based on the same inventive concept, the embodiment of the present application also provides a data encryption device for implementing the data encryption method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more data encryption device embodiments provided below can refer to the limitations on the data encryption method above, and will not be repeated here.

[0092] In an exemplary embodiment, Figure 4 As shown, a data encryption device is provided, including: an acquisition module 402, a determination module 404 and an encryption module 406, wherein:

[0093] The acquisition module 402 is used to obtain data sensitivity information and current threat level information of the data to be encrypted, as well as system resource usage information of the data encryption system; the data encryption system is used to encrypt the data.

[0094] The determination module 404 is used to determine the encryption policy information for the data to be encrypted based on the data sensitivity information, the current threat level information and the system resource usage information in a preset rule base; the encryption policy information represents the encryption algorithm, encryption key and encryption strength for the data to be encrypted.

[0095] The encryption module 406 is used to encrypt the data to be encrypted according to the encryption policy information through the data encryption system.

[0096] In one of the exemplary embodiments, the preset rule base includes fuzzy rules, and the fuzzy rules characterize the correspondence between data sensitivity, current threat level and system resource usage and encryption policy. The determination module 404 is specifically used to filter out target fuzzy rules from the fuzzy rules in the preset rule base according to the data sensitivity information, the current threat level information and the system resource usage information; the data sensitivity, current threat level and system resource usage corresponding to the target fuzzy rule match the data sensitivity information, the current threat level information and the system resource usage information; and determine that the encryption policy corresponding to the target fuzzy rule is the encryption policy information for the data to be encrypted.

[0097] In one of the exemplary embodiments, the determination module 404 is specifically used to compare the data sensitivity, current threat level and system resource usage corresponding to the fuzzy rules in the preset rule base with the data sensitivity information, the current threat level information and the system resource usage information one by one; and take the fuzzy rules in the preset rule base whose data sensitivity is consistent with the data sensitivity information, the current threat level is consistent with the current threat level information, and the system resource usage is consistent with the system resource usage information as the target fuzzy rules.

[0098] In one of the exemplary embodiments, the determination module 404 is specifically used to determine the data sensitivity interval information of the fuzzy rules according to the data sensitivity corresponding to the fuzzy rules in the preset rule base, determine the current threat level interval information of the fuzzy rules according to the current threat level corresponding to the fuzzy rules in the preset rule base, and determine the system resource usage interval information of the fuzzy rules according to the system resource usage corresponding to the fuzzy rules in the preset rule base; compare the data sensitivity information with the data sensitivity interval information of the fuzzy rules, the current threat level information with the previous threat level interval information of the fuzzy rules, and the system resource usage information with the system resource usage interval information of the fuzzy rules one by one, and filter out the target fuzzy rules from the fuzzy rules in the preset rule base.

[0099] In one of the exemplary embodiments, the determination module 404 is specifically used to generate a first fuzzy rule set according to the fuzzy rule that the data sensitivity interval information in the fuzzy rule contains the data sensitivity information; generate a second fuzzy rule set according to the fuzzy rule that the current threat level interval information in the fuzzy rule contains the current threat level information; generate a third fuzzy rule set according to the fuzzy rule that the system resource usage interval information in the fuzzy rule contains the system resource usage information; determine the target fuzzy rule according to the intersection of the first fuzzy rule set, the second fuzzy rule set and the third fuzzy rule set.

[0100] In one of the exemplary embodiments, the device also includes a transmission module, which is specifically used to obtain encrypted data corresponding to the data to be encrypted; obtain a storage location and / or a transmission location corresponding to the encrypted data; store the encrypted data in the storage location, and / or send the encrypted data to the transmission location.

[0101] Each module in the above data encryption device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0102] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 5 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data such as data sensitivity information, current threat level information, system resource usage information and a preset rule base. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a data encryption method is implemented.

[0103] Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0104] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0105] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0106] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0107] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0108] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0109] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0110] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A data encryption method, characterized in that: The method comprises: Acquiring data sensitivity information and current threat level information of the data to be encrypted, as well as system resource usage information of a data encryption system; the data encryption system is used to encrypt the data; Determining encryption policy information for the data to be encrypted in a preset rule base according to the data sensitivity information, the current threat level information and the system resource usage information; the encryption policy information represents the encryption algorithm, encryption key and encryption strength for the data to be encrypted; The data to be encrypted is encrypted by the data encryption system according to the encryption policy information.

2. The method according to claim 1, characterized in that: The preset rule base includes fuzzy rules, and the fuzzy rules represent the corresponding relationship between data sensitivity, current threat level, system resource usage, and encryption policy. The encryption policy information for the data to be encrypted is determined in the preset rule base according to the data sensitivity information, the current threat level information, and the system resource usage information, including: According to the data sensitivity information, the current threat level information and the system resource usage information, a target fuzzy rule is screened out from the fuzzy rules in the preset rule base; the data sensitivity, current threat level and system resource usage corresponding to the target fuzzy rule match the data sensitivity information, the current threat level information and the system resource usage information; Determine that the encryption policy corresponding to the target fuzzy rule is encryption policy information for the data to be encrypted.

3. The method according to claim 2, characterized in that The step of selecting a target fuzzy rule from the fuzzy rules in the preset rule base according to the data sensitivity information, the current threat level information and the system resource usage information includes: Comparing the data sensitivity, current threat level and system resource usage corresponding to the fuzzy rules in the preset rule base with the data sensitivity information, the current threat level information and the system resource usage information one by one; The fuzzy rules in the preset rule base whose data sensitivity is consistent with the data sensitivity information, whose current threat level is consistent with the current threat level information, and whose system resource usage is consistent with the system resource usage information are taken as target fuzzy rules.

4. The method according to claim 2, characterized in that: The step of selecting a target fuzzy rule from the fuzzy rules in the preset rule base according to the data sensitivity information, the current threat level information and the system resource usage information includes: Determining data sensitivity interval information of the fuzzy rules according to data sensitivity corresponding to the fuzzy rules in the preset rule base, determining current threat level interval information of the fuzzy rules according to current threat levels corresponding to the fuzzy rules in the preset rule base, and determining system resource usage interval information of the fuzzy rules according to system resource usage corresponding to the fuzzy rules in the preset rule base; The data sensitivity information is compared with the data sensitivity interval information of the fuzzy rule, the current threat level information is compared with the previous threat level interval information of the fuzzy rule, and the system resource usage information is compared with the system resource usage interval information of the fuzzy rule, and the target fuzzy rule is selected from the fuzzy rules in the preset rule base.

5. The method according to claim 4, characterized in that The step of comparing the data sensitivity information with the data sensitivity interval information of the fuzzy rule, the current threat level information with the previous threat level interval information of the fuzzy rule, and the system resource usage information with the system resource usage interval information of the fuzzy rule one by one, and selecting a target fuzzy rule from the fuzzy rules in the preset rule base includes: Generate a first fuzzy rule set according to the fuzzy rule that the data sensitivity interval information in the fuzzy rules includes the data sensitivity information; generating a second fuzzy rule set according to the fuzzy rule that the current threat level interval information in the fuzzy rules includes the current threat level information; generating a third fuzzy rule set according to the fuzzy rule that the system resource usage interval information in the fuzzy rules includes the system resource usage information; The target fuzzy rule is determined according to an intersection among the first fuzzy rule set, the second fuzzy rule set and the third fuzzy rule set.

6. The method according to claim 1, characterized in that After the step of encrypting the data to be encrypted according to the encryption policy information by the data encryption system, the method further includes: Obtaining encrypted data corresponding to the data to be encrypted; Obtaining a storage location and / or a transmission location corresponding to the encrypted data; The encrypted data is stored in the storage location, and / or the encrypted data is sent to the transmission location.

7. A data encryption device, characterized in that: The device comprises: An acquisition module, used to acquire data sensitivity information and current threat level information of the data to be encrypted, and system resource usage information of a data encryption system; the data encryption system is used to encrypt the data; A determination module, configured to determine encryption policy information for the data to be encrypted in a preset rule base according to the data sensitivity information, the current threat level information, and the system resource usage information; the encryption policy information represents an encryption algorithm, an encryption key, and an encryption strength for the data to be encrypted; An encryption module is used to encrypt the data to be encrypted according to the encryption policy information through the data encryption system.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images