Encryption and decryption method and device for terminal data and related equipment

Abstract

The invention provides a terminal data encryption and decryption method and device and related equipment, and relates to the technical field of computers, in particular to the technical fields of Internet of Vehicles, information security, intelligent transportation, big data and the like. The specific implementation scheme is as follows: performing segmented encryption on to-be-encrypted data of a terminal by adopting an encryption thread of the terminal; in the segmented encryption process of the to-be-encrypted data, controlling an encryption thread to alternately execute dormancy and segmented encryption operation based on a first dormancy strategy so as to release a memory space occupied by the encryption thread through dormancy; wherein the segmented ciphertext of the to-be-encrypted data is stored in the target file.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to technical fields such as Internet of Vehicles, information security, intelligent transportation, and big data. Background Art

[0002] The interaction between the terminal and the cloud is a core component of Internet of Vehicles technology, involving multiple aspects such as data collection, transmission, processing and application.

[0003] The technological progress of terminals and the cloud has jointly promoted the development of the Internet of Vehicles, realizing efficient communication and intelligent control between vehicles and the outside world, and improving road safety and traffic efficiency. With the continuous advancement of technology, the application scenarios and business models of the Internet of Vehicles are also constantly expanding and deepening.

[0004] Therefore, protecting data security and privacy between terminals and the cloud is crucial. Summary of the invention

[0005] The present invention provides a method and apparatus for encrypting and decrypting terminal data, and related equipment.

[0006] According to one aspect of the present disclosure, a method for encrypting terminal data is provided, comprising:

[0007] The encryption thread of the terminal is used to encrypt the data to be encrypted in the terminal in sections;

[0008] In the process of segmented encryption of the data to be encrypted, the encryption thread is controlled to alternately perform sleep and segmented encryption operations based on the first sleep strategy, so as to release the memory space occupied by the encryption thread through sleep;

[0009] The segmented ciphertext of the data to be encrypted is stored in the target file.

[0010] According to another aspect of the present disclosure, there is provided a device for encrypting terminal data, comprising:

[0011] The encryption module is used to encrypt the data to be encrypted of the terminal in sections by using the encryption thread of the terminal;

[0012] A control module, used for controlling the encryption thread to alternately perform sleep and segment encryption operations based on a first sleep strategy during the process of segmented encryption of the encrypted data, so as to release the memory space occupied by the encryption thread through sleep;

[0013] The segmented ciphertext of the data to be encrypted is stored in the target file.

[0014] According to another aspect of the present disclosure, there is provided a terminal data decryption device, comprising:

[0015] A receiving module is used to receive data to be decrypted from a terminal; the data to be decrypted is data in a target file obtained by encrypting the data to be encrypted by the terminal;

[0016] The decryption module is used to perform segmented decryption on the data to be decrypted based on the second sleep strategy; the segmented plaintext obtained by segmented decryption of the data to be decrypted is stored in the output file.

[0017] According to another aspect of the present disclosure, there is provided an electronic device, comprising:

[0018] at least one processor; and

[0019] a memory communicatively connected to the at least one processor; wherein,

[0020] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute any method in the embodiments of the present disclosure.

[0021] According to another aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute any method according to the embodiments of the present disclosure.

[0022] According to another aspect of the present disclosure, a computer program product is provided, including a computer program, which implements any method according to the embodiments of the present disclosure when executed by a processor.

[0023] In the embodiment of the present disclosure, considering that the processing time of large files can be appropriately delayed, segmented encryption is adopted for the data to be encrypted of the terminal, and a sleep strategy is used to control the encryption thread to alternately perform sleep and segmented encryption operations. Based on this, during the entire encryption cycle, the occupation of terminal resources can be alleviated by sleeping the encryption thread to make better use of the limited resources of the terminal. In addition, by encrypting in segments and saving the segmented ciphertext in the target file instead of saving it in the memory, the memory space occupied by the encryption thread can be released as much as possible, while supporting the gradual completion of the encryption operation of the data to be encrypted. The encryption method of terminal data provided by the embodiment of the present disclosure can be completed sequentially, especially for the encryption of large files, and will not occupy too many terminal resources.

[0024] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present disclosure.

[0026] Figure 1 is an architectural diagram of a method for encrypting terminal data according to an embodiment of the present disclosure;

[0027] Figure 2 is a flowchart of a method for encrypting terminal data according to an embodiment of the present disclosure;

[0028] Figure 3 is another flowchart of a method for encrypting terminal data according to an embodiment of the present disclosure;

[0029] Figure 4 is another flowchart of a method for encrypting terminal data according to an embodiment of the present disclosure;

[0030] Figure 5 is a schematic diagram of the overall process of a method for encrypting terminal data according to an embodiment of the present disclosure;

[0031] Figure 6 is a flowchart of a method for decrypting terminal data according to an embodiment of the present disclosure;

[0032] Figure 7 is a schematic diagram of the overall process of a method for decrypting terminal data according to an embodiment of the present disclosure;

[0033] Figure 8 is an overall framework diagram of a method for encrypting and decrypting terminal data according to an embodiment of the present disclosure;

[0034] Fig. 9 is a schematic diagram of the structure of a terminal data encryption device according to an embodiment of the present disclosure;

[0035] Fig.10 is a schematic diagram of the structure of a terminal data decryption device according to an embodiment of the present disclosure;

[0036] Fig.11 The block diagram is a block diagram of an electronic device used to implement the terminal data encryption method / terminal data decryption method of the embodiment of the present disclosure. DETAILED DESCRIPTION

[0037] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope of the present disclosure. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0038] In the disclosed embodiment, the encrypted data transmission between the terminal and the cloud is mainly limited by the resources of the terminal. Taking the vehicle as an example, the main task of the vehicle is to complete the driving task, and it cannot provide too many resources to complete data encryption. Regarding the problem of secure data transmission between the terminal and the cloud, a terminal data encryption method is proposed based on multiple considerations such as terminal resource usage, encryption and decryption of large files, and processing time. Taking vehicle-to-cloud encrypted data transmission as an example, this method can be applied to Figure 1 The architecture shown includes a vehicle 101 and a cloud 102. The vehicle 101 can be an autonomous vehicle or a non-autonomous vehicle. The vehicle 101 encrypts the terminal data through the terminal data encryption method provided in the embodiment of the present disclosure and transmits it to the cloud 102. The cloud 102 receives the encrypted data of the vehicle 101 and performs a decryption operation according to the terminal data decryption method provided in the embodiment of the present disclosure.

[0039] The cloud 102 may be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), as well as big data and artificial intelligence platforms.

[0040] It should be noted that the method provided in the embodiments of the present disclosure is not limited to the vehicle side, but is applicable to products such as various end-to-cloud data security transmission, large file transmission, data encryption and decryption, etc.

[0041] When a large file, i.e. a file with a large amount of data, needs to be encrypted and transmitted, the encryption time is long, resulting in the terminal being unable to complete the encryption transmission of the large file. Taking the vehicle side as an example, because the computing resources of the vehicle side are limited, and in the automatic driving scene or semi-automatic driving scene, they must be provided to the driving system first to ensure driving safety. In view of this, in the embodiment of the present disclosure, a method for encrypting terminal data is provided, such as Figure 2 As shown, it can be implemented as:

[0042] S201, using the encryption thread of the terminal to encrypt the data to be encrypted of the terminal in sections.

[0043] Among them, segment encryption means that after the encrypted data is segmented, each segment of the encrypted data is encrypted, and each segment is encrypted using a compliant encryption method to ensure the information security of the terminal data.

[0044] The size of each segment of the data to be encrypted can be determined based on actual conditions, and the embodiments of the present disclosure do not limit this.

[0045] S202, in the process of segmented encryption of the data to be encrypted, based on the first sleep strategy, the encryption thread is controlled to alternately perform sleep and segmented encryption operations, so as to release the memory space occupied by the encryption thread through sleep; wherein the segmented ciphertext of the data to be encrypted is stored in the target file.

[0046] Since the terminal resources are limited and cannot bear the CPU (Central Processing Unit) and the high memory usage, in the embodiment of the present disclosure, considering that the processing time of large files can be appropriately delayed, the terminal's data to be encrypted is encrypted in segments, and the sleep strategy is used to control the encryption thread to alternately perform sleep and segment encryption operations. Based on this, during the entire encryption cycle, the occupation of terminal resources can be alleviated by sleeping the encryption thread to make better use of the terminal's limited resources. In addition, by encrypting in segments and saving the segmented ciphertext in the target file instead of saving it in the memory, the memory space occupied by the encryption thread can be released as much as possible, while supporting the gradual completion of the encryption operation of the data to be encrypted. The encryption method of terminal data provided by the embodiment of the present disclosure can be completed sequentially, especially for the encryption of large files, and will not occupy too many terminal resources.

[0047] In some embodiments, in order to better adapt to terminal encryption, the encryption thread is controlled to alternately perform sleep and segment encryption operations based on the first sleep strategy, which can be specifically implemented as follows: Figure 3 As shown:

[0048] S301, when a preset condition is met, analyzing a control method of an encryption thread based on a first sleep strategy.

[0049] In some embodiments, the first sleep strategy is determined based on a preset duration, and the preset duration is determined based on a resource occupancy requirement of the terminal;

[0050] The preset duration is used to control the CPU resource occupancy rate of the terminal to meet the resource occupancy rate requirement. The preset duration is the upper limit of the sum of the encryption duration required for a single segment of the data to be encrypted and the sleep duration.

[0051] The preset duration can be dynamically adjusted based on actual conditions. For example, for the same preset duration, the larger the amount of data in a single segment of the data to be encrypted, the greater the CPU resource usage of the terminal. Similarly, for segments of the same size, the larger the preset duration, the smaller the CPU resource usage of the terminal.

[0052] It should be noted that, for the vehicle side, since the vehicle's CPU resources are also used for daily driving, etc., the resource occupancy rate requirements, preset duration, and data volume of a single segment can be set based on the actual situation of the vehicle. The resource occupancy rate requirements and preset duration can be flexibly evaluated and determined based on the situation of different vehicles.

[0053] In the disclosed embodiment, the preset duration is determined in combination with the occupancy of the terminal CPU, and the speed of file encryption can be flexibly adjusted according to the terminal resource situation to reasonably utilize the limited resources of the terminal to complete file encryption and terminal core tasks.

[0054] In some embodiments, the method for determining the preset duration is as follows: Figure 4 As shown, including:

[0055] S401, generating a virtual file to be encrypted in response to a segment size set for a target object.

[0056] The virtual file to be encrypted is used to simulate the encryption process of a large file so as to evaluate the appropriate preset duration. The data to be encrypted is segmented based on the segment size, which means that the target object is supported to flexibly set the data volume of a single segment.

[0057] S402, encrypting the virtual file to be encrypted in sections to determine the average duration and resource occupancy rate of the section encryption.

[0058] During implementation, the virtual file to be encrypted may be divided into multiple segments based on the segment size, and the encryption duration of each segment may be calculated. The encryption duration of each segment may be averaged to obtain the average encryption duration of the segments.

[0059] S403: recommend the average duration and resource occupancy rate to the target object to obtain a preset duration set by the target object to meet the resource occupancy rate requirement.

[0060] The target object can set a preset duration that is longer than the average duration to ensure that the encryption thread can be properly dormant during the subsequent encryption of terminal data. Of course, the target object can also set a preset duration that is not longer than the average duration to increase the encryption speed.

[0061] In the disclosed embodiment, based on the actual resource occupancy rate requirements, the entire encryption process is simulated to assist in determining the appropriate preset duration. Based on this method, key information such as resource occupancy rate and encryption duration of a single segment can be recommended to the target object, so as to guide the target object to reasonably plan the preset duration, so that the encryption process can balance the encryption of large files and the limited terminal resources according to the needs.

[0062] In some embodiments, the user may be supported to set the total time limit of the unit amount of data and the resource occupancy rate requirement. The terminal may encrypt the virtual file to be encrypted in a grid search-based manner to determine a reasonable segment size and preset time for the user to select, provided that the total time limit and resource occupancy rate requirement are met.

[0063] For example, the minimum block size block1 and the maximum block size block2 of the unit amount of data can be determined, and the value range of the block [block1, block2] is obtained. The value range is sampled to obtain multiple block sizes.

[0064] Perform the following steps at each block size: Encrypt the virtual file to be encrypted in segments based on the block size to obtain statistics on the actual resource occupancy rate and the total encryption duration. From multiple block sizes, select the block size whose actual resource occupancy rate meets the resource occupancy rate requirements and whose total encryption duration is less than or equal to the upper limit of the total duration, as well as the average encryption duration for each block size, and then recommend them to the user. By recommending this information, the user can be guided to select a suitable block size as the aforementioned segment size, and set a reasonable preset duration based on its average duration. Generally, the preset duration is greater than the encryption duration of a single segment.

[0065] In some embodiments, when the preset conditions are met, the control mode of the encryption thread is analyzed based on the first sleep strategy, and the following operations can be performed for each encryption segment of the data to be encrypted until the encryption of the data to be encrypted is completed:

[0066] Step A1, when writing the segment ciphertext of the to-be-encrypted segment of the to-be-encrypted data into the target file, determine the encryption time length occupied by the to-be-encrypted segment.

[0067] The preset condition is that the encryption of each segment to be encrypted is completed. It can be understood that after the segment ciphertext of the segment to be encrypted is written into the target file, it can be determined that the preset condition is met.

[0068] Among them, the encryption duration is the duration taken for encrypting the current segment to be encrypted.

[0069] Step A2, comparing the encrypted duration with the preset duration.

[0070] Step A3, when the encryption duration is less than the preset duration, determine the control mode of the encryption thread to enter the dormant state after the encryption of the current segment to be encrypted is completed.

[0071] Exemplarily, the encryption duration of the i-th segment of data to be encrypted is a, and the preset duration is b, and both a and b are not less than 0. When b is greater than a, the control mode of the encryption thread is determined to enter a dormant state after completing the encryption of the i-th segment of data to be encrypted. After the dormancy ends, the encryption thread is controlled to continue to encrypt the (i+1)-th segment of data to be encrypted, and so on, until all the data to be encrypted are encrypted, where i is a positive integer not less than 0.

[0072] In the disclosed embodiment, the encryption duration is compared with the preset duration to determine whether the encryption thread needs to be dormant, so as to ensure that in the case of dormancy, the encryption thread can reduce the occupation of terminal resources and can gradually complete the terminal data encryption.

[0073] In some embodiments, when the comparison result in step A2 is that the encryption duration of the segment to be encrypted is not less than the preset duration, the control method of the encryption thread is determined to continue the encryption operation on the next segment to be encrypted of the segment to be encrypted.

[0074] During implementation, when the encryption duration is c and the preset duration is b, b and c are not less than 0. When c is greater than b, the encryption duration has exceeded the preset duration, that is, the encryption operation of the next segment of data to be encrypted is directly performed.

[0075] If the target object wants to complete encryption first, a relatively short preset duration can be set. Based on the solution provided by the embodiment of the present disclosure, encryption can be completed in a non-sleep or less sleep state. Therefore, during implementation, the preset duration can be set according to actual needs, and the embodiment of the present disclosure does not limit this.

[0076] In the disclosed embodiment, when the encryption duration is not less than the preset duration, sleep is not performed, and the sleep status is reconsidered in the next segment to be encrypted to take into account the overall encryption duration requirement.

[0077] Of course, as explained above, in order to sleep as long as possible during implementation, the preset duration is usually set to be greater than the encryption duration of a single segment, and whether to sleep and how long to sleep can be flexibly set.

[0078] S302: When it is determined based on the first sleep strategy that the control mode of the encryption thread is to enter a sleep state, determine the sleep duration of the encryption thread.

[0079] In some embodiments, the sleep duration of the encryption thread may be determined to be a fixed duration.

[0080] In order to better consider the total processing time occupied by the data to be encrypted, determining the sleep time of the encryption thread in the embodiment of the present disclosure can be implemented as follows: determining the difference between the encryption time and the preset time to obtain the sleep time.

[0081] During implementation, the encryption duration is a, the preset duration is b, and b is greater than a. In this case, (ba) is the sleep duration.

[0082] In the disclosed embodiment, based on the sleep time determined in this way, the segmented encryption process can be properly dormant, and the sleep time in the entire encryption cycle is dynamically adjusted, which can appropriately shorten the total time of the entire encryption cycle and improve encryption efficiency.

[0083] S303, controlling the encryption thread to sleep for a certain sleep time to release the memory space occupied by the encryption thread.

[0084] S304: After the sleep time ends, the encryption thread is controlled to continue encrypting the data to be encrypted in segments.

[0085] In the disclosed embodiment, the encryption thread is controlled to alternately perform sleep and segment encryption operations based on the first sleep strategy, so as to flexibly determine whether to sleep according to the execution status of each segment to be encrypted, so as to ensure the system performance of the terminal during the encryption process.

[0086] In some embodiments, the above description describes the alternation of the encryption process and the sleep process, and the encryption process is described below. In order to occupy as few terminal resources as possible, the segmented ciphertext of each segment in the embodiment of the present disclosure is stored in the target file. During implementation, after the target file is created, in order to facilitate cloud decryption, the target file not only stores the segmented ciphertext, but also stores the key ciphertext in the file header of the target file; the key ciphertext includes the ciphertext of the key and random value (Initialization Vector, IV) used for segment encryption to meet compliance requirements.

[0087] Among them, each segment to be encrypted is encrypted with the key and random value in the file header. When implemented, SM4-CBC (Cipher Block Chaining) encryption can be used for encryption. In order to ensure information security, the key and random value need to be encrypted and transmitted to the cloud. Therefore, the ciphertext of the key and random value is stored in the file header. The key and random value can be obtained by using the public key through SM2 encryption.

[0088] During implementation, taking the vehicle side as an example, the public key can be obtained from the vehicle certificate, and then the public key is used to encrypt the key and random value required for segment encryption using the SM2 encryption method, and written into the file header.

[0089] The key required to encrypt the data to be encrypted can be randomly generated, and a random value can be generated. Its length can be 16 bytes. Of course, a 24-byte or 32-byte random key and random value can also be generated, which can be determined based on actual conditions, and the embodiments of the present disclosure do not limit this.

[0090] In the disclosed embodiment, the key ciphertext is stored at the header position of the target file so that the cloud can quickly decrypt it.

[0091] In some embodiments, in order to ensure that the cloud decrypts the complete data, the target file also needs to store the summary ciphertext for the cloud to verify. The method of obtaining the summary ciphertext of the data to be encrypted can be specifically implemented as follows:

[0092] Step C1, in the process of segmentally encrypting the data to be encrypted, the intermediate digest of each segment is calculated to obtain the digest ciphertext of the data to be encrypted.

[0093] For example, the data to be encrypted is divided into multiple segments, and the SM3 encryption method is used to process the original data of the first segment to obtain the intermediate summary of the first segment; based on the intermediate summary of the first segment, the intermediate summary of the original data of the second segment of the data to be encrypted is calculated. Similarly, when calculating the intermediate summary of the jth segment, the intermediate summary of the j-1th segment is used to encrypt the original data of the jth segment based on the SM3 encryption method until all segment calculations are completed to obtain the final summary ciphertext, where j is a positive integer not less than 1.

[0094] Step C2, writing the summary ciphertext into a reserved position of the target file; the reserved position is set between the file header of the target file and the segment ciphertext of the first segment of the data to be encrypted.

[0095] In the disclosed embodiment, the summary ciphertext is stored in a reserved location, and the storage method of the summary ciphertext is defined in a structured description manner, so that the summary ciphertext can be obtained in the cloud to complete the decryption process.

[0096] The segmented ciphertext of the first segment of the data to be encrypted is the segmented ciphertext corresponding to the first segment to be encrypted in the data to be encrypted.

[0097] During implementation, after the key ciphertext is written into the header of the target file, m bytes may be reserved, where m is a positive integer and the value of m may be 32 bytes. The segmented ciphertext of each segment is sequentially written into the target file starting from the reserved position until the encryption is completed.

[0098] Exemplarily, the structure of the target file finally generated is:

[0099] Key ciphertext - summary ciphertext - segmented ciphertexts of each segment of the data to be encrypted written in sequence;

[0100] In some embodiments, the segmented ciphertext of each segment of the data to be encrypted is obtained, which can be specifically implemented as follows: the data to be encrypted is segmented to obtain multiple segments to be encrypted; each segment to be encrypted is encrypted using the SM4_CBC encryption method to obtain the segmented ciphertext of each segment to be encrypted.

[0101] Use SM4_CBC to encrypt and obtain the segmented ciphertext of each segment to be encrypted. Specifically, it can be implemented as follows: perform XOR (exclusive OR) operation on the first segment to be encrypted and the IV obtained above to obtain a plaintext block, and then use the key to perform SM4_CBC encryption on the plaintext block to obtain the segmented ciphertext of the first segment to be encrypted. For each subsequent segment to be encrypted, first perform an XOR operation with the previous segmented ciphertext to obtain the plaintext block of the current segment to be encrypted, and then use the key to perform SM4_CBC encryption on the plaintext block. And so on, the encryption is completed.

[0102] It should be noted that the segmented ciphertexts may be generated first and then the summary ciphertexts may be generated; the summary ciphertexts may be generated first and then the segmented ciphertexts may be regenerated; or two threads may be used to simultaneously perform the segmented encryption and summary ciphertext generation operations, which is not limited in the embodiments of the present disclosure.

[0103] In some embodiments, in order to achieve the fastest possible transmission of ciphertext, data transmission can also be performed in the form of a data stream: when the data to be encrypted is a data stream, the summary ciphertext of the data to be encrypted is written to the end of the target file, so that the target file can be sent to the cloud in a streaming manner.

[0104] During implementation, since the purpose of the summary ciphertext is to ensure the integrity of the data to be encrypted, the acquisition of the summary ciphertext and the acquisition of the segmented ciphertext are performed asynchronously. After the segmented ciphertext of each segment of the data to be encrypted is generated, it is sent to the cloud in the form of a data stream. After the complete summary ciphertext is generated, the summary ciphertext is sent to the cloud.

[0105] In the disclosed embodiment, fast transmission is achieved by using data streams, so that the encryption process and the decryption process can be executed simultaneously, thereby improving the efficiency of data encryption and decryption at both ends of the cloud.

[0106] For ease of understanding, taking the vehicle side as an example, the overall flow chart of data encryption for the vehicle side is as follows: Figure 5 As shown, including:

[0107] S501, segmenting the data to be encrypted based on the segment size to obtain at least one segment to be encrypted.

[0108] S502, based on the first sleep strategy determined by the preset duration and the segment size, the data to be encrypted is segmented and encrypted, and the specific execution steps are as follows S5031-S5033:

[0109] S5021, generate the key and random value required for SM4-CBC encryption.

[0110] S5022, obtain the public key from the vehicle certificate, and encrypt the key and random value generated in S5031 using the SM2 encryption method based on the public key to obtain the key ciphertext.

[0111] S5023, write the key ciphertext into the file header of the target file, and reserve a reserved position of m bits.

[0112] S5024, for the segment k to be encrypted, use the SM4_CBC encryption method, use the key and random value generated in S5021 to encrypt the segment k to be encrypted, obtain the segment ciphertext of the segment k to be encrypted, and write the segment ciphertext into the target file in sequence after the reserved position, where k is a positive integer greater than 0.

[0113] S5025, determine whether the encryption time occupied by the segment k to be encrypted is greater than the preset time, if so, execute S5026, if not, execute 5027.

[0114] S5026, the encryption thread goes into sleep mode, and then executes S5027.

[0115] S5027, take the next segment to be encrypted of the segment to be encrypted k as the segment to be encrypted k, and return to execute S5024.

[0116] S5028, in the process of segmentally encrypting the data to be encrypted, the intermediate digest of the original data of each segment to be encrypted is calculated in sequence to obtain the digest ciphertext of the data to be encrypted, and the digest ciphertext is written into the reserved position in the target file.

[0117] The specific method of obtaining the digest ciphertext has been described above, and the present embodiment will not be repeated here.

[0118] There is no restriction on the execution time of encryption and calculation of summary ciphertext.

[0119] S503, after the encryption of the encrypted data is completed, the target file is sent to the cloud.

[0120] Based on the same technical concept, the present disclosure also proposes a terminal data decryption method, which is applied to the cloud. Figure 6 As shown, including:

[0121] S601, receiving data to be decrypted from a terminal; the data to be decrypted is data in a target file obtained by encrypting the data to be encrypted by the terminal.

[0122] S602, decrypt the data to be decrypted segment by segment based on the second sleep strategy; and save the segmented plaintexts of the data to be decrypted obtained by segment decryption in an output file.

[0123] The second sleep strategy may be consistent with or different from the first sleep strategy, which is not limited in the embodiment of the present disclosure.

[0124] Among them, the block size of each segment to be decrypted obtained by segmenting the data to be decrypted in the cloud and the block size of each segment to be encrypted in the terminal can be the same or different, which can be determined based on the resource situation of the cloud, and the embodiments of the present disclosure do not limit this.

[0125] In the disclosed embodiment, the target file sent by the receiving terminal is decrypted in segments on the data to be encrypted to obtain the final plaintext data, so that the cloud can reasonably perform the decryption operation according to its own resource conditions to obtain the plaintext.

[0126] In the embodiment of the present disclosure, when cloud resources are sufficient, the second sleep strategy requires that the data to be decrypted be decrypted in segments in a non-sleep manner.

[0127] During implementation, when there are sufficient cloud resources, it can be determined that the decryption process can be realized without the need for the decryption thread to sleep.

[0128] In the embodiment of the present disclosure, when the cloud resources are sufficient, the decryption efficiency can be improved by not sleeping.

[0129] In some embodiments, when cloud resources are scarce, the second sleep strategy requires that during the process of segmented decryption of the data to be decrypted, the decryption thread is controlled to alternately perform sleep and decryption operations.

[0130] In the disclosed embodiment, considering the shortage of cloud resources, the decryption thread is subjected to alternate sleep and decryption operations to alleviate the pressure on cloud resources.

[0131] In some embodiments, controlling the decryption thread to alternately perform sleep and decryption operations may be implemented by performing the following operations on each to-be-decrypted segment of the to-be-decrypted data:

[0132] Step E1, when writing the plain text of the to-be-decrypted segment of the to-be-decrypted data into the output file, determining the decryption time length occupied by the to-be-decrypted segment.

[0133] The data block size preset in the second sleep strategy is the block size of the segment to be decrypted.

[0134] The decryption duration is the duration taken to decrypt a single segment to be decrypted.

[0135] Step E2, comparing the decryption duration and the reference duration in the second sleep strategy.

[0136] Step E3: When the decryption time is less than the reference time, it is determined that the decryption thread enters a dormant state after the decryption of the segment to be decrypted is completed.

[0137] Similar to the aforementioned execution of the encryption thread alternating between sleep and segmented decryption operations, when the decryption time is less than the reference time, the decryption thread is determined to enter the sleep state after the current segment to be decrypted is decrypted, and sleep until the reference time, and continue to decrypt the next segment to be decrypted, and execute in sequence until the decryption is completed.

[0138] Exemplarily, the decryption time of the qth segment to be decrypted is p, the reference time is n, and p and n are not less than 0. If p is less than n, the control method of the decryption thread is determined to enter a dormant state after completing the decryption of the qth segment to be decrypted. After the dormancy ends, the decryption thread is controlled to continue to decrypt the (q+1)th segment to be decrypted, and so on, until all the data to be decrypted are decrypted, where q is a positive integer greater than 0.

[0139] In the embodiment of the present disclosure, when the decryption duration is less than the reference duration, cloud hibernation is achieved based on the reference duration, so that cloud resources can be reasonably utilized.

[0140] In some embodiments, the sleep time length of the decryption thread may be determined to be a fixed time length.

[0141] In order to better consider the total processing time of decryption, the sleep time of the decryption thread in the embodiment of the present disclosure may be determined as follows: the sleep time of the decryption thread is the difference between the decryption time and the reference time.

[0142] The specific process of calculating the sleep time is similar to the process of calculating the sleep time by the aforementioned encryption thread, and the embodiments of the present disclosure will not be described in detail.

[0143] In the disclosed embodiment, the sleep duration is determined based on the difference between the decryption duration and the reference duration, so that the cloud can dynamically sleep after the decryption of a segment to be encrypted is completed, taking into account the decryption speed.

[0144] In some embodiments, when the decryption duration is not less than the reference duration, it is determined that the decryption thread continues to perform a decryption operation on the next to-be-decrypted segment of the to-be-decrypted segment without sleeping.

[0145] When the decryption time is not less than the reference time, the decryption operation continues to be performed, so as to reasonably control the total time taken by the decryption process.

[0146] In the disclosed embodiment, when the decryption time is not less than the reference time, the decryption operation is continued, so that the total time occupied by the decryption process can be reasonably controlled.

[0147] In some embodiments, decrypting the data to be decrypted in sections includes:

[0148] Step F1, obtaining key ciphertext from the file header of the target file.

[0149] Step F2, using the soft password to decrypt the key ciphertext to obtain the key and random value used for segment encryption; the soft password is generated based on the dispersion technology and white box encryption technology.

[0150] Among them, the private key can be hosted in the soft password SDK (Software Development Kit). Specifically, the private key is processed using decentralized technology and then decentralized stored using white box encryption. It is stored in the SDK and the private key is obtained only during decryption to prevent the private key from appearing in the memory in plain text, causing information leakage.

[0151] Among them, the decentralized technology is a technology that divides the key into multiple parts and stores them in a decentralized manner to improve the security of the key. This technology can increase the difficulty for attackers to obtain the complete key. Even if a part is leaked, the attacker cannot obtain the complete key and cannot decrypt sensitive data. Therefore, it greatly improves the security of key storage in the cloud.

[0152] Step F3, decrypt the data to be decrypted segment by segment based on the key and the random value to obtain the plaintext of the data to be decrypted.

[0153] During implementation, first decrypt the key ciphertext based on the private key to obtain the key and random value used for segment encryption. Then, use the SM4-CBC decryption algorithm to decrypt the first segment to be decrypted based on the key to obtain the intermediate data of the first segment to be decrypted. Perform an XOR operation on the decrypted intermediate data and IV to obtain the plaintext data of the first segment to be decrypted. For each subsequent segment to be decrypted, first use the SM4-CBC decryption algorithm and decrypt with the key to obtain the intermediate data of the current segment to be decrypted, and then perform an XOR operation with the plaintext data of the previous segment to be decrypted to obtain the plaintext data corresponding to the segment to be decrypted, and execute in sequence until the decryption is completed.

[0154] In the disclosed embodiment, a soft password is used to derive a key and a random value, and then the key and the random value are used to decrypt the data to be decrypted into plain text, so that the cloud can support segmented decryption.

[0155] In some embodiments, in order to further ensure the integrity of the information, it also includes:

[0156] Step G1, obtaining the digest ciphertext of the data to be encrypted from the reserved location of the target file.

[0157] Step G2, decrypting the summary ciphertext to obtain first summary information of the data to be encrypted.

[0158] During implementation, a decryption operation is performed on the summary ciphertext based on SM3 to obtain first summary information of the data to be encrypted.

[0159] Step G3, comparing the first summary information with the second summary information of the complete plaintext decrypted from the target file.

[0160] The plaintext information of the to-be-decrypted segment is decrypted using the SM4-CBC algorithm, and based on the plaintext information, the plaintext information obtained by the above decryption is encrypted using the SM3 ciphertext to obtain the second summary information.

[0161] Step G4: when the first summary information and the second summary information are consistent, determine that the decryption is successful.

[0162] In some embodiments, when the first digest information and the second digest information are inconsistent, it is determined that the decryption fails.

[0163] In the disclosed embodiment, summary information is used for comparison to ensure the integrity of terminal data information, and multiple ciphertexts are used to ensure the security of information.

[0164] In addition, when the terminal transmits the data to the cloud in the form of a data stream, the cloud can decrypt the target file in real time. In some embodiments, when the data to be decrypted is transmitted in a streaming manner, the data to be decrypted can be received while being decrypted in sections.

[0165] Exemplarily, the transmission order of the streaming transmission of the data to be encrypted is: first transmit the key ciphertext, then transmit the segmented ciphertext, and after the terminal generates the complete summary ciphertext, finally send the summary ciphertext to the cloud. After the key ciphertext is transmitted to the cloud, the cloud can use the soft password SDK to decrypt the key and random value required for segment encryption. Then use the key and random value in the key ciphertext to decrypt each segment to be decrypted to obtain the plaintext information of each segment to be decrypted. After decrypting all the segmented ciphertexts of the data to be encrypted, use the SM3 ciphertext to encrypt the obtained complete plaintext to obtain the second summary information. On the premise of parsing the first summary information from the summary ciphertext, compare the first summary information with the second summary information. If the first summary information and the second summary information are consistent, it is determined that the decryption is successful. If the first summary information and the second summary information are inconsistent, it is determined that the decryption failed.

[0166] For ease of understanding, taking the vehicle side as an example, the overall flow chart for decryption of vehicle side data is as follows: Figure 7 As shown, including:

[0167] S701, receiving data to be decrypted from the vehicle side; the data to be decrypted is data in a target file obtained by encrypting the data to be encrypted from the vehicle side.

[0168] S702: Obtain at least one segment to be decrypted based on the data block size set for the target object.

[0169] S703, decrypt the data to be decrypted, and the specific execution steps are as follows S7041-S7043:

[0170] S7031, obtain the key ciphertext, use the soft password to decrypt the key ciphertext to obtain the key and random value used for segment encryption.

[0171] S7032, decrypt each segment to be decrypted based on the key and the random value to obtain the complete plaintext of the data to be encrypted.

[0172] S7033, using SM3 to process the complete plaintext of the data to be encrypted to obtain second summary information;

[0173] S7034, obtaining the summary ciphertext from the reserved position of the target file, performing a decryption operation on the summary ciphertext, and obtaining first summary information of the data to be encrypted.

[0174] Among them, the execution order of S7034 and S7031-S7033 is not restricted.

[0175] S704, determining the consistency between the first summary information and the second summary information, if they are consistent, executing S705, if they are inconsistent, executing S706.

[0176] S705, decryption successful.

[0177] S706, decryption failed.

[0178] For ease of understanding, taking the car cloud as an example, the overall framework diagram of the embodiment of the present disclosure is as follows: Figure 8 As shown, based on the vehicle certificate in the SDK, the vehicle certificate is only verified. When the vehicle certificate verification passes, the public key is extracted from the vehicle certificate. The vehicle-side data of the vehicle is encrypted based on the public key to obtain a target file constructed by key ciphertext, summary ciphertext, and segmented ciphertext. The target file is sent to the cloud. The cloud obtains the private key based on the SDK to decrypt the key ciphertext in the target file. The cloud uses decentralized technology and white box encryption based on the SDK to store the private key. The cloud decrypts the target file based on the private key in the SDK to obtain plaintext. The specific decryption process has been described above, and the embodiments of the present disclosure will not be repeated here.

[0179] Based on the same technical concept, the embodiment of the present disclosure also provides a terminal data encryption device 900, such as Fig. 9 As shown, including:

[0180] The encryption module 901 is used to encrypt the data to be encrypted of the terminal in sections by using the encryption thread of the terminal;

[0181] The control module 902 is used to control the encryption thread to alternately perform sleep and segment encryption operations based on a first sleep strategy during the process of segment encryption of the encrypted data, so as to release the memory space occupied by the encryption thread through sleep;

[0182] The segmented ciphertext of the data to be encrypted is stored in the target file.

[0183] In some embodiments, the control module includes:

[0184] The analyzing unit is used to analyze the control mode of the encryption thread based on the first sleep strategy when a preset condition is met:

[0185] a determining unit, configured to determine a sleep duration of the encryption thread when the control mode of the encryption thread is determined to enter a sleep state based on the first sleep strategy;

[0186] A sleep unit, used to control the sleep duration of the encryption thread to release the memory space occupied by the encryption thread;

[0187] The encryption unit is used to control the encryption thread to continue to encrypt the encrypted data in segments after the sleep period ends.

[0188] In some embodiments, the first sleep strategy is determined based on a preset duration, and the preset duration is determined based on a resource occupancy requirement of the terminal;

[0189] The preset duration is used to control the CPU resource utilization of the terminal to meet the resource utilization requirement.

[0190] In some embodiments, a duration determination module is further included, which is used to determine the preset duration based on the following method:

[0191] In response to the segment size set by the target object, generating a virtual file to be encrypted;

[0192] Encrypt the virtual file to be encrypted in segments to determine the average encryption time and resource usage of the segments;

[0193] The average duration and resource occupancy rate are recommended to the target object to obtain a preset duration set by the target object to meet the resource occupancy rate requirement.

[0194] In some embodiments, the analysis unit is specifically configured to:

[0195] Execute the following steps for each encrypted segment of the data to be encrypted:

[0196] When writing the segment ciphertext of the to-be-encrypted segment of the to-be-encrypted data into the target file, determining the encryption time length occupied by the current to-be-encrypted segment;

[0197] Compare the encrypted duration with the preset duration;

[0198] When the encryption duration is less than the preset duration, the control method of the encryption thread is determined to enter a dormant state after the encryption of the current segment to be encrypted is completed.

[0199] In some embodiments, the determining unit is specifically configured to:

[0200] The difference between the encryption duration and the preset duration is determined to obtain the sleep duration.

[0201] In some embodiments, the control module is further configured to:

[0202] When the encryption time is not less than the preset time, the control mode of the encryption thread is determined to continue to perform the encryption operation on the next to-be-encrypted segment of the to-be-encrypted segment.

[0203] In some embodiments, a file header of the target file stores key ciphertext; the key ciphertext includes a key and a ciphertext of a random value used for segment encryption.

[0204] In some embodiments, a digest ciphertext processing module is further included, which is used to:

[0205] In the process of segmented encryption of the data to be encrypted, the intermediate summary of each segment is calculated to obtain the summary ciphertext of the data to be encrypted;

[0206] The summary ciphertext is written into a reserved position of the target file; the reserved position is set between the file header of the target file and the segment ciphertext of the first segment of the data to be encrypted.

[0207] In some embodiments, a streaming processing module is further included for:

[0208] When the data to be encrypted is a data stream, the summary ciphertext of the data to be encrypted is written to the end of the target file, so that the target file is sent to the cloud in a streaming manner.

[0209] Based on the same technical concept, a terminal data decryption device 1000 is also provided. Fig.10 As shown, including:

[0210] The receiving module 1001 is used to receive the data to be decrypted from the terminal; the data to be decrypted is the data in the target file obtained by encrypting the data to be encrypted by the terminal;

[0211] The decryption module 1002 is used to perform segmented decryption on the data to be decrypted based on the second sleep strategy; the segmented plaintexts obtained by segmented decryption of the data to be decrypted are stored in the output file.

[0212] In some embodiments, when cloud resources are sufficient, the second sleep strategy requires that the data to be decrypted be decrypted in segments in a non-sleep manner.

[0213] In some embodiments, when cloud resources are scarce, the second sleep strategy requires that during the process of segmented decryption of the data to be decrypted, the decryption thread is controlled to alternately perform sleep and decryption operations.

[0214] In some embodiments, the decryption module is specifically configured to:

[0215] The following operations are performed on each segment of the data to be decrypted:

[0216] Determining the decryption time occupied by the to-be-decrypted segments when writing the segmented plaintext of the to-be-decrypted segments of the to-be-decrypted data to the output file;

[0217] Compare the decryption duration with the reference duration in the second sleep strategy;

[0218] When the decryption duration is less than the reference duration, it is determined that the decryption thread enters a dormant state after the current segment to be decrypted is decrypted.

[0219] In some embodiments, the sleep duration of the decryption thread is the difference between the decryption duration and the reference duration.

[0220] In some embodiments, the decryption module is further configured to:

[0221] When the decryption time is not less than the reference time, it is determined that the decryption thread continues to perform a decryption operation on the next to-be-decrypted segment of the to-be-decrypted segment without sleeping.

[0222] In some embodiments, the decryption module includes:

[0223] An acquisition unit, used for obtaining key ciphertext from a file header of a target file;

[0224] The first decryption unit is used to decrypt the key ciphertext using a soft password to obtain a key and a random value used for segment encryption; the soft password is generated based on a dispersion technology and a white box encryption technology;

[0225] The second decryption unit is used to decrypt the data to be decrypted in sections based on the key and the random value to obtain the plain text of the data to be decrypted.

[0226] In some embodiments, a digest ciphertext processing module is further included, which is used to:

[0227] Obtain the digest ciphertext of the data to be encrypted from the reserved location of the target file;

[0228] Decrypting the summary ciphertext to obtain first summary information of the data to be encrypted;

[0229] Compare the first summary information with the second summary information of the complete plaintext decrypted from the target file;

[0230] When the first digest information and the second digest information are consistent, it is determined that the decryption is successful.

[0231] For the description of specific functions and examples of each module and submodule of the device in the embodiment of the present disclosure, reference can be made to the relevant description of the corresponding steps in the above method embodiment, which will not be repeated here.

[0232] In the technical solution disclosed herein, the acquisition, storage and application of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0233] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium and a computer program product.

[0234] Fig.11 A schematic block diagram of an example electronic device 1100 that can be used to implement an embodiment of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0235] like Fig.11 As shown, the device 1100 includes a computing unit 1101, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 1102 or a computer program loaded from a storage unit 1108 into a random access memory (RAM) 1103. In the RAM 1103, various programs and data required for the operation of the device 1100 can also be stored. The computing unit 1101, the ROM 1102, and the RAM 1103 are connected to each other via a bus 1104. An input / output (I / O) interface 1105 is also connected to the bus 1104.

[0236] A number of components in the device 1100 are connected to the I / O interface 1105, including: an input unit 1106, such as a keyboard, a mouse, etc.; an output unit 1107, such as various types of displays, speakers, etc.; a storage unit 1108, such as a disk, an optical disk, etc.; and a communication unit 1109, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 1109 allows the device 1100 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0237] The computing unit 1101 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 1101 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 1101 performs the various methods and processes described above, such as the encryption method of terminal data / the decryption method of terminal data. For example, in some embodiments, the encryption method of terminal data / the decryption method of terminal data may be implemented as a computer software program, which is tangibly included in a machine-readable medium, such as a storage unit 1108. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 1100 via the ROM 1102 and / or the communication unit 1109. When the computer program is loaded into the RAM 1103 and executed by the computing unit 1101, one or more steps of the encryption method of terminal data / the decryption method of terminal data described above may be performed. Alternatively, in other embodiments, the computing unit 1101 may be configured to execute the terminal data encryption method / terminal data decryption method in any other appropriate manner (for example, by means of firmware).

[0238] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0239] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0240] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0241] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0242] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0243] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0244] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0245] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the principles of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A method for encrypting terminal data, comprising: The encryption thread of the terminal is used to encrypt the data to be encrypted in the terminal in sections; In the process of segmented encryption of the data to be encrypted, the encryption thread is controlled to alternately perform sleep and segmented encryption operations based on a first sleep strategy, so as to release the memory space occupied by the encryption thread through sleep; The segmented ciphertext of the data to be encrypted is stored in the target file.

2. The method according to claim 1, wherein: The method of controlling the encryption thread to alternately perform sleep and segmented encryption operations based on the first sleep strategy includes: When the preset conditions are met, the control method of the encryption thread is analyzed based on the first sleep strategy: In a case where it is determined based on the first sleep strategy that the control mode of the encryption thread is to enter a sleep state, determining a sleep duration of the encryption thread; Controlling the encryption thread to sleep for the sleep duration to release the memory space occupied by the encryption thread; After the sleep time ends, the encryption thread is controlled to continue encrypting the data to be encrypted in segments.

3. The method according to claim 2, wherein: The first sleep strategy is determined based on a preset duration, and the preset duration is determined based on a resource occupancy requirement of the terminal; The preset duration is used to control the CPU resource occupancy rate of the terminal to meet the resource occupancy rate requirement.

4. The method according to claim 3, wherein: Determining the preset duration includes: In response to the segment size set by the target object, generating a virtual file to be encrypted; Encrypting the virtual file to be encrypted in sections to determine the average duration and resource occupancy rate of the section encryption; The average duration and the resource occupancy rate are recommended to a target object to obtain the preset duration set by the target object to meet the resource occupancy rate requirement.

5. The method according to claim 3, wherein: The step of analyzing the control mode of the encryption thread based on the first sleep strategy when the preset condition is met includes: For each encrypted segment of the data to be encrypted, execute: When writing the segmented ciphertext of the segment to be encrypted of the data to be encrypted into the target file, determining the encryption time length occupied by the current segment to be encrypted; Comparing the encryption duration with the preset duration; In the case that the encryption duration is less than the preset duration, the control mode of the encryption thread is determined to enter a dormant state after the encryption of the current segment to be encrypted is completed.

6. The method according to claim 5, wherein: The determining the sleep duration of the encryption thread includes: The difference between the encryption duration and the preset duration is determined to obtain the sleep duration.

7. The method according to claim 5, further comprising: In the case that the encryption duration is not less than the preset duration, the control mode of the encryption thread is determined to continue to perform the encryption operation on the next segment to be encrypted of the segment to be encrypted.

8. The method according to any one of claims 1 to 7, wherein: The file header of the target file stores a key ciphertext; the key ciphertext includes a key and a random value ciphertext used for segmented encryption.

9. The method according to any one of claims 1 to 8, further comprising: In the process of segmentally encrypting the data to be encrypted, an intermediate summary of each segment is calculated to obtain a summary ciphertext of the data to be encrypted; Writing the digest ciphertext into a reserved location of the target file; The reserved position is set between the file header of the target file and the segment ciphertext of the first segment of the data to be encrypted.

10. The method according to any one of claims 1 to 8, further comprising: When the data to be encrypted is a data stream, the summary ciphertext of the data to be encrypted is written into the tail of the target file, so that the target file is sent to the cloud in a streaming manner.

11. A method for decrypting terminal data, comprising: receiving the data to be decrypted from the terminal; The data to be decrypted is the data in the target file obtained by encrypting the data to be encrypted by the terminal; The data to be decrypted is decrypted in sections based on the second sleep strategy; and the sectioned plaintexts obtained by decrypting the data to be decrypted in sections are stored in an output file.

12. The method according to claim 11, wherein: In the case where cloud resources are sufficient, the second sleep strategy requires that the data to be decrypted be decrypted in sections in a non-sleep manner.

13. The method according to claim 11, wherein: In the case of limited cloud resources, the second sleep strategy requires that during the process of segmented decryption of the data to be decrypted, the decryption thread is controlled to alternately perform sleep and decryption operations.

14. The method according to claim 13, wherein: The control decryption thread alternately performs sleep and decryption operations, including: The following operations are performed on each segment of the data to be decrypted: Determining the decryption time occupied by the to-be-decrypted segments when writing the to-be-decrypted segments of the to-be-decrypted data in plain text into the output file; Comparing the decryption duration with a reference duration in the second sleep strategy; When the decryption time is shorter than the reference time, it is determined that the decryption thread enters a dormant state after the current segment to be decrypted is decrypted.

15. The method according to claim 14, wherein: The sleep duration of the decryption thread is the difference between the decryption duration and the reference duration.

16. The method according to claim 14, further comprising: When the decryption time is not less than the reference time, it is determined that the decryption thread continues to perform a decryption operation on the next segment to be decrypted of the segment to be decrypted without sleeping.

17. The method according to claim 11, wherein: The step of decrypting the data to be decrypted in sections comprises: Obtaining key ciphertext from the file header of the target file; Decrypting the key ciphertext using a soft password to obtain a key and a random value used for segment encryption; the soft password is generated based on a dispersion technology and a white box encryption technology; The data to be decrypted is decrypted segment by segment based on the key and the random value to obtain the plaintext of the data to be decrypted.

18. The method according to claim 11, further comprising: Obtaining the digest ciphertext of the data to be encrypted from the reserved location of the target file; Decrypting the summary ciphertext to obtain first summary information of the data to be encrypted; Comparing the first summary information with the second summary information of the complete plaintext decrypted from the target file; When the first digest information and the second digest information are consistent, it is determined that the decryption is successful.

19. A terminal data encryption device, comprising: The encryption module is used to encrypt the data to be encrypted by the terminal in sections by using the encryption thread of the terminal; A control module, used for controlling the encryption thread to alternately perform sleep and segment encryption operations based on a first sleep strategy during segment encryption of the data to be encrypted, so as to release the memory space occupied by the encryption thread through sleep; The segmented ciphertext of the data to be encrypted is stored in the target file.

20. The device according to claim 19, wherein The control module comprises: An analyzing unit, configured to analyze the control mode of the encryption thread based on the first sleep strategy when a preset condition is met: a determining unit, configured to determine a sleep duration of the encryption thread when it is determined based on the first sleep strategy that the control mode of the encryption thread is to enter a sleep state; A sleep unit, used to control the encryption thread to sleep for the sleep duration to release the memory space occupied by the encryption thread; The encryption unit is used to control the encryption thread to continue to encrypt the data to be encrypted in segments after the sleep time ends.

21. The device according to claim 20, wherein: The first sleep strategy is determined based on a preset duration, and the preset duration is determined based on a resource occupancy requirement of the terminal; The preset duration is used to control the CPU resource occupancy rate of the terminal to meet the resource occupancy rate requirement.

22. The device according to claim 21, wherein It also includes a duration determination module, which is used to determine the preset duration based on the following method: In response to the segment size set by the target object, generating a virtual file to be encrypted; Encrypting the virtual file to be encrypted in sections to determine the average duration and resource occupancy rate of the section encryption; The average duration and the resource occupancy rate are recommended to a target object to obtain the preset duration set by the target object to meet the resource occupancy rate requirement.

23. The device according to claim 21, wherein The analysis unit is specifically used for: For each encrypted segment of the data to be encrypted, execute: When writing the segmented ciphertext of the segment to be encrypted of the data to be encrypted into the target file, determining the encryption time length occupied by the current segment to be encrypted; Comparing the encryption duration with the preset duration; In the case that the encryption duration is less than the preset duration, the control mode of the encryption thread is determined to enter a dormant state after the encryption of the current segment to be encrypted is completed.

24. The device according to claim 23, wherein: The determining unit is specifically configured to: The difference between the encryption duration and the preset duration is determined to obtain the sleep duration.

25. The device according to claim 23, wherein the control module is further configured to: In the case that the encryption duration is not less than the preset duration, the control mode of the encryption thread is determined to continue to perform the encryption operation on the next segment to be encrypted of the segment to be encrypted.

26. The device according to any one of claims 19 to 25, wherein: The file header of the target file stores a key ciphertext; the key ciphertext includes a key and a random value ciphertext used for segmented encryption.

27. The apparatus according to any one of claims 19 to 26, further comprising a digest ciphertext processing module, configured to: In the process of segmentally encrypting the data to be encrypted, an intermediate summary of each segment is calculated to obtain a summary ciphertext of the data to be encrypted; Writing the digest ciphertext into a reserved location of the target file; The reserved position is set between the file header of the target file and the segment ciphertext of the first segment of the data to be encrypted.

28. The apparatus according to any one of claims 19 to 26, further comprising a stream processing module, configured to: When the data to be encrypted is a data stream, the summary ciphertext of the data to be encrypted is written into the tail of the target file, so that the target file is sent to the cloud in a streaming manner.

29. A terminal data decryption device, comprising: A receiving module, used for receiving data to be decrypted from a terminal; The data to be decrypted is the data in the target file obtained by encrypting the data to be encrypted by the terminal; The decryption module is used to decrypt the data to be decrypted in sections based on the second sleep strategy; the sectioned plaintexts obtained by decrypting the data to be decrypted in sections are stored in an output file.

30. The device according to claim 29, wherein In the case where cloud resources are sufficient, the second sleep strategy requires that the data to be decrypted be decrypted in sections in a non-sleep manner.

31. The device according to claim 29, wherein: In the case of limited cloud resources, the second sleep strategy requires that during the process of segmented decryption of the data to be decrypted, the decryption thread is controlled to alternately perform sleep and decryption operations.

32. The device according to claim 31, wherein The decryption module is specifically used for: The following operations are performed on each segment of the data to be decrypted: Determining the decryption time occupied by the to-be-decrypted segments when writing the to-be-decrypted segments of the to-be-decrypted data in plain text into the output file; Comparing the decryption duration with a reference duration in the second sleep strategy; When the decryption time is shorter than the reference time, it is determined that the decryption thread enters a dormant state after the current segment to be decrypted is decrypted.

33. The device according to claim 32, wherein: The sleep duration of the decryption thread is the difference between the decryption duration and the reference duration.

34. The apparatus according to claim 32, wherein the decryption module is further configured to: When the decryption time is not less than the reference time, it is determined that the decryption thread continues to perform a decryption operation on the next segment to be decrypted of the segment to be decrypted without sleeping.

35. The apparatus of claim 29, wherein: The decryption module comprises: An acquisition unit, used for obtaining key ciphertext from a file header of the target file; A first decryption unit is used to decrypt the key ciphertext using a soft password to obtain a key and a random value used for segment encryption; the soft password is generated based on a dispersion technology and a white box encryption technology; The second decryption unit is used to decrypt the data to be decrypted in sections based on the key and the random value to obtain the plaintext of the data to be decrypted.

36. The apparatus according to claim 29, further comprising a digest ciphertext processing module, configured to: Obtaining the digest ciphertext of the data to be encrypted from the reserved location of the target file; Decrypting the summary ciphertext to obtain first summary information of the data to be encrypted; Comparing the first summary information with the second summary information of the complete plaintext decrypted from the target file; When the first digest information and the second digest information are consistent, it is determined that the decryption is successful.

37. An electronic device comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 18.

38. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-18.

39. A computer program product comprising a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 18.

Images