Data encryption method and device, computer equipment and storage medium

Abstract

Embodiments of the invention relate to a data encryption method and apparatus, a computer device and a storage medium. The method comprises the steps of generating a target key for to-be-encrypted target data; after encrypting and storing the target data according to the target key, dividing the target key into a plurality of key segments; generating a corresponding key fragment ciphertext for each key fragment to obtain a plurality of key fragment ciphertexts; and respectively storing the plurality of key segment ciphertexts to first storage areas in a plurality of different nodes. Therefore, after the target data is encrypted, the target key can be divided into a plurality of key fragment ciphertexts which are respectively stored in different storage areas, the risk of single-point failure and centralized attack on the data is avoided through the fragmentation and scattered storage design of the key, and the data storage security is greatly improved.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of data encryption technology, and in particular to a data encryption method, device, computer equipment and storage medium. Background Art

[0002] With the rapid development of quantum computing technology, traditional encryption algorithms are at risk of being cracked by quantum computing. For some important data, especially data that needs to be preserved for a long time (such as medical records, financial records, etc.), secure encryption and storage mechanisms that are resistant to quantum attacks are needed to ensure that they remain safe in the future.

[0003] Existing data storage generally uses symmetric encryption or asymmetric encryption, and key management is mostly done through a centralized key management system to uniformly generate, distribute, and protect keys. Centrally stored keys and data are easy targets for attacks, and once compromised, they may lead to large-scale data leaks. Therefore, how to improve the security of data encryption has become an urgent problem to be solved. Summary of the invention

[0004] In view of this, in order to solve the above-mentioned technical problem of improving the security of data encryption, an embodiment of the present invention provides a data encryption method, apparatus, computer equipment and storage medium.

[0005] In a first aspect, an embodiment of the present invention provides a data encryption method, comprising:

[0006] Generate a target key for target data to be encrypted;

[0007] After encrypting and storing the target data according to the target key, dividing the target key into a plurality of key fragments;

[0008] Generating a corresponding key fragment ciphertext for each key fragment to obtain a plurality of key fragment ciphertexts;

[0009] The plurality of key fragment ciphertexts are stored in first storage areas in a plurality of different nodes respectively.

[0010] In a possible implementation manner, encrypting and storing the target data according to the target key includes:

[0011] Encrypting the target data according to the target key to obtain encrypted target data;

[0012] Dividing the encrypted target data into a plurality of data segments;

[0013] The plurality of data fragments are respectively stored in second storage areas in a plurality of different nodes, and each of the second storage areas is different from each of the first storage areas.

[0014] In a possible implementation manner, the generating a corresponding key fragment ciphertext for each key fragment includes:

[0015] For each of the key fragments, determining a corresponding quantum-resistant encryption algorithm;

[0016] Each of the key fragments is encrypted according to the quantum-resistant encryption algorithm to generate the key fragment ciphertext.

[0017] In a possible implementation, storing the plurality of key fragment ciphertexts in first storage areas in a plurality of different nodes respectively includes:

[0018] Acquire multiple nodes at different geographical locations corresponding to the target data;

[0019] Determine a storage area in each of the nodes as the first storage area;

[0020] storing each of the key fragment ciphertexts in different first storage areas, each of the first storage areas correspondingly storing one key fragment ciphertext;

[0021] For each of the nodes, the fragment number, encryption method, storage location and generation time of the key fragment are obtained as metadata for storage.

[0022] In a possible implementation, the method further includes:

[0023] At preset intervals, integrity checks are performed on the key fragments in each node;

[0024] When the integrity check fails, an alarm message is generated based on the metadata corresponding to the key fragment that failed the check, for alarm reminder.

[0025] In a possible implementation manner, after storing the plurality of key fragment ciphertexts in first storage areas in a plurality of different nodes respectively, the method further includes:

[0026] When the encrypted target data needs to be decrypted, a plurality of key fragment ciphertexts are obtained from a plurality of the first storage areas;

[0027] Generating a corresponding key fragment for each of the key fragment ciphertexts to obtain a plurality of key fragments;

[0028] Generate the target key from a plurality of the key fragments;

[0029] The encrypted target data is decrypted according to the target key.

[0030] In a possible implementation manner, decrypting the encrypted target data according to the target key includes:

[0031] Retrieving a plurality of data fragments from each node including a second storage area;

[0032] generating the encrypted target data according to the plurality of data fragments;

[0033] When the generated encrypted target data is complete, the encrypted target data is decrypted according to the target key.

[0034] In a second aspect, an embodiment of the present invention provides a data encryption device, comprising:

[0035] A first generating module, used to generate a target key for target data to be encrypted;

[0036] A division module, used for dividing the target key into a plurality of key fragments after encrypting and storing the target data according to the target key;

[0037] A second generating module, configured to generate a corresponding key fragment ciphertext for each key fragment, to obtain a plurality of key fragment ciphertexts;

[0038] The storage module is used to store the plurality of key fragment ciphertexts in first storage areas in a plurality of different nodes respectively.

[0039] In a third aspect, an embodiment of the present invention provides a computer device, comprising: a processor and a memory, wherein the processor is used to execute a data encryption program stored in the memory to implement the data encryption method described in any one of the first aspects above.

[0040] In a fourth aspect, an embodiment of the present invention provides a storage medium, wherein the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the data encryption method described in any one of the first aspects above.

[0041] The data encryption scheme provided by the embodiment of the present invention generates a target key for the target data to be encrypted; after encrypting and storing the target data according to the target key, the target key is divided into multiple key fragments; a corresponding key fragment ciphertext is generated for each key fragment to obtain multiple key fragment ciphertexts; and the multiple key fragment ciphertexts are respectively stored in the first storage area of ​​multiple different nodes. Thus, after encrypting the target data, the target key can be divided into multiple key fragment ciphertexts and then stored in different storage areas. The risk of single point failure and concentrated attack on data is avoided by the sharding and distributed storage design of the key, greatly improving the security of data storage. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 A schematic diagram of a data encryption method provided by an embodiment of the present invention;

[0043] Figure 2 A schematic diagram of a flow chart of another data encryption method provided by an embodiment of the present invention;

[0044] Figure 3 A schematic diagram of the structure of a data encryption device provided by an embodiment of the present invention;

[0045] Figure 4 A schematic diagram of the structure of a computer device provided by an embodiment of the present invention;

[0046] Figure 5 A flowchart of another data encryption method provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0048] To facilitate understanding of the embodiments of the present invention, specific embodiments will be further explained below in conjunction with the accompanying drawings. The embodiments do not constitute a limitation on the embodiments of the present invention.

[0049] Figure 1 A flow chart of a data encryption method provided by an embodiment of the present invention is as follows: Figure 1 As shown, the method specifically includes:

[0050] S11. Generate a target key for target data to be encrypted.

[0051] The data encryption method provided in the embodiment of the present invention is applied to a computer device, which may include but is not limited to: a server, a node, a scheduler, etc. in a distributed system application scenario. Specifically, after encrypting the target data with a target key, the target key is divided into a plurality of key fragment ciphertexts and stored in different storage areas respectively.

[0052] In this embodiment, since traditional encryption algorithms (e.g., asymmetric encryption algorithm RSA and symmetric encryption algorithm AES) are easily cracked under quantum computing, a quantum-resistant master key (Root Key) can be generated as a target key for the target data to be encrypted in the distributed system. Specifically, a lattice-based encryption algorithm with strong quantum resistance can be used when generating the target key (e.g., N-th degree Truncated Polynomial Ring Unit, NTRU or other lattice-based encryption algorithms (such as Kyber)). These algorithms are considered to have strong resistance to quantum computing attacks, so the target key generated by the encryption algorithm can maintain the security of the encryption system.

[0053] S12: After encrypting and storing the target data according to the target key, divide the target key into multiple key fragments.

[0054] In this embodiment, after the target data to be encrypted is encrypted and stored according to the target key, in order to ensure the security of the target key in the distributed system, the target key is divided into multiple key fragments. The number of key fragments can be set according to the number of storage areas that can currently store the key fragments and user needs.

[0055] Specifically, the master key can be divided into multiple key fragments using the Shamir's Secret Sharing (SSS) scheme. Shamir's Secret Sharing is a secret splitting scheme based on polynomial interpolation. It splits a secret (such as a target key) into multiple fragments (shares) and sets a threshold so that the original secret can only be restored when a certain number (threshold) of fragments are merged. This ensures that even if a part of the fragments is lost or tampered with, the secret remains safe as long as enough fragments are restored. In other words, the original target key (master key) can only be restored when a combination of key fragments (threshold) greater than the target number is obtained. For example, if the target key is split into 5 key fragments, at least 3 key fragments are required to restore the target key.

[0056] S13: Generate a corresponding key fragment ciphertext for each key fragment to obtain a plurality of key fragment ciphertexts.

[0057] In this embodiment, in order to further enhance the security of the target key, each key fragment is additionally encrypted before being distributed, so that even if some key fragments are leaked, the attacker cannot crack the original target key. This can be achieved by encrypting each key fragment using a quantum-resistant encryption algorithm (e.g., lattice-based encryption algorithm Learning With Errors (LWE) or Ring-LWE (RLWE)).

[0058] LWE and RLWE are highly resistant to quantum computing. In the era of quantum computing, they provide stronger security than traditional public key cryptography algorithms. Shamir's Secret Sharing (SSS) can be combined with LWE or RLWE to ensure that each key fragment is quantum-safe encrypted, providing additional protection.

[0059] Specifically, each key fragment is encrypted using a quantum-resistant encryption algorithm such as LWE or RLWE to generate an encrypted key fragment ciphertext.

[0060] S14. Store the plurality of key fragment ciphertexts in first storage areas in a plurality of different nodes respectively.

[0061] In this embodiment, multiple first storage areas for storing key fragment ciphertexts are pre-set in multiple nodes of the distributed system (for example, the first storage area can be a database (MongoDB, Cassandra) or a distributed file system (IPFS), and the access rights to the first storage area can also be restricted.), and each node can be located in a different geographical location or data center.

[0062] In order to enhance the security and fault tolerance of the system, each key fragment ciphertext can be stored in multiple different nodes, each node is located in a different data center or geographical location. In this way, even if a node or data center fails or is attacked, other nodes can still ensure the security and availability of the key. Not only does it strengthen the protection against single point of failure (SPOF), but it also improves the system's disaster tolerance and data redundancy.

[0063] Specifically, each key fragment ciphertext is stored in the first storage area of ​​a different node to ensure that no single node can access the complete target key. The key fragments are distributed in different data centers or geographical locations to reduce the risk of key loss due to a data center failure (such as natural disasters, network interruptions, etc.). When the encrypted target data needs to be decrypted, multiple key fragment ciphertexts can be obtained from multiple first storage areas, and the number of obtained key fragments is greater than the threshold set in Shamir's Secret Sharing. After decrypting the multiple key fragment ciphertexts, multiple key fragments are obtained, and the multiple key fragments are combined to obtain the target key. The encrypted target data can be decrypted by the target key.

[0064] The data encryption method provided by the embodiment of the present invention generates a target key for the target data to be encrypted; after encrypting and storing the target data according to the target key, the target key is divided into multiple key fragments; a corresponding key fragment ciphertext is generated for each key fragment to obtain multiple key fragment ciphertexts; and the multiple key fragment ciphertexts are respectively stored in the first storage area in multiple different nodes. Thus, by sharding the key and encrypting them separately using a quantum-resistant algorithm, the key's anti-cracking capability is improved. At the same time, the key fragments are dispersedly stored on different nodes to ensure that the system has the ability to resist concentrated attacks and single-point failures. Even if the key fragments of some nodes are lost or attacked, the key can still be restored by combining a certain number of key fragments, thereby ensuring the security of data encryption.

[0065] Figure 2 A flow chart of another data encryption method provided by an embodiment of the present invention is as follows: Figure 2 As shown, the method specifically includes:

[0066] S21. Generate a target key for target data to be encrypted.

[0067] In this embodiment, similar to step S11, the specific Figure 1 For the sake of brevity, the relevant content will not be elaborated here.

[0068] S22. Encrypt the target data according to the target key to obtain encrypted target data; divide the encrypted target data into multiple data fragments; store the multiple data fragments in second storage areas in multiple different nodes, respectively, and each of the second storage areas is different from each of the first storage areas.

[0069] In this embodiment, the target data is first encrypted using the target key. The encrypted target data is divided into multiple data fragments. The division method may include but is not limited to: 1. Division into fixed-size fragments: the encrypted data is divided into data blocks of equal size. 2. Logical division: division is performed according to the specific structure or needs of the data.

[0070] Furthermore, multiple second storage areas for storing data fragments are pre-set in different nodes of the distributed system, and multiple data fragments are stored in different second storage areas, so that each data fragment is stored in a different node, and these nodes are located in different data centers or geographical locations or cloud platforms, ensuring data redundancy and fault tolerance. At the same time, each second storage area is completely separated from each first storage area storing key fragments to avoid the loss or leakage of keys and data due to attacks or failures.

[0071] S23. After encrypting and storing the target data according to the target key, divide the target key into multiple key fragments.

[0072] In this embodiment, similar to step S12, the specific Figure 1 For the sake of brevity, the relevant content will not be elaborated here.

[0073] S24. Determine a corresponding quantum-resistant encryption algorithm for each key fragment; encrypt each key fragment according to the quantum-resistant encryption algorithm to generate the key fragment ciphertext.

[0074] In this embodiment, corresponding quantum-resistant encryption algorithms may be pre-set for key fragments at different positions (for example, adjacent key fragments may be set to use different quantum-resistant encryption algorithms, or each key fragment may be set to use a different quantum-resistant encryption algorithm).

[0075] Specifically, quantum-resistant encryption algorithms may include but are not limited to: 1. Lattice-Based Cryptography, such as LWE (Learning With Errors) and RLWE (Ring-LWE). LWE is a classic implementation of lattice-based encryption, and RLWE is a specialization of LWE, suitable for encryption on polynomial rings. NTRU: An encryption scheme based on integer rings, which is a quantum-resistant encryption algorithm that uses mathematical problems in high-dimensional lattices. NTRU is widely used in encryption, key exchange, and digital signatures. 2. Code-Based Cryptography, such as McEliece encryption: Based on the problem of random linear codes, it has been widely studied and proven to be resistant to quantum attacks. The key to the McEliece encryption scheme is to generate an undecodable coding system. 3. Multivariate polynomial encryption algorithms, such as FrodoKEM: A protocol using key exchange whose security is based on multivariate polynomial problems (such as solving high-order equations), is another quantum-resistant encryption algorithm. Kyber: A key exchange scheme based on the RLWE problem has been included in NIST's quantum security standardization process. 4. Hash-based encryption algorithms, for example, Sphincs+: a hash-based signature scheme that has been proven to be secure in quantum computing environments and is suitable for building quantum-resistant public key systems.

[0076] When choosing a quantum-resistant encryption algorithm, you can choose a suitable quantum-resistant encryption algorithm based on system requirements and the characteristics of each key fragment. For example, for key fragments that require efficient encryption and decryption, you can choose NTRU or Kyber. For key exchange and other usage scenarios, you can choose FrodoKEM or LWE / RLWE. If a signature solution is required, you can choose Sphincs+.

[0077] For the selected quantum-resistant encryption algorithm, you first need to generate an encryption key pair. The encryption key pair consists of a public key and a private key. Use the public key to encrypt each key fragment to generate the ciphertext of the key fragment. These key fragment ciphertexts are encrypted data, and the original key fragments cannot be used directly. In this way, even if an attacker has access to some key fragments, they cannot undermine the overall security of the system.

[0078] S25. Acquire multiple nodes at different geographical locations corresponding to the target data; determine the storage area in each of the nodes as the first storage area; store each of the key fragment ciphertexts in a different first storage area, and each of the first storage areas stores a key fragment ciphertext.

[0079] In this embodiment, multiple first storage areas are pre-set in nodes at different geographical locations in the distributed system, and each node includes only one first storage area, so that each first storage area is physically and logically isolated from other first storage areas.

[0080] Specifically, storage nodes are selected from multiple geographical locations (e.g., different data centers or cloud regions). The storage area of ​​each node is used as the first storage area, which is specifically used to store a key fragment ciphertext, and each storage area can be regarded as a virtual storage unit. Each key fragment ciphertext is stored in the first storage area of ​​different nodes respectively, and the first storage area of ​​each node can only store one key fragment ciphertext.

[0081] Among them, it is necessary to determine the nodes distributed in different geographical locations. You can choose the following solutions:

[0082] Choose storage services provided by different cloud service platforms. These platforms support cross-regional storage distribution, and you can choose different data centers as storage nodes. Or, build your own data center: If it is a self-built distributed system, you can choose multiple data centers located in different cities or regions as storage nodes.

[0083] As an example, each key fragment ciphertext is uploaded to the first storage area of ​​a different storage node. Storage node 1 (located in us-west-1): stores the ciphertext of key fragment 1.

[0084] Storage node 2 (located in eu-central-1): stores the ciphertext of key fragment 2.

[0085] Storage node 3 (located at ap-southeast-1): stores the ciphertext of key fragment 3.

[0086] In one possible implementation, each first storage area has strict access control (such as IAM permissions, ACL policies) to ensure that only authorized entities can access and operate these key fragment ciphertexts. During the transmission process, the key fragment ciphertexts can be protected by encryption protocols such as TLS / SSL to prevent the data from being intercepted during the transmission process. At the same time, in order to ensure high availability and disaster resistance, redundant copies can be set in different storage areas, for example, multi-copy storage, in case a storage node fails.

[0087] S26. For each of the nodes, obtain the fragment number, encryption method, storage location and generation time of the key fragment as metadata for storage.

[0088] In this embodiment, the information of the key fragment is obtained as metadata for the key fragment ciphertext stored in each node, and the content of the metadata may include but is not limited to: Fragment number of the key fragment: identifies the unique ID of each key fragment. Encryption method: describes the quantum-resistant encryption algorithm used (such as Kyber, NTRU, LWE, etc.). Storage location: records the node location where the key fragment is stored or the geographical location of the first storage area (for example, the regional ID of the data center). Generation time: records the generation time of the key fragment or the key fragment ciphertext, which is used to trace the life cycle of the key fragment. Validity of the key fragment: records the validity status of the key fragment, such as whether it has been accessed, leaked or abandoned, etc.

[0089] Furthermore, the stored metadata can be uploaded to the distributed ledger of the current node. At the same time, in order to ensure the privacy of the metadata, the metadata needs to be encrypted before uploading it to the distributed ledger. After encryption, it can be uploaded to the distributed ledger in the following ways: Upload to the blockchain: such as Ethereum, Hyperledger Fabric or Corda and other blockchain platforms. The blockchain is tamper-proof and immutable, which can ensure that the metadata cannot be tampered with once it is written into the ledger. DAG (directed acyclic graph): such as IOTA, which adopts the concept of blockchain, but is not completely chain-like in structure. Metadata can be recorded through DAG, which has the characteristics of decentralization and low cost.

[0090] In one possible implementation, the integrity check is performed on the key fragment in each node at a preset time interval; when the integrity check fails, an alarm message is generated based on the metadata corresponding to the key fragment that failed the check, for alarm reminder.

[0091] Specifically, each node periodically performs a self-check task to check the status of the stored key fragments to ensure that they are not lost, damaged or tampered with.

[0092] Integrity verification: Verify that the stored key fragments are consistent by comparing the hash values ​​of the key fragments. If the key fragments are tampered with or damaged, the hash values ​​will not match.

[0093] Fragment validity check: In addition to verifying the hash value, the validity status of the key fragment can also be checked, such as whether it is marked as expired or discarded. If the fragment is no longer valid, an alarm mechanism should be triggered.

[0094] Consistency check, using consistent hashing or other consistency check algorithms, to ensure that the key fragments on each storage node are consistent with the corresponding fragments on other nodes. If there are multiple copies, data consistency between the copies should be ensured.

[0095] Metadata verification: Each storage node can also periodically check the metadata of the stored key fragments to ensure that the metadata matches the actual key fragments. If any inconsistency is found, the system should trigger an alarm.

[0096] If the self-check finds a problem (such as fragment loss, inconsistent hash values, storage errors, etc.), the system should immediately issue an alarm. The alarm content can include: fragment number, storage node ID, problem type (such as loss, damage, tampering, etc.), timestamp of the problem, affected storage area or node, multi-level alarm: The alarm system should set different alarm levels according to the severity of the problem, and adopt different response strategies for different levels of alarms.

[0097] When the monitoring system finds that a key fragment is missing or abnormal, the system should automatically start the recovery process. First, check other copies to confirm whether the fragment is lost or damaged. If other copies are available, restore the missing or damaged fragment by replicating the copy. If no other copies can be found, the system can restore the lost key fragment based on the existing fragments through the threshold recovery mechanism in Shamir's SecretSharing.

[0098] S27. When the encrypted target data needs to be decrypted, multiple key fragment ciphertexts are obtained from multiple first storage areas; a corresponding key fragment is generated for each key fragment ciphertext to obtain multiple key fragments; the target key is generated from the multiple key fragments; and the encrypted target data is decrypted according to the target key.

[0099] In this embodiment, decrypting the encrypted target data according to the target key includes:

[0100] Acquire multiple data fragments from each node containing the second storage area; generate the encrypted target data according to the multiple data fragments; and when the generated encrypted target data is complete, decrypt the encrypted target data according to the target key.

[0101] Specifically, when the encrypted target data needs to be decrypted, the stored key fragment ciphertexts are obtained from the multiple first storage areas. According to the encryption method of each key fragment (such as LWE, Kyber, etc.), a correct decryption algorithm is selected, and the key fragment ciphertext is decrypted using the same key or decryption mechanism as that used for encryption, thereby restoring the original key fragment.

[0102] Successful decryption obtains multiple key fragments, and the target key is restored according to the threshold scheme by performing polynomial interpolation on the multiple key fragments. Shamir's Secret Sharing will use a certain number of key fragments to restore the original target key (master key). After the target key is restored, the correctness of the target key can be ensured through a specific verification mechanism (such as verifying the hash value).

[0103] The recovered target key is used to decrypt the encrypted target data and restore the original target data. The decrypted data can be verified for integrity to ensure that the data has not been damaged or tampered with during the encryption and decryption process.

[0104] As an example, Figure 5 The figure shows a flow chart of another data encryption method provided by an embodiment of the present invention, which specifically includes: 1. Key generation and sharding: First, the system generates a master key (Root Key) as the target key, which will be used to encrypt data. In order to ensure quantum security, a lattice-based encryption algorithm with strong quantum resistance (such as NTRU, lattice encryption, etc.) is used when generating the master key. The master key is divided into multiple key fragments using the Shamir's Secret Sharing (SSS) scheme. The SSS scheme ensures through mathematical polynomial interpolation that the original master key can only be restored when a certain number of key fragments (threshold) combinations are met. Each key fragment is then separately encrypted by a different quantum-resistant encryption algorithm (such as LWE, RLWE, etc.) to generate a key fragment ciphertext to ensure that even if a single fragment is leaked, it cannot be cracked.

[0105] 2. Distributed storage of key fragments: The encrypted key fragments are distributed and stored on different storage nodes, and each node is distributed in different geographical locations or data centers to ensure that the fragments are not concentrated in a single physical location to avoid single point failure. The metadata of the key fragment (such as fragment number, encryption method, storage location, generation time, etc.) is recorded on each node, and the metadata is encrypted and uploaded to the distributed ledger to ensure the tamper-proof and traceability of the metadata. Each storage node regularly performs self-checks and consistency checks on the key fragments to verify the integrity of the fragments. If a fragment is found to be lost or abnormal, the system will automatically issue an alarm and trigger the fragment redundancy recovery mechanism. 3. Data encryption and object storage: At the object storage layer, the stored data objects are encrypted using a quantum-resistant encryption algorithm to generate encrypted data blocks. Each data block encryption key is derived from the aforementioned shard key (generated through a key derivation function) to ensure the strength of the encryption key. The encrypted data object is sharded and stored in different object storage nodes, so that the data is redundantly distributed on different nodes and separated from the key fragment storage nodes, further reducing the risks brought by centralization. 4. Key recovery mechanism: When accessing or decrypting data, the system will automatically request multiple key fragment nodes to provide key fragments. Access requests must pass the identity authentication of the quantum-resistant algorithm to ensure that only authorized users or systems can access the fragments. When the system successfully obtains at least key fragments, it automatically performs fragment verification and decryption to recover the complete master key. If the integrity of the fragment cannot be verified, the system will trigger the error handling process for key recovery. After obtaining the master key, the system can use the master key to decrypt the object storage data and generate the original data for authorized users to access. 5. Access control and logging: Each data decryption request and key recovery request must undergo quantum-resistant identity authentication to ensure that only authorized users or nodes can perform decryption operations. All data and key access records will be written to an unalterable distributed ledger as a historical operation log. These log data are stored after encryption to ensure operation traceability and security.

[0106] The data encryption method provided by the embodiment of the present invention uses a quantum-resistant encryption algorithm to shard the key, each key fragment is independently encrypted, and is stored in multiple storage nodes in a distributed manner, and security is improved by combining a multi-point verification mechanism. The key can only be restored when the set node conditions are met, which improves the key's anti-cracking ability and the reliability of the system. In addition, the scheme does not rely on centralized key management, and prevents single-point attacks through a multi-node distributed architecture. Since the key fragments have been encrypted by a quantum-resistant encryption algorithm when stored, it is ensured that even if some key fragments are leaked, the master key cannot be directly cracked. Secondly, by distributing the key fragments in multiple geographical locations and storage areas, it is ensured that even if a node or storage area fails, the system can recover the key fragments from other copies. Only when a sufficient number of key fragments are recovered can the correct target key be generated, increasing the security of the system. The system can flexibly manage keys and encrypted data while ensuring data security and integrity, and has a strong anti-attack capability, especially when facing quantum computing attacks.

[0107] Figure 3 A schematic diagram of the structure of a data encryption device provided by an embodiment of the present invention is shown in FIG. Figure 3 As shown, the device specifically includes:

[0108] A first generating module 31, used to generate a target key for target data to be encrypted;

[0109] A division module 32, configured to divide the target key into a plurality of key fragments after encrypting and storing the target data according to the target key;

[0110] A second generating module 33, configured to generate a corresponding key fragment ciphertext for each key fragment, to obtain a plurality of key fragment ciphertexts;

[0111] The storage module 34 is used to store the plurality of key fragment ciphertexts in first storage areas in a plurality of different nodes respectively.

[0112] In a possible implementation manner, the encryption storage module 35 is used to encrypt the target data according to the target key to obtain encrypted target data;

[0113] Dividing the encrypted target data into multiple data segments;

[0114] The plurality of data fragments are respectively stored in second storage areas in a plurality of different nodes, and each of the second storage areas is different from each of the first storage areas.

[0115] In a possible implementation, the second generation module is specifically configured to determine a corresponding quantum-resistant encryption algorithm for each of the key fragments;

[0116] Each of the key fragments is encrypted according to the quantum-resistant encryption algorithm to generate the key fragment ciphertext.

[0117] In a possible implementation, the storage module is specifically used to obtain multiple nodes at different geographical locations corresponding to the target data;

[0118] Determine a storage area in each of the nodes as the first storage area;

[0119] storing each of the key fragment ciphertexts in different first storage areas, each of the first storage areas correspondingly storing one key fragment ciphertext;

[0120] For each of the nodes, the fragment number, encryption method, storage location and generation time of the key fragment are obtained as metadata for storage.

[0121] In a possible implementation, the verification module 36 is configured to perform integrity verification on the key fragment in each node at intervals of a preset duration;

[0122] When the integrity check fails, an alarm message is generated based on the metadata corresponding to the key fragment that failed the check, for alarm reminder.

[0123] In a possible implementation manner, the acquisition module 37 is configured to acquire multiple key fragment ciphertexts from multiple first storage areas when the encrypted target data needs to be decrypted;

[0124] A third generating module 38, configured to generate a corresponding key fragment for each key fragment ciphertext, to obtain a plurality of key fragments;

[0125] Generate the target key from a plurality of the key fragments;

[0126] The decryption module 39 is used to decrypt the encrypted target data according to the target key.

[0127] In a possible implementation, the decryption module is specifically configured to obtain a plurality of data fragments from each node including the second storage area;

[0128] generating the encrypted target data according to the plurality of data fragments;

[0129] When the generated encrypted target data is complete, the encrypted target data is decrypted according to the target key.

[0130] The data encryption device provided in this embodiment can be as follows Figure 3 The device shown in FIG. 1 can perform the following steps: Figure 1-2All steps of the data encryption method in Figure 1-2 For details on the technical effects of the data encryption method shown, please refer to Figure 1-2 For the sake of brevity, the relevant description is not repeated here.

[0131] Figure 4 A schematic diagram of the structure of a computer device provided by an embodiment of the present invention, Figure 4 The computer device 400 shown includes: at least one processor 401, a memory 402, at least one network interface 404 and other user interfaces 403. The various components in the computer device 400 are coupled together via a bus system 405. It is understood that the bus system 405 is used to achieve connection and communication between these components. In addition to the data bus, the bus system 405 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, the bus system 405 is not shown in FIG. Figure 4 Various buses are labeled as bus system 405 .

[0132] The user interface 403 may include a display, a keyboard, or a pointing device (eg, a mouse, a trackball, a touch pad, or a touch screen).

[0133] It can be understood that the memory 402 in the embodiment of the present invention can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct RAM bus random access memory (DRRAM). The memory 402 described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0134] In some implementations, the memory 402 stores the following elements, executable units or data structures, or a subset thereof, or an extended set thereof: an operating system 4021 and application programs 4022 .

[0135] The operating system 4021 includes various system programs, such as a framework layer, a core library layer, a driver layer, etc., which are used to implement various basic services and process hardware-based tasks. The application 4022 includes various application programs, such as a media player (Media Player), a browser (Browser), etc., which are used to implement various application services. The program for implementing the method of the embodiment of the present invention can be included in the application 4022.

[0136] In the embodiment of the present invention, by calling the program or instruction stored in the memory 402, specifically, the program or instruction stored in the application 4022, the processor 401 is used to execute the method steps provided by each method embodiment, for example, including:

[0137] Generate a target key for target data to be encrypted;

[0138] After encrypting and storing the target data according to the target key, dividing the target key into a plurality of key fragments;

[0139] Generating a corresponding key fragment ciphertext for each key fragment to obtain a plurality of key fragment ciphertexts;

[0140] The plurality of key fragment ciphertexts are stored in first storage areas in a plurality of different nodes respectively.

[0141] In a possible implementation, the target data is encrypted according to the target key to obtain encrypted target data;

[0142] Dividing the encrypted target data into a plurality of data segments;

[0143] The plurality of data fragments are respectively stored in second storage areas in a plurality of different nodes, and each of the second storage areas is different from each of the first storage areas.

[0144] In a possible implementation, for each of the key fragments, a corresponding quantum-resistant encryption algorithm is determined;

[0145] Each of the key fragments is encrypted according to the quantum-resistant encryption algorithm to generate the key fragment ciphertext.

[0146] In a possible implementation, a plurality of nodes at different geographical locations corresponding to the target data are obtained;

[0147] Determine a storage area in each of the nodes as the first storage area;

[0148] storing each of the key fragment ciphertexts in different first storage areas, each of the first storage areas correspondingly storing one key fragment ciphertext;

[0149] For each of the nodes, the fragment number, encryption method, storage location and generation time of the key fragment are obtained as metadata for storage.

[0150] In a possible implementation, at intervals of a preset duration, integrity check is performed on the key fragment in each node;

[0151] When the integrity check fails, an alarm message is generated based on the metadata corresponding to the key fragment that failed the check, for alarm reminder.

[0152] In a possible implementation, when the encrypted target data needs to be decrypted, multiple key fragment ciphertexts are obtained from multiple first storage areas;

[0153] Generating a corresponding key fragment for each of the key fragment ciphertexts to obtain a plurality of key fragments;

[0154] Generate the target key from a plurality of the key fragments;

[0155] The encrypted target data is decrypted according to the target key.

[0156] In one possible implementation, multiple data fragments are obtained from each node including the second storage area;

[0157] generating the encrypted target data according to the plurality of data fragments;

[0158] When the generated encrypted target data is complete, the encrypted target data is decrypted according to the target key.

[0159] The method disclosed in the above embodiment of the present invention can be applied to the processor 401, or implemented by the processor 401. The processor 401 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit in the processor 401 or the instruction in the form of software. The above processor 401 can be a general processor, a digital signal processor (Digital Signal Processor, DSP), an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present invention can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiment of the present invention can be directly embodied as a hardware decoding processor to execute, or the hardware and software units in the decoding processor can be executed. The software unit can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 402, and the processor 401 reads the information in the memory 402 and completes the steps of the above method in combination with its hardware.

[0160] It is understood that the embodiments described herein may be implemented in hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit may be implemented in one or more application specific integrated circuits (ASIC), digital signal processors (DSP), digital signal processing devices (DSPDevice, DSPD), programmable logic devices (PLD), field programmable gate arrays (FPGA), general purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions described in the present application, or a combination thereof.

[0161] For software implementation, the technology described herein can be implemented by a unit that performs the functions described herein. The software code can be stored in a memory and executed by a processor. The memory can be implemented in the processor or outside the processor.

[0162] The computer device provided in this embodiment may be Figure 4 The computer device shown in , can execute Figure 1-2 All steps of the data encryption method in Figure 1-2 For details on the technical effects of the data encryption method shown, please refer to Figure 1-2 For the sake of brevity, the relevant description is not repeated here.

[0163] The embodiment of the present invention also provides a storage medium (computer-readable storage medium). The storage medium here stores one or more programs. The storage medium may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a read-only memory, a flash memory, a hard disk or a solid-state drive; the memory may also include a combination of the above-mentioned types of memory.

[0164] When one or more programs in the storage medium can be executed by one or more processors, the above-mentioned data encryption method executed on the device side can be implemented.

[0165] The processor is used to execute the data encryption program stored in the memory to implement the following steps of the data encryption method performed on the device side:

[0166] Generate a target key for target data to be encrypted;

[0167] After encrypting and storing the target data according to the target key, dividing the target key into a plurality of key fragments;

[0168] Generating a corresponding key fragment ciphertext for each key fragment to obtain a plurality of key fragment ciphertexts;

[0169] The plurality of key fragment ciphertexts are stored in first storage areas in a plurality of different nodes respectively.

[0170] In a possible implementation, the target data is encrypted according to the target key to obtain encrypted target data;

[0171] Dividing the encrypted target data into multiple data segments;

[0172] The plurality of data fragments are respectively stored in second storage areas in a plurality of different nodes, and each of the second storage areas is different from each of the first storage areas.

[0173] In a possible implementation, for each of the key fragments, a corresponding quantum-resistant encryption algorithm is determined;

[0174] Each of the key fragments is encrypted according to the quantum-resistant encryption algorithm to generate the key fragment ciphertext.

[0175] In a possible implementation, a plurality of nodes at different geographical locations corresponding to the target data are obtained;

[0176] Determine a storage area in each of the nodes as the first storage area;

[0177] storing each of the key fragment ciphertexts in different first storage areas, each of the first storage areas correspondingly storing one key fragment ciphertext;

[0178] For each of the nodes, the fragment number, encryption method, storage location and generation time of the key fragment are obtained as metadata for storage.

[0179] In a possible implementation, integrity check is performed on the key fragment in each node at intervals of a preset duration;

[0180] When the integrity check fails, an alarm message is generated based on the metadata corresponding to the key fragment that failed the check, for alarm reminder.

[0181] In a possible implementation, when the encrypted target data needs to be decrypted, multiple key fragment ciphertexts are obtained from multiple first storage areas;

[0182] Generating a corresponding key fragment for each of the key fragment ciphertexts to obtain a plurality of key fragments;

[0183] Generate the target key from a plurality of the key fragments;

[0184] The encrypted target data is decrypted according to the target key.

[0185] In one possible implementation, multiple data fragments are obtained from each node including the second storage area;

[0186] generating the encrypted target data according to the plurality of data fragments;

[0187] When the generated encrypted target data is complete, the encrypted target data is decrypted according to the target key.

[0188] The professionals should further realize that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to the function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0189] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0190] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A data encryption method, characterized in that: include: Generate a target key for target data to be encrypted; After encrypting and storing the target data according to the target key, dividing the target key into a plurality of key fragments; Generating a corresponding key fragment ciphertext for each key fragment to obtain a plurality of key fragment ciphertexts; The plurality of key fragment ciphertexts are stored in first storage areas in a plurality of different nodes respectively.

2. The method according to claim 1, characterized in that The encrypting and storing the target data according to the target key includes: Encrypting the target data according to the target key to obtain encrypted target data; Dividing the encrypted target data into multiple data segments; The plurality of data fragments are respectively stored in second storage areas in a plurality of different nodes, and each of the second storage areas is different from each of the first storage areas.

3. The method according to claim 1, characterized in that The generating a corresponding key fragment ciphertext for each key fragment includes: For each of the key fragments, determining a corresponding quantum-resistant encryption algorithm; Each of the key fragments is encrypted according to the quantum-resistant encryption algorithm to generate the key fragment ciphertext.

4. The method according to claim 1, characterized in that: The storing the plurality of key fragment ciphertexts respectively in first storage areas in a plurality of different nodes comprises: Acquire multiple nodes at different geographical locations corresponding to the target data; Determine a storage area in each of the nodes as the first storage area; storing each of the key fragment ciphertexts in different first storage areas, each of the first storage areas correspondingly storing one key fragment ciphertext; For each of the nodes, the fragment number, encryption method, storage location and generation time of the key fragment are obtained as metadata for storage.

5. The method according to claim 4, characterized in that The method further comprises: At preset intervals, integrity checks are performed on the key fragments in each node; When the integrity check fails, an alarm message is generated based on the metadata corresponding to the key fragment that failed the check, for alarm reminder.

6. The method according to claim 1, characterized in that After storing the plurality of key fragment ciphertexts in first storage areas in a plurality of different nodes respectively, the method further comprises: When the encrypted target data needs to be decrypted, a plurality of key fragment ciphertexts are obtained from a plurality of the first storage areas; Generating a corresponding key fragment for each of the key fragment ciphertexts to obtain a plurality of key fragments; Generate the target key from a plurality of the key fragments; The encrypted target data is decrypted according to the target key.

7. The method according to claim 6, characterized in that The decrypting the encrypted target data according to the target key comprises: Retrieving a plurality of data fragments from each node including a second storage area; generating the encrypted target data according to the plurality of data fragments; When the generated encrypted target data is complete, the encrypted target data is decrypted according to the target key.

8. A data encryption device, characterized in that: include: A first generating module, used to generate a target key for target data to be encrypted; A division module, used for dividing the target key into a plurality of key fragments after encrypting and storing the target data according to the target key; A second generating module, configured to generate a corresponding key fragment ciphertext for each key fragment, to obtain a plurality of key fragment ciphertexts; The storage module is used to store the plurality of key fragment ciphertexts in first storage areas in a plurality of different nodes respectively.

9. A computer device, characterized in that: include: A processor and a memory, wherein the processor is used to execute a data encryption program stored in the memory to implement the data encryption method according to any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the data encryption method according to any one of claims 1 to 7.

Images