Data encryption method and device, equipment and medium

Abstract

The invention discloses a data encryption method and device, equipment and a medium, and is applied to the field of data security. According to the method, after a shared key and an internal filling value are subjected to XOR operation, an obtained first XOR result is spliced with to-be-encrypted data; hash operation is carried out on the first splicing result, and first Hash operation is completed. And then, carrying out an XOR operation on the shared key and an external filling value, splicing an obtained second XOR result with the first Hash operation result, and finally completing a second Hash operation. According to the embodiment of the invention, a new Hash operation message authentication code encryption mode is provided, the shared key is subjected to XOR operation through the internal filling value and the external filling value to obtain two XOR results, and then the two XOR results are sequentially spliced with the to-be-encrypted data and subjected to Hash operation; and multi-level and multi-dimensional security protection measures are provided, so that the security of network data in a transmission process is ensured.

Description

Technical Field

[0001] The present application relates to the field of data security, and in particular to a data encryption method, device, equipment and medium. Background Art

[0002] With the rapid development of the Internet, the network has become the main channel for information transmission and sharing in modern society. At the same time, network security issues have become increasingly prominent, with frequent incidents such as data leakage, hacker attacks, and malware propagation, posing serious threats to personal information security and corporate secrets. Therefore, how to ensure the security of network data has become an urgent problem to be solved. The current solution is to encrypt data to maintain data security.

[0003] However, in the network data scenario, due to the complexity and openness of the network environment, the security of conventional encryption methods is relatively low, and data still faces the risk of being stolen, tampered with or destroyed. Especially when it comes to the transmission of sensitive data involving personal privacy and commercial secrets, once the data is illegally obtained or tampered with, it may cause immeasurable losses. Summary of the invention

[0004] The embodiments of the present application provide a data encryption method, apparatus, device and medium, which can improve the security of data in a network data scenario and prevent the data from being stolen, tampered with or destroyed.

[0005] On the one hand, an embodiment of the present application provides a data encryption method, including:

[0006] Obtain the data to be encrypted and the shared key;

[0007] Performing an XOR operation on the shared key and the internal filling value to obtain a first XOR result;

[0008] Concatenate the first XOR result with the data to be encrypted to obtain a first concatenation result;

[0009] Performing a hash operation on the first concatenation result to obtain a first hash operation result;

[0010] Performing an XOR operation on the shared key and the external padding value to obtain a second XOR result;

[0011] Concatenate the second XOR result with the first Hash operation result to obtain a second concatenation result;

[0012] A hash operation is performed on the second concatenation result to obtain encrypted data.

[0013] On the other hand, obtaining the shared key includes:

[0014] generating a first random number;

[0015] Taking the first random number as an iteration initial value, processing the iteration initial value based on a chaotic mapping iterative function to obtain function output data;

[0016] Based on the function output data, the shared key is determined.

[0017] On the other hand, determining the shared key based on the function output data includes:

[0018] Obtain the data length of the output data of the function;

[0019] In a case where the data length exceeds the block length of the hash function, determining the function output data as the shared key;

[0020] In the case where the data length does not exceed the block length of the hash function, generating a second random number of a preset length; the sum of the data length and the preset length is greater than the block length of the hash function;

[0021] The second random number is filled into the tail of the function output data to obtain the shared key.

[0022] On the other hand, obtaining the data to be encrypted includes:

[0023] Get the decimal data to be encrypted;

[0024] The decimal data to be encrypted is processed in blocks to obtain information block data;

[0025] Performing byte division processing on the information block data to obtain byte message group data;

[0026] The byte message group data is converted into a binary sequence to obtain the binary data to be encrypted.

[0027] On the other hand, after performing a hash operation on the second concatenation result to obtain encrypted data, the method further includes:

[0028] Upon receiving a data query request from a user, verifying the data query request to obtain a verification result;

[0029] When the verification result indicates that the user has the query authority and the data query request meets the preset conditions, decrypting the encrypted data to obtain decrypted data;

[0030] The decrypted data is sent to the user.

[0031] On the other hand, sending the decrypted data to the user comprises:

[0032] Encrypting the decrypted data using chaotic mapping to obtain target transmission data;

[0033] The target transmission data is sent to the user.

[0034] On the other hand, the preset conditions include that the request format, request content and request parameters of the data query request meet preset standards;

[0035] In the case of receiving the data query request from the user, after verifying the data query request to obtain a verification result, the method further includes:

[0036] If the verification result indicates that the user has the query authority, but the data query request does not meet the preset condition, the query authority of the user is cancelled.

[0037] On the other hand, an embodiment of the present application provides a data encryption device, including:

[0038] An acquisition module, used to acquire the data to be encrypted and the shared key;

[0039] A processing module, configured to perform an XOR operation on the shared key and an internal filling value to obtain a first XOR result;

[0040] A splicing module, used for splicing the first XOR result with the data to be encrypted to obtain a first splicing result;

[0041] A computing module, configured to perform a hash operation on the first concatenation result to obtain a first hash operation result;

[0042] The processing module is further used to perform an XOR operation on the shared key and the external padding value to obtain a second XOR result;

[0043] The splicing module is further used to splice the second XOR result with the first Hash operation result to obtain a second splicing result;

[0044] The operation module is further used to perform a hash operation on the second splicing result to obtain encrypted data.

[0045] In another aspect, an embodiment of the present application provides a data encryption device, comprising: a processor and a memory storing computer program instructions;

[0046] When the processor executes the computer program instructions, the data encryption method as described above is implemented.

[0047] On the other hand, an embodiment of the present application provides a computer-readable storage medium, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the data encryption method as described above is implemented.

[0048] On the other hand, an embodiment of the present application provides a computer program product. When instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes the data encryption method as described above.

[0049] A data encryption method provided by an embodiment of the present application performs an XOR operation on a shared key and an internal filling value, and then concatenates the first XOR result obtained with the data to be encrypted; then performs a hash operation on the first concatenation result to complete the first hash operation. Then, the shared key is XORed with an external filling value, and the second XOR result obtained is concatenated with the first hash operation result, and finally the second hash operation is completed. The embodiment of the present application proposes a new Hash-based Message Authentication Code (HMAC) encryption method, performs an XOR operation on the shared key through an internal filling value and an external filling value to obtain two XOR results, and then concatenates the two XOR results with the data to be encrypted in turn and performs a hash operation, providing multi-level and multi-dimensional security protection measures to ensure the security of network data during transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the technical solution of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0051] Figure 1 A schematic diagram of a data encryption method according to an embodiment of the present invention is shown;

[0052] Figure 2 A schematic diagram of the structure of a data security management system provided by an embodiment of the present application is shown;

[0053] Figure 3 A schematic diagram of the structure of a data storage module provided by an embodiment of the present application is shown;

[0054] Figure 4 A schematic diagram of the structure of a data encryption device provided in an embodiment of the present application is shown;

[0055] Figure 5 A schematic diagram of the hardware structure of a data encryption device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0056] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present application by illustrating the examples of the present application.

[0057] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "include..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0058] With the rapid development of the Internet, the network has become the main channel for information transmission and sharing in modern society. How to ensure the security of network data has become an urgent problem to be solved. Conventional data encryption methods have low security and data still faces the risk of being stolen, tampered with or destroyed.

[0059] The commonly used HMAC encryption method is a message authentication code used to verify the integrity of a message and the authenticity of an identity. It processes messages through a key and a hash function (such as SHA-256). The HMAC algorithm is a more secure message digest algorithm, and it is always used in conjunction with a hash algorithm, such as HMAC-MD5 or HMAC-SHA256. The HMAC algorithm is widely used in network communications, digital signatures, and other fields, and is an important data security protection method.

[0060] The current HMAC encryption scheme performs generally in network data security scenarios. Therefore, in order to solve the problems of the traditional scheme, the present application embodiment provides a data encryption method, device, equipment and medium. The data encryption method provided by the present application embodiment is first introduced below. Figure 1 FIG. 1 is a flow chart of a data encryption method provided by an embodiment of the present application. Figure 1As shown, the method comprises the following steps:

[0061] S101: Obtain data to be encrypted and obtain a shared key.

[0062] For network data to be used, it needs to be saved in a database, and when the user issues a corresponding data query request, the network data is obtained from the database and sent to the user. In actual applications, data faces the risk of being stolen, tampered with or destroyed. Therefore, the network data needs to be encrypted before being saved to improve its security.

[0063] The above data is used as the data to be encrypted, and the data to be encrypted needs to be encrypted to ensure its security. The key is the corresponding substitution relationship between the password and the plain text. In the embodiment of the present application, a shared key needs to be generated in advance, and then the data to be encrypted is encrypted based on the shared key.

[0064] The specific method of generating the shared key is not limited and can be selected according to actual needs. Generally, in practical applications, it is necessary to ensure that the length of the shared key meets the requirements, because the data needs to be hashed in subsequent steps, so the length of the shared key can be set based on the length of the hash function block.

[0065] S102: Perform an XOR operation on the shared key and the internal filling value to obtain a first XOR result.

[0066] The internal fill value IPad and the external fill value OPad mentioned below are specific fill values ​​used for key expansion and other operations in cryptography. The specific value is a predefined fixed byte sequence used to perform an XOR operation with the processed key to enhance security. In the embodiment of the present application, the internal fill value IPad is XORed with the shared key generated above to obtain the first XOR result.

[0067] XOR operation is commonly used in logic operations and bit operations in computers. The XOR operation output is true (1) if and only if the two input values ​​are different, otherwise the output is false (0). Because the shared key and the internal padding value need to be XORed in this step, both the shared key and the internal padding value need to be converted into binary data.

[0068] S103: Concatenate the first XOR result with the data to be encrypted to obtain a first concatenated result.

[0069] After obtaining the first XOR result, it is spliced ​​with the data to be encrypted, thereby changing the data to be encrypted to improve its security. It should be noted that the specific splicing method is not limited here. As a feasible implementation method, the first XOR result can be spliced ​​to the front of the data to be encrypted, or the first XOR result can be spliced ​​to the end of the data to be encrypted.

[0070] S104: Perform a hash operation on the first concatenation result to obtain a first hash operation result.

[0071] Hashing is a process that converts input data of arbitrary length into a fixed-length output (hash value). The output of a hash operation is usually a short binary number or string that serves as a unique identifier for the input data. Hashing has a wide range of applications in computer science, especially in data encryption, data integrity checks, and hash tables.

[0072] There are multiple hashing algorithms, and this application does not limit which specific algorithm is used. As a feasible implementation method, the SHA-256 hash function can be used for hashing. For example, based on the SHA-256 hash function, the first concatenation result can be hashed to obtain the first hashing result. At this point, the first hashing operation is completed.

[0073] S105: Perform an XOR operation on the shared key and the external padding value to obtain a second XOR result.

[0074] As mentioned above, the internal filling value IPad and the external filling value OPad are specific filling values ​​used for key expansion and other operations in cryptography. In this step, the shared key and the external filling value are XORed to obtain a second XOR result.

[0075] S106: Concatenate the second XOR result with the first Hash operation result to obtain a second concatenation result.

[0076] The second XOR result is obtained by performing an XOR operation on the shared key and the external filling value; and the first Hash operation result is the value obtained by the first Hash operation. In this step, the second XOR result is concatenated with the first Hash operation result to obtain a second concatenated result.

[0077] Similarly, the concatenation method of the second XOR result and the first Hash operation result is not limited here. As a feasible implementation, the second XOR result can be concatenated to the front of the first Hash operation result, or the second XOR result can be concatenated to the end of the first Hash operation result.

[0078] S107: Perform a hash operation on the second concatenation result to obtain encrypted data.

[0079] In the above, the internal padding value and the external padding value are XORed with the shared key respectively, and then the first XOR result and the second XOR result are sequentially concatenated on the data to be encrypted, and finally, the second concatenated result is hashed to obtain the encrypted data. At this point, the HMAC encryption of the data to be encrypted is completed, and the final encrypted data can be saved in the database so that users can query the required data.

[0080] Encrypting data is only part of the data processing process. In actual applications, data needs to be saved in the database. When a user issues a data query request, the corresponding encrypted data needs to be obtained, decrypted and sent to the user. These steps require a complete data management system to complete.

[0081] In the present embodiment, the traditional HMAC encryption algorithm is improved. As a message authentication code algorithm based on hash function, it combines hash function and key, and generates message authentication code (MAC) by specific calculation method. The main purpose of HMAC encryption algorithm is to ensure the integrity of data and to authenticate identity, and to ensure that data is not tampered with during transmission. The principle of HMAC algorithm is to combine key with data, and then apply hash function. The specific steps include selecting an appropriate hash function (such as SHA-256), filling data with shared key, XORing shared key with internal specific constant (internal filling value IPad and external filling value OPad) to generate internal key (two XOR results), hashing data with internal key, and hashing hash result with another internal key again. The hash value finally generated is HMAC value (i.e. encrypted data).

[0082] A data encryption method provided in an embodiment of the present application performs an XOR operation on a shared key and an internal filling value, and then concatenates the first XOR result obtained with the data to be encrypted; then, a hash operation is performed on the first concatenation result to complete the first hash operation. Then, the shared key is XORed with an external filling value, and the second XOR result obtained is concatenated with the first hash operation result, and finally, the second hash operation is completed. The embodiment of the present application proposes a new HMAC encryption method, performs an XOR operation on the shared key through an internal filling value and an external filling value to obtain two XOR results, and then concatenates the two XOR results with the data to be encrypted in turn and performs a hash operation, thereby providing multi-level and multi-dimensional security protection measures to ensure the security of network data during transmission.

[0083] As mentioned above, it is necessary to implement the encryption operation of the encrypted data based on the shared key, so it is necessary to obtain the shared key first. As an optional implementation method, a first random number can be generated; then the first random number is used as the initial value of the iteration, and the initial value of the iteration is processed based on the chaotic mapping iterative function to obtain the function output data; finally, the shared key is determined based on the function output data.

[0084] As a feasible implementation method, the chaotic mapping iterative function may specifically utilize Logistic mapping and Chebyshev mapping.

[0085] Specifically, in this embodiment, the Logistic mapping, also known as the Logistic function or the Logistic equation, is a commonly used nonlinear mapping function, which is used to map the input to the interval (0, 1). It is usually expressed as a quadratic polynomial mapping (recursive relation), which is one of the typical mappings that express complex nonlinear behaviors.

[0086] Logistic mapping has the following notable characteristics: 1. The curve produced by Logistic mapping is S-shaped. 2. From an asymptotic perspective, when the independent variable x approaches positive infinity, the function value f(x) approaches 1; when x approaches negative infinity, f(x) approaches 0. 3. Logistic mapping is a nonlinear transformation function that can perform nonlinear mapping on the input; this nonlinear characteristic enables Logistic mapping to better simulate complex relationships and behaviors. 4. Limit the output range: Logistic mapping limits the input to between (0,1), that is, the output value falls within the unit interval. This characteristic makes it commonly used in probability, classification problems, and neural networks.

[0087] Logistic mapping has a wide range of applications in many fields. In biology, it is often used to describe the saturation effect of biological population growth, that is, when environmental resources are limited, the population reaches a stable value. In neural networks, Logistic mapping is used as an activation function to introduce nonlinear characteristics, enabling neural networks to learn and process complex patterns. In addition, in the logistic regression classifier, Logistic mapping maps the input variable to a probability value of (0,1) through the Logistic function, which is used for probability estimation and decision boundary judgment of binary classification problems.

[0088] The Chebyshev map is a mapping with order k as a parameter, which is based on Chebyshev polynomials, a polynomial sequence commonly used in numerical analysis and approximation theory. The Chebyshev map generates chaotic behavior by iterating a specific form of the Chebyshev polynomial. The Chebyshev map has the autocorrelation and zero-valued cross-correlation of a delta function, which is similar to the properties of white noise and has good random performance. Therefore, it can be used as a key in data communication or multimedia security. Due to the simplicity of its mathematical expression and good chaotic characteristics, the Chebyshev chaotic map is widely used in chaotic encryption and pseudo-random number generation.

[0089] When the control parameter of the Chebyshev map is w∈[2,6], the Lyapunov exponent of the map is positive, indicating that within the range of w∈[2,6], the Chebyshev map can exhibit chaotic characteristics.

[0090] This embodiment proposes a method for generating a shared key, which first generates a random number and uses it as an iteration initial value, and processes it based on a chaotic mapping iterative function to obtain a shared key with sufficiently high security, thereby ensuring the encryption effect.

[0091] The output value of the chaotic mapping iterative function in the above text is the function output data, and the shared key needs to be determined based on this function output data; however, in actual applications, the length of the function output data is uncertain, and in the subsequent hash operation process, it is necessary to ensure that the length of the shared key meets the requirements.

[0092] As a feasible implementation, in the process of determining the shared key based on the function output data, the data length of the function output data may be first obtained; then the data length of the function output data and the block length of the hash function may be compared;

[0093] When the data length of the function output data exceeds the block length of the hash function, the function output data is determined as a shared key; that is, the data length of the function output data meets the requirements and does not need to be processed.

[0094] When the data length does not exceed the block length of the hash function, a second random number of a preset length needs to be generated; and the second random number is filled to the end of the function output data to obtain a shared key. The specific value of the preset length of the second random number is not limited, and it is necessary to ensure that the sum of the data length and the preset length is greater than the block length of the hash function. As an optional implementation, 0x00 bytes can be filled after the function output data until the block size is reached.

[0095] In the embodiment of the present application, when the length of the function output data does not meet the requirements, it is padded based on the second random number, thereby ensuring that the final shared key can be hashed.

[0096] In the subsequent processing of the encrypted data, operations such as XOR, concatenation and hash calculation are required, so the encrypted data needs to be binary data. As an optional implementation, after obtaining the decimal data to be encrypted, the decimal data to be encrypted is first divided into blocks to obtain information block data; then the information block data is divided into bytes to obtain byte message group data; finally, the byte message group data can be converted into a binary sequence to obtain binary data to be encrypted.

[0097] In this implementation, a series of processes are performed on the original decimal data to be encrypted to obtain binary data to be encrypted, so as to meet the data requirements of the subsequent encryption steps.

[0098] After performing a hash operation on the second concatenation result to obtain encrypted data, the user may have a query requirement for the encrypted data, that is, issue a corresponding data query request. As a feasible embodiment, upon receiving a data query request from a user, the data query request may be verified to obtain a verification result; and when the verification result indicates that the user has query authority and the data query request meets the preset conditions, the encrypted data is decrypted to obtain decrypted data; and finally the decrypted data is sent to the user.

[0099] As an optional implementation, the above-mentioned preset conditions may include that the request format, request content and request parameters of the data query request meet the preset standards, etc. Then, when a data query request of a user is received, the data query request is verified to obtain a verification result. If the verification result indicates that the user has the query authority, but the data query request does not meet the preset conditions, the user's query authority may be revoked.

[0100] In this implementation, after the user issues a data query request for encrypted data, the request is verified to ensure data security. If the data query request issued by the user does not meet the preset conditions, the user's query authority is revoked to avoid data leakage caused by theft of the user's account.

[0101] When a user with query authority issues a data query request and the verification result of the data query request meets the preset conditions, the decrypted data needs to be sent to the user. As an optional implementation, the decrypted data can be encrypted using chaotic mapping to obtain the target transmission data; then the target transmission data is sent to the user. The embodiment of the present application protects the data during the transmission process to prevent criminals from intercepting the data during the data transmission process, thereby ensuring data security.

[0102] As a feasible implementation method, this embodiment provides a data security management system. Figure 2 FIG. 1 is a schematic diagram showing the structure of a data security management system provided by an embodiment of the present application. Figure 2 As shown, the data security management system 201 includes a data encryption module 202 , a data storage module 203 , a data decryption module 204 , a data transmission module 205 and a data monitoring module 206 .

[0103] The data encryption module 202 is used to obtain the data to be encrypted from the database, and encrypt the data to be encrypted using the HMAC encryption algorithm to obtain encrypted data;

[0104] As a feasible implementation, the data encryption module 202 in this embodiment may include a data acquisition unit, an iterative function unit, and a sequence conversion unit. The data acquisition unit is used to acquire the encrypted transmission data of the database, process the data of any length in the encrypted transmission data by message block, obtain information block data, and process the information block data to obtain byte message group data. The iterative function unit is used to use Logistic mapping and Chebyshev mapping as iterative functions of the HMAC data encryption algorithm; the sequence conversion unit is used to convert the bytes of the byte message group data into binary sequences to obtain binary data.

[0105] The data storage module 203 is used to transmit the encrypted data to a database for storage, and obtain real-time encrypted transmission data.

[0106] As a feasible implementation, this embodiment provides a specific structure of a data storage module 203 . Figure 3 FIG. 1 is a schematic diagram showing the structure of a data storage module provided by an embodiment of the present application. Figure 3 As shown, the data storage module 203 may specifically include the following units:

[0107] The parameter acquisition unit 2031 is used to acquire binary data and obtain the initial value and control parameters of the HMAC data encryption algorithm iteration;

[0108] A parameter adjustment unit 2032, used to adjust the number of iterations and the number of message blocks of binary data during data transmission using a logic processor to obtain decimal data;

[0109] The linear adjustment unit 2033 is used to output the data after iterative processing by the logic processor, intercept the binary data therein, and adjust the initial value after the linear shift;

[0110] The data interception unit 2034 is used to repeat the iterative process in the logic processor, obtain the message blocks after several rounds of iterations, and intercept the binary sequence in the output data;

[0111] The data calculation unit 2035 is used to calculate the two decimal numbers in the binary sequence, divide them into different cyclic shifts and finally output two groups of sequences to obtain encrypted transmission data.

[0112] The data decryption module 204 is used to decrypt the real-time encrypted transmission data to obtain decrypted data when receiving a data query demand for the real-time encrypted transmission data.

[0113] As a feasible implementation, the data decryption module 204 in this embodiment may include a data acquisition submodule, a request verification submodule and a data decryption submodule. The data acquisition submodule is used to obtain the data query requirements of the real-time encrypted transmission data, and the data query requirements at least include the data query content, the data query format and the query time range. The request verification submodule is used to request verification of the data query requirements, and the request verification at least includes whether the data query is legal and whether the user has the corresponding query authority; the data decryption submodule is used to decrypt the real-time encrypted transmission data if the request verification is passed to obtain the decrypted data.

[0114] The data transmission module 205 is used to perform transmission protection on the decrypted data by using Logistics mapping to obtain target transmission data.

[0115] As a feasible implementation, the data transmission module 205 in this embodiment may include a key acquisition submodule, a cyclic shift submodule, and a mixed operation submodule. The key acquisition submodule is used to convert the decrypted transmission data and the key used in the decryption module into a mapping parameter in a chaotic state according to the logic generator processing; the cyclic shift submodule is used to feed back the values ​​after iteration to the system, and the values ​​after the Logistic mapping iteration are entered into the logic generator and converted into the cyclic shift of the initial operation sequence; the mixed operation submodule is used to use the output data processed by the logic generator as the iterative initial value and control parameter of the two mappings after the mixed operation to obtain the target transmission data.

[0116] The data monitoring module 206 is used to monitor the query of the target transmission data, and if the data query demand does not meet the preset query requirement, the data query permission is released.

[0117] As a feasible implementation method, the data monitoring module 206 in this embodiment includes a data monitoring unit, an authority judgment unit, and a result notification unit. The data monitoring unit is used to monitor the query of the target transmission data, and the query requirements at least include the request format, request content, and request parameters; the authority judgment unit is used to release the data query authority if the data query requirements do not meet the preset query requirements, and continue to process the query request if the query requirements fully meet the preset requirements; the result notification unit is used to record the authority processing result after releasing the data query authority, and transmit the authority processing result to the mobile terminal of the manager.

[0118] This embodiment provides multi-level and multi-dimensional security protection measures to ensure the security of network data during transmission and storage. At the same time, the method also solves the speed and stability problems of data transmission and improves the efficiency and reliability of data transmission.

[0119] In order to solve the above technical problems, the present application also provides a data encryption device. Figure 4 The structure diagram of the data encryption device provided by the embodiment of the present application is shown. Figure 4 As shown, the device includes the following modules:

[0120] The acquisition module 401 is used to acquire the data to be encrypted and the shared key;

[0121] The processing module 402 is used to perform an XOR operation on the shared key and the internal filling value to obtain a first XOR result;

[0122] A splicing module 403 is used to splice the first XOR result with the data to be encrypted to obtain a first splicing result;

[0123] A calculation module 404 is used to perform a hash operation on the first concatenation result to obtain a first hash operation result;

[0124] The processing module 402 is further used to perform an XOR operation on the shared key and the external padding value to obtain a second XOR result;

[0125] The splicing module 403 is further used to splice the second XOR result with the first Hash operation result to obtain a second splicing result;

[0126] The operation module 404 is further used to perform a hash operation on the second concatenation result to obtain encrypted data.

[0127] In some embodiments, the acquisition module 401 is further used to:

[0128] generating a first random number;

[0129] The first random number is used as an iteration initial value, and the iteration initial value is processed based on a chaotic mapping iterative function to obtain function output data;

[0130] Based on the function output data, a shared key is determined.

[0131] In some embodiments, the acquisition module 401 is further used to:

[0132] Get the data length of the function output data;

[0133] When the data length exceeds the block length of the hash function, the function output data is determined as the shared key;

[0134] In the case where the data length does not exceed the block length of the hash function, generating a second random number of a preset length; the sum of the data length and the preset length is greater than the block length of the hash function;

[0135] The second random number is filled into the tail of the function output data to obtain the shared key.

[0136] In some embodiments, the acquisition module 401 is further used to:

[0137] Get the decimal data to be encrypted;

[0138] The encrypted decimal data is processed into blocks to obtain information block data;

[0139] Perform byte division processing on the information block data to obtain byte message group data;

[0140] The byte message group data is converted into a binary sequence to obtain binary data to be encrypted.

[0141] In some embodiments, the data encryption device further includes:

[0142] A verification module, configured to, after performing a hash operation on the second concatenation result to obtain encrypted data, verify the data query request upon receiving a data query request from a user to obtain a verification result;

[0143] The decryption module is used to decrypt the encrypted data to obtain the decrypted data when the verification result indicates that the user has the query authority and the data query request meets the preset conditions;

[0144] The sending module is used to send the decrypted data to the user.

[0145] In some embodiments, the sending module is specifically used to encrypt the decrypted data using a chaotic map to obtain target transmission data;

[0146] Send the target transmission data to the user.

[0147] In some embodiments, the preset conditions include that the request format, request content, and request parameters of the data query request meet preset standards;

[0148] In some embodiments, the processing module 402 is also used to verify the data query request of the user when receiving the data query request to obtain the verification result, and cancel the user's query permission when the verification result indicates that the user has the query permission but the data query request does not meet the preset conditions.

[0149] The device provided in the embodiment of the present application is the same as the method in the above embodiment, so both have the same embodiments and beneficial effects, which will not be repeated here.

[0150] Figure 5 The hardware structure diagram of the data encryption device provided by the embodiment of the present application is shown. Figure 5 As shown, the data encryption device may include a processor 501 and a memory 502 storing computer program instructions.

[0151] Specifically, the processor 501 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0152] The memory 502 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 502 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive or a combination of two or more of these. In appropriate cases, the memory 502 may include a removable or non-removable (or fixed) medium. In appropriate cases, the memory 502 may be inside or outside the integrated gateway disaster recovery device. In a specific embodiment, the memory 502 is a non-volatile solid-state memory.

[0153] The memory 502 may include a read-only memory (ROM), a random access memory (RAM), a magnetic disk storage medium device, an optical storage medium device, a flash memory device, an electrical, optical or other physical / tangible memory storage device. Therefore, generally, the memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to one aspect of the present disclosure.

[0154] The processor 501 implements any one of the data encryption methods in the above embodiments by reading and executing computer program instructions stored in the memory 502 .

[0155] In one example, the data encryption device may further include a communication interface 503 and a bus 504. The processor 501, the memory 502, and the communication interface 503 are connected via the bus 504 and communicate with each other.

[0156] The communication interface 503 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.

[0157] The bus 504 includes hardware, software or both, coupling the components of the data encryption device to each other. For example, but not limitation, the bus may include an Accelerate Graphical Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an InfiniBand interconnect, a Low Pin Count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VLB) bus or other suitable buses or a combination of two or more of these. Where appropriate, the bus 504 may include one or more buses. Although embodiments of the present application describe and illustrate a particular bus, the present application contemplates any suitable bus or interconnect.

[0158] In addition, in combination with the data encryption method in the above embodiment, the embodiment of the present application can provide a computer storage medium for implementation. The computer storage medium stores computer program instructions; when the computer program instructions are executed by a processor, any one of the data encryption methods in the above embodiment is implemented.

[0159] An embodiment of the present application also provides a computer program product, including a computer program, which implements any one of the data encryption methods in the above embodiments when the computer program is processed and executed.

[0160] It should be clear that the present application is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application.

[0161] The functional blocks shown in the block diagram above can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an ASIC, appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present application are programs or code segments used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link by a data signal carried in a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (Erasable ROM, EROM), floppy disks, compact disc read-only memory (Compact Disc Read-Only Memory, CD-ROM), optical discs, hard disks, optical fiber media, radio frequency (Radio Frequency, RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0162] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiment, or in a different order from the embodiment, or several steps can be performed simultaneously.

[0163] The above reference is to a data encryption method, device, equipment and medium according to the embodiment of the present disclosure. The flowchart and / or block diagram of the medium describe various aspects of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine so that these instructions executed by the processor of the computer or other programmable data processing device enable the implementation of the function / action specified in one or more boxes of the flowchart and / or block diagram. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field programmable logic circuit. It can also be understood that each box in the block diagram and / or flowchart and the combination of boxes in the block diagram and / or flowchart can also be implemented by dedicated hardware that performs a specified function or action, or can be implemented by a combination of dedicated hardware and computer instructions.

[0164] The above contents are only specific implementation methods of the present application. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in the present application, and these modifications or replacements should be included in the protection scope of the present application.

Claims

1. A data encryption method, characterized in that: include: Obtain the data to be encrypted and the shared key; Performing an XOR operation on the shared key and the internal filling value to obtain a first XOR result; Concatenate the first XOR result with the data to be encrypted to obtain a first concatenation result; Performing a hash operation on the first concatenation result to obtain a first hash operation result; Performing an XOR operation on the shared key and the external padding value to obtain a second XOR result; Concatenate the second XOR result with the first Hash operation result to obtain a second concatenation result; A hash operation is performed on the second concatenation result to obtain encrypted data.

2. The data encryption method according to claim 1, characterized in that: The obtaining of the shared key comprises: generating a first random number; Taking the first random number as an iteration initial value, processing the iteration initial value based on a chaotic mapping iterative function to obtain function output data; Based on the function output data, the shared key is determined.

3. The data encryption method according to claim 2, characterized in that: The determining the shared key based on the function output data comprises: Obtain the data length of the output data of the function; In a case where the data length exceeds the block length of the hash function, determining the function output data as the shared key; In the case where the data length does not exceed the block length of the hash function, generating a second random number of a preset length; the sum of the data length and the preset length is greater than the block length of the hash function; The second random number is filled into the tail of the function output data to obtain the shared key.

4. The data encryption method according to claim 1, characterized in that: The step of obtaining the data to be encrypted comprises: Get the decimal data to be encrypted; The decimal data to be encrypted is processed in blocks to obtain information block data; Performing byte division processing on the information block data to obtain byte message group data; The byte message group data is converted into a binary sequence to obtain the binary data to be encrypted.

5. The data encryption method according to any one of claims 1 to 4, characterized in that: After performing a hash operation on the second concatenation result to obtain encrypted data, the method further includes: Upon receiving a data query request from a user, verifying the data query request to obtain a verification result; When the verification result indicates that the user has the query authority and the data query request meets the preset conditions, decrypting the encrypted data to obtain decrypted data; The decrypted data is sent to the user.

6. The data encryption method according to claim 5, characterized in that: The sending the decrypted data to the user comprises: Encrypting the decrypted data using chaotic mapping to obtain target transmission data; The target transmission data is sent to the user.

7. The data encryption method according to claim 5, characterized in that: The preset conditions include that the request format, request content and request parameters of the data query request meet the preset standards; In the case of receiving the data query request from the user, after verifying the data query request to obtain a verification result, the method further includes: If the verification result indicates that the user has the query authority, but the data query request does not meet the preset condition, the query authority of the user is cancelled.

8. A data encryption device, characterized in that: include: An acquisition module, used to acquire the data to be encrypted and the shared key; A processing module, configured to perform an XOR operation on the shared key and an internal filling value to obtain a first XOR result; A splicing module, used for splicing the first XOR result with the data to be encrypted to obtain a first splicing result; A computing module, configured to perform a hash operation on the first concatenation result to obtain a first hash operation result; The processing module is further used to perform an XOR operation on the shared key and the external padding value to obtain a second XOR result; The splicing module is further used to splice the second XOR result with the first Hash operation result to obtain a second splicing result; The operation module is further used to perform a hash operation on the second splicing result to obtain encrypted data.

9. A data encryption device, characterized in that: include: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, the data encryption method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, and when the computer program instructions are executed by a processor, the data encryption method according to any one of claims 1 to 7 is implemented.

Images