Data hierarchical encryption method and device, equipment and medium

Abstract

The embodiment of the invention provides a data hierarchical encryption method and device, equipment and a medium. The method comprises the following steps: acquiring target data and a use scene of the target data; determining a security level and an opening level of the target data; the security level represents the importance of the data; the open level represents the exposure risk of the data; determining an encryption round number according to the security level and the opening level of the target data; determining at least one target encryption algorithm; and performing hierarchical encryption on the target data according to the encryption round number and at least one target encryption algorithm to obtain encrypted data. According to the embodiment of the invention, the security level and the openness level of the target data are determined by analyzing the target data and the use scene thereof, and the encryption round number is determined accordingly. And performing hierarchical encryption on the data in combination with at least one target encryption algorithm. According to the technical scheme, a personalized encryption scheme can be provided according to the characteristics and requirements of different data, the encryption and decryption performance and safety of the data are effectively improved, and the encryption efficiency is optimized while sensitive information is fully protected.

Description

Technical Field

[0001] The present invention relates to the field of encryption technology, and in particular to a data hierarchical encryption method and a data hierarchical encryption device. Background Art

[0002] In a cloud computing environment, servers store a large amount of user data. To ensure data security, a unified symmetric encryption algorithm is usually used to encrypt the data before saving it to a storage medium. However, with the explosive growth of user data and the substantial increase in access frequency, the decryption operation has brought a heavy performance burden to the server. Although the unified encryption algorithm can ensure security, its high computing resource consumption makes it difficult to meet the efficiency requirements of users. Faced with massive data and frequent access, the existing encryption methods have gradually become performance bottlenecks, affecting the system's response speed and service quality. Therefore, a more efficient encryption solution is urgently needed to optimize decryption performance and reduce computing resource consumption while ensuring data security, in order to cope with the growing data processing needs and improve user experience and overall system performance. Summary of the invention

[0003] In view of the above problems, embodiments of the present invention are proposed to provide a data hierarchical encryption method and a corresponding data hierarchical encryption device that overcome the above problems or at least partially solve the above problems.

[0004] According to a first aspect of an embodiment of the present invention, a data hierarchical encryption method is provided, the method comprising:

[0005] Acquire target data and usage scenarios of the target data;

[0006] Determine the security level and exposure level of the target data; the security level represents the importance of the target data; the exposure level represents the exposure risk of the target data in the usage scenario;

[0007] Determining the number of encryption rounds according to the security level and exposure level of the target data;

[0008] Determining at least one target encryption algorithm from a plurality of preset encryption algorithms;

[0009] The target data is hierarchically encrypted according to the number of encryption rounds and at least one target encryption algorithm to obtain encrypted data.

[0010] Optionally, determining the number of encryption rounds according to the security level and exposure level of the target data includes:

[0011] Obtaining a mapping relationship table; the mapping relationship table represents the relationship between the security level and exposure level of the target data and the number of encryption rounds;

[0012] The number of encryption rounds of the target data is determined according to the mapping relationship table, the security level and the exposure level of the target data.

[0013] Optionally, the method further includes:

[0014] When the usage scenario of the target data changes, re-determine the exposure level of the target data;

[0015] Re-determining the number of encryption rounds of the target data according to the mapping table, the security level of the target data and the re-determined exposure level;

[0016] When the re-determined number of encryption rounds is unchanged relative to the original number of encryption rounds, determining that the encrypted data is applicable to the changed usage scenario;

[0017] When the re-determined number of encryption rounds changes relative to the original number of encryption rounds, determining that the encrypted data is not suitable for the changed usage scenario; determining a round number difference between the re-determined number of encryption rounds and the original number of encryption rounds; and encrypting or decrypting the encrypted data according to the round number difference.

[0018] Optionally, determining a difference between the re-determined number of encryption rounds and the original number of encryption rounds includes:

[0019] When the difference is greater than zero, the target data is encrypted according to the difference; when the difference is less than zero, the target data is decrypted according to the difference.

[0020] Optionally, the method further includes:

[0021] After the encrypted data is decrypted, determining the number of remaining decryption rounds of the encrypted data;

[0022] Generate a cache file of the encrypted data for the remaining number of decryption rounds, and configure an exposure time corresponding to the cache file; the exposure time represents a time allowed to decrypt the cache file;

[0023] When the cache file of the encrypted data is not decrypted within the exposure time, the cache file of the encrypted data is deleted.

[0024] Optionally, performing hierarchical encryption on the target data according to the number of encryption rounds and at least one target encryption algorithm to obtain encrypted data includes:

[0025] According to the number of encryption rounds and at least one target encryption algorithm, the target data is hierarchically encrypted to obtain encrypted data content;

[0026] Using the target encryption algorithm and the number of encryption rounds as an information header;

[0027] The information header and the encrypted data content are combined to obtain encrypted data.

[0028] Optionally, also include:

[0029] Determine the encrypted version information symbol, the random symmetric key and the digest through the encrypted data content;

[0030] The encrypted version information symbol, the random symmetric key and the digest are added to the information header.

[0031] According to a second aspect of an embodiment of the present invention, a data hierarchical encryption device is provided, the device comprising:

[0032] A first acquisition module, used to acquire target data and a usage scenario of the target data;

[0033] A first determination module is used to determine the security level and exposure level of the target data; the security level represents the importance of the target data; the exposure level represents the exposure risk of the target data in the usage scenario;

[0034] A second determination module, configured to determine the number of encryption rounds according to the security level and exposure level of the target data;

[0035] A third determination module, used to determine at least one target encryption algorithm from a plurality of preset encryption algorithms;

[0036] The first encryption module is used to perform hierarchical encryption on the target data according to the number of encryption rounds and at least one target encryption algorithm to obtain encrypted data.

[0037] Optionally, the second determining module includes:

[0038] A first acquisition submodule is used to acquire a mapping relationship table; the mapping relationship table represents the relationship between the security level and exposure level of the target data and the number of encryption rounds;

[0039] The first determination submodule is used to determine the number of encryption rounds of the target data according to the mapping relationship table, the security level and the exposure level of the target data.

[0040] Optionally, the device further comprises:

[0041] A third determination module, configured to re-determine the exposure level of the target data when the usage scenario of the target data changes;

[0042] a fourth determination module, configured to redetermine the number of encryption rounds of the target data according to the mapping table, the security level of the target data and the redetermined exposure level;

[0043] A fifth determination module, configured to determine that the encrypted data is applicable to a changed usage scenario when the re-determined number of encryption rounds is unchanged relative to the original number of encryption rounds;

[0044] The sixth determination module is used to determine that the encrypted data is not suitable for the changed usage scenario when the re-determined number of encryption rounds changes relative to the original number of encryption rounds; determine the difference between the re-determined number of encryption rounds and the original number of encryption rounds; and encrypt or decrypt the encrypted data according to the difference in the number of rounds.

[0045] Optionally, the sixth determining module includes:

[0046] The first encryption submodule is used to encrypt the target data according to the difference when the difference is greater than zero; and to decrypt the target data according to the difference when the difference is less than zero.

[0047] Optionally, the device further comprises:

[0048] a seventh determination module, configured to determine the remaining number of decryption rounds of the encrypted data after the encrypted data is decrypted;

[0049] A first configuration module is used to generate a cache file of the encrypted data of the remaining number of decryption rounds, and configure an exposure time corresponding to the cache file; the exposure time represents a time allowed to decrypt the cache file;

[0050] The first deleting module is used to delete the cache file of the encrypted data if the cache file of the encrypted data is not decrypted within the exposure time.

[0051] Optionally, the first encryption module includes:

[0052] A second encryption submodule, configured to perform hierarchical encryption on the target data according to the number of encryption rounds and at least one target encryption algorithm to obtain encrypted data content;

[0053] The first is a submodule, used to use the target encryption algorithm and the number of encryption rounds as an information header;

[0054] The first merging submodule is used to merge the information header and the encrypted data content to obtain encrypted data.

[0055] Optionally, the first encryption module further includes:

[0056] A second determination submodule, used to determine the encryption version information symbol, the random symmetric key and the digest according to the encrypted data content;

[0057] The first adding submodule is used to add the encrypted version information symbol, the random symmetric key and the summary to the information header.

[0058] According to a third aspect of the present invention, there is provided an electronic device comprising: a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program implements the steps of the data hierarchical encryption method as described in any one of the above items when executed by the processor.

[0059] According to a fourth aspect of the present invention, there is provided a computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of the data hierarchical encryption method as described in any one of the above items.

[0060] The technical solution provided by the embodiments of the present invention may have the following beneficial effects:

[0061] The embodiment of the present invention provides a data hierarchical encryption method, which obtains target data and the usage scenario of the target data; determines the security level and exposure level of the target data; the security level represents the importance of the data; the exposure level represents the exposure risk of the data; determines the number of encryption rounds according to the security level and exposure level of the target data; determines at least one target encryption algorithm; and hierarchically encrypts the target data according to the number of encryption rounds and at least one target encryption algorithm to obtain encrypted data. The embodiment of the present invention determines the security level and exposure level of the target data by analyzing the target data and its usage scenario, and determines the number of encryption rounds accordingly. The data is hierarchically encrypted in combination with at least one target encryption algorithm. It can provide personalized encryption schemes according to the characteristics and needs of different data, effectively improve the encryption and decryption performance and security of the data, ensure that sensitive information is fully protected, and optimize encryption efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 It is a flowchart of a data hierarchical encryption method provided by an embodiment of the present invention;

[0063] Figure 2 is a structural block diagram of a mapping relationship provided by an embodiment of the present invention;

[0064] Figure 3 It is a structural block diagram of a data hierarchical encryption device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0065] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0066] One of the core concepts of the embodiments of the present invention is that the embodiments of the present invention analyze the target data and its usage scenarios to determine its security level and exposure level, and determine the number of encryption rounds accordingly. The data is hierarchically encrypted in combination with at least one target encryption algorithm. It is possible to provide personalized encryption solutions based on the characteristics and needs of different data, effectively improve the encryption and decryption performance and security of the data, ensure that sensitive information is fully protected, and optimize encryption efficiency.

[0067] Reference Figure 1 , shows a flowchart of a data hierarchical encryption method provided by an embodiment of the present invention, and the method may specifically include the following steps:

[0068] Step 101, obtaining target data and usage scenarios of the target data;

[0069] Different data types and service scenarios have significantly different security requirements. For example, financial transaction data requires extremely high security, while general log files may only require basic protection. Understanding the usage scenarios of the data can help the system identify which data is most sensitive and which data can run at a lower level of encryption, thereby avoiding the waste of resources caused by a "one-size-fits-all" encryption solution. The purpose of obtaining the target data and its usage scenarios is to comprehensively assess the importance and exposure risks of the data, so as to accurately determine the security level and exposure level. Based on these evaluation results, the system can reasonably set the number of encryption rounds, select the most suitable encryption algorithm, and implement hierarchical encryption.

[0070] Step 102, determining the security level and exposure level of the target data; the security level represents the importance of the target data; the exposure level represents the exposure risk of the target data in the usage scenario;

[0071] The security level reflects the sensitivity of the target data and its importance to the business. For example, critical data such as financial transaction records and personal privacy information require the highest level of protection, while general log files or public information can accept lower levels of encryption. By classifying the data, it is possible to clearly identify which data is the most critical and must be encrypted with high-intensity measures, and which data can use lighter encryption methods while ensuring basic security. This not only improves the effectiveness of encryption, but also optimizes the allocation of computing resources and reduces unnecessary performance overhead.

[0072] The exposure level characterizes the exposure risk of data in a specific usage scenario, that is, the possibility of unauthorized access or leakage of data. The exposure risk of data varies significantly in different usage scenarios. For example, data transmitted in a public network environment faces a higher risk than data in an internal closed network. By evaluating the exposure level, the encryption strength and number of rounds can be adjusted in a targeted manner to ensure that high-risk data is fully protected while reducing the encryption cost of low-risk data. In addition, the exposure level can also help identify potential security vulnerabilities, take preventive measures in advance, and reduce the risk of data leakage.

[0073] Step 103, determining the number of encryption rounds according to the security level and exposure level of the target data;

[0074] The number of encryption rounds refers to a series of encryption operations used in an encryption algorithm. More encryption rounds will increase the difficulty of cracking, and also require more computing resources and time. The number of encryption rounds includes: initial round, normal round and final round. The initial round is the first round operation in the block encryption algorithm. Generally, only simple processing is performed on the input data to increase the complexity and randomness of the data. The normal round is also called the repeated round. It performs multiple repeated operations on the input data, generally including byte substitution, row shift, column confusion and round key addition. The final round is the last round operation in the block encryption algorithm, which is generally a simplification of the normal round operation.

[0075] Data with a high security level requires stronger protection measures, while data with a high exposure level faces greater risks. Therefore, for data with a high security level and a high exposure level, the number of encryption rounds needs to be increased to improve encryption strength and prevent data from being stolen or tampered with. On the contrary, for data with a low security level and a low exposure level, the number of encryption rounds can be reduced to improve encryption efficiency and reduce the consumption of computing resources. By determining the number of encryption rounds based on the security level and exposure level of the target data, personalized configuration of data encryption can be achieved to ensure the security and reliability of data in different usage scenarios. This flexible encryption strategy not only improves the effect of data protection, but also optimizes the utilization of encryption resources and maximizes cost-effectiveness.

[0076] Step 104, determining at least one target encryption algorithm from a plurality of preset encryption algorithms;

[0077] Determine at least one target encryption algorithm from a variety of preset encryption algorithms. You can choose a public mature block encryption algorithm according to business needs, such as the Triple Data Encryption Standard algorithm, the Advanced Encryption Standard algorithm, the International Data Encryption Algorithm, the Symmetric Key Block Encryption Algorithm, the National Secret Algorithm 4, etc. You can also use a private block encryption algorithm designed by the user. In addition, you can also use a variety of different block encryption algorithms for mixed encryption according to business needs to improve encryption effect and security.

[0078] Public mature block encryption algorithms have been widely verified and applied, with high security and reliability, and are suitable for most business scenarios. User-designed private block encryption algorithms can be customized according to specific needs, providing higher flexibility and security. Hybrid encryption combines the advantages of multiple encryption algorithms and further improves data security and reliability through multi-level encryption protection. By determining at least one target encryption algorithm from a variety of preset encryption algorithms and selecting an appropriate encryption strategy based on business needs, the security and reliability of data in different usage scenarios can be ensured. This flexible encryption strategy not only improves the effect of data protection, but also optimizes the utilization of encryption resources and maximizes cost-effectiveness.

[0079] Step 105: hierarchically encrypt the target data according to the number of encryption rounds and at least one target encryption algorithm to obtain encrypted data.

[0080] The number of encryption rounds determines the strength of encryption. The more rounds, the higher the encryption strength, but the more computing resources are consumed. The choice of target encryption algorithm depends on business needs and data characteristics. It can also be customized according to specific needs through user-designed private encryption algorithms, providing higher flexibility and security. By hierarchically encrypting the target data according to the number of encryption rounds and at least one target encryption algorithm, personalized configuration of data encryption can be achieved to ensure the security and reliability of data in different usage scenarios. This flexible encryption strategy not only improves the effect of data protection, but also optimizes the use of encryption resources and maximizes cost-effectiveness.

[0081] Reference Figure 2 , shows a structural block diagram of a mapping relationship provided by an embodiment of the present invention.

[0082] In one embodiment, determining the number of encryption rounds based on the security level and exposure level of the target data includes: obtaining a mapping relationship table; the mapping relationship table represents the relationship between the security level and exposure level of the target data and the number of encryption rounds; and determining the number of encryption rounds of the target data based on the mapping relationship table, the security level and exposure level of the target data.

[0083] Data security levels are divided according to the importance of the data and the degree of harm after being destroyed (attacked, leaked, tampered, etc.). In practice, data can generally be divided into four security levels: core data, important data, general data, and public data, to avoid complexity and arbitrariness and facilitate data evaluation and management. At the same time, users can divide data according to the data security level standards of the industry they are engaged in, or add more fine-grained data security levels based on business-specific data, compliance requirements or other business needs.

[0084] For example, the financial industry's "Financial Data Security Data Security Grading Guidelines" standard will divide data security levels from high to low into 5, 4, 3, 2, and 1, based on the affected objects and the degree of impact after the data security of financial institutions is compromised; Level 5 involves data that affects national security, Level 4 is the highest level of data for ordinary financial institutions, and levels 3 and above can be identified as important data / sensitive data in the public's cognition, Level 2 is commonly used data for internal offices of enterprises and institutions, and Level 1 is basically publicly available data.

[0085] Data exposure levels can be divided according to the risks exposed in different data usage scenarios. Data exposure can be simply divided into three levels according to data storage and access scenarios: data storage exposure, external access exposure, and internal access exposure. At the same time, users can control the exposure duration of data in business scenarios to reduce risk exposure; they can also divide data exposure levels into more fine-grained levels according to specific business usage scenarios.

[0086] According to the data security level and data exposure level, an encryption round number matrix table that meets the business requirements for data encryption strength can be formulated. Of course, other forms of mapping relationship tables can also be used. Among them, public data generally does not need to be encrypted directly; for core data, all exposures are generally fully encrypted, that is, the standard encryption rounds of the block encryption algorithm are used; for important data and general data, the encryption algorithm is simplified and a custom encryption round number is used. The same encryption round number can be used for different data security levels and data exposure levels. The data encryption round number matrix information can be stored in the database and can be dynamically adjusted according to business needs. After the adjustment, it can take effect immediately for the newly added data. At the same time, when adjusting, the difference between the new and old data encryption round number matrix information can be compared, and all encrypted data that need to adjust the encryption round number can be traversed to update the data encryption. In addition, the data encryption round number matrix information can be loaded into the memory for caching during use to improve access efficiency.

[0087] The mapping table provides the corresponding relationship between the security level, exposure level and the number of encryption rounds. By querying the mapping table, you can quickly determine the appropriate number of encryption rounds to achieve the best encryption effect. This method of determining the number of encryption rounds based on the mapping table not only improves the flexibility and accuracy of the encryption strategy, but also ensures the security and reliability of data in different usage scenarios.

[0088] In one embodiment, the method also includes: when the usage scenario of the target data changes, redetermining the exposure level of the target data; redetermining the number of encryption rounds of the target data based on the mapping table, the security level of the target data and the redetermined exposure level; when the redetermined number of encryption rounds is unchanged relative to the original number of encryption rounds, determining that the encrypted data is suitable for the changed usage scenario; when the redetermined number of encryption rounds changes relative to the original number of encryption rounds, determining that the encrypted data is not suitable for the changed usage scenario; determining the difference in the number of rounds between the redetermined number of encryption rounds and the original number of encryption rounds; and encrypting or decrypting the encrypted data based on the difference in the number of rounds.

[0089] Changes in usage scenarios may cause changes in data exposure risks, so it is necessary to re-evaluate the exposure level and determine the appropriate number of encryption rounds based on the new exposure level. When the re-determined number of encryption rounds increases, additional encryption operations are required on the encrypted data to increase the encryption strength and prevent the data from being stolen or tampered with. When the re-determined number of encryption rounds decreases, the encrypted data needs to be decrypted to reduce the encryption strength, improve encryption efficiency, and reduce the consumption of computing resources. By redetermining the exposure level and the number of encryption rounds according to changes in usage scenarios, and encrypting or decrypting the encrypted data according to the difference in the number of rounds, dynamic adjustment of data encryption can be achieved to ensure the security and reliability of data in different usage scenarios. This flexible encryption strategy not only improves the effect of data protection, but also optimizes the utilization of encryption resources and maximizes cost-effectiveness.

[0090] In one embodiment, determining the difference between the re-determined number of encryption rounds and the original number of encryption rounds includes: when the difference is greater than zero, encrypting the target data according to the difference; when the difference is less than zero, decrypting the target data according to the difference.

[0091] When the difference is greater than zero, it means that the number of encryption rounds needs to be increased and additional encryption operations need to be performed on the target data to improve the encryption strength and prevent the data from being stolen or tampered with. When the difference is less than zero, it means that the number of encryption rounds needs to be reduced and decryption operations need to be performed on the target data to reduce the encryption strength, improve encryption efficiency, and reduce the consumption of computing resources. In different block encryption algorithms, the role of the final round may be different. Only the number of encryption rounds for the repeated rounds can be adjusted, while the final round can be retained. This flexible encryption strategy not only improves the effect of data protection, but also optimizes the utilization of encryption resources and maximizes cost-effectiveness. By encrypting or decrypting the target data according to the difference, dynamic adjustment of data encryption can be achieved to ensure the security and reliability of data in different usage scenarios.

[0092] In one embodiment, the method further includes: after the encrypted data is decrypted, determining the remaining number of decryption rounds of the encrypted data; generating a cache file of the encrypted data for the remaining number of decryption rounds, and configuring an exposure time corresponding to the cache file; the exposure time represents the time allowed for decryption of the cache file; when the cache file of the encrypted data is not decrypted within the exposure time, deleting the cache file of the encrypted data.

[0093] By determining the number of remaining decryption rounds, you can evaluate the decryption strength of the encrypted data and ensure the security and reliability of the data after decryption. By generating a cache file and configuring the exposure time, you can limit the decryption time of the cache file to prevent the data from being exposed to risks for a long time after decryption. If the cache file is not decrypted within the exposure time, the cache file is deleted to ensure the security and reliability of the data. This flexible decryption strategy not only improves the effectiveness of data protection, but also optimizes the use of decryption resources and maximizes cost-effectiveness. By configuring the exposure time and deleting undecrypted cache files, you can ensure the security and reliability of the data after decryption and prevent the data from being illegally accessed or tampered with.

[0094] For example, file A is important data of a certain user. When the file is stored, it is encrypted with 10 rounds of advanced encryption standard algorithm to ensure the confidentiality of the file when it is leaked. When the file is authorized to 10 users for external network access, each user must go through a complete standard advanced encryption standard algorithm decryption when accessing the file, and a total of 100 rounds of decryption operations are required for the encrypted file. Using the hierarchical encryption scheme of this scheme, when the first user accesses the file, 4 rounds of decryption operations can be performed on the original encrypted file to generate a cache file with 6 rounds of encryption, and the timeout deletion time of the cache file is set to 5 minutes, then the risk exposure time of the cache file is 5 minutes. When subsequent users access the encrypted file within 5 minutes, 6 rounds of decryption operations can be directly performed on the cache file to obtain the file plaintext, so that the access of 10 users to the file requires a total of 64 rounds of decryption operations. When the file is authorized to be accessed by internal users, the number of encryption rounds of the cache file can be adjusted to 3 rounds, and the access of 10 users to the file requires a total of 37 rounds of decryption operations. By comparison, it can be found that the hierarchical encryption scheme of the present invention can provide security protection for data in different scenarios while effectively improving data decryption performance.

[0095] In one embodiment, the target data is hierarchically encrypted according to the number of encryption rounds and at least one target encryption algorithm to obtain encrypted data, including: according to the number of encryption rounds and at least one target encryption algorithm, the target data is hierarchically encrypted to obtain encrypted data content; the target encryption algorithm and the number of encryption rounds are used as an information header; the information header and the encrypted data content are combined to obtain encrypted data.

[0096] The number of encryption rounds determines the strength of encryption. The more rounds, the higher the encryption strength, but the greater the computing resource consumption. The choice of the target encryption algorithm depends on business needs and data characteristics. By using the target encryption algorithm and the number of encryption rounds as the information header, subsequent decryption operations can be facilitated to ensure the accuracy and consistency of the decryption process. The information header contains key information of the encrypted data, such as the encryption algorithm and the number of encryption rounds. When decrypting, the decryption strategy can be quickly determined based on the information header to improve decryption efficiency and security. When the number of encryption rounds and the target encryption algorithm need to be changed, the information header and encrypted data of the encrypted data are updated accordingly.

[0097] In one embodiment, the encrypted version information symbol, the random symmetric key and the digest are determined by the encrypted data content; and the encrypted version information symbol, the random symmetric key and the digest are added to the information header.

[0098] The encryption version information symbol can be used to detect encrypted data. According to the encryption version information symbol of the information header, it can be judged whether the data is encrypted through hierarchical encryption; the random symmetric key is an encryption key randomly generated for each data. The data can be asymmetrically encrypted through the random symmetric key to achieve the separation of independent keys for each data and data encryption and decryption permissions. The summary contains a one-way hash value of the data, which is used to detect the integrity of the data. The one-way hash value will change when the data is destroyed or modified.

[0099] The key information of the encrypted data is provided through the information header so that the decryption strategy can be quickly determined during the decryption process to ensure the accuracy and consistency of the decryption process. The encryption version information symbol, random symmetric key and summary are determined by the encrypted data content, and these information are added to the information header, which can further improve the security and reliability of the encrypted data. According to the number of encryption rounds and at least one target encryption algorithm, the target data is hierarchically encrypted, and the target encryption algorithm and the number of encryption rounds are used as the information header. The information header and the encrypted data content are merged to obtain the encrypted data, and the encryption version information symbol, random symmetric key and summary are determined by the encrypted data content. These information are added to the information header, which not only improves the effect of data protection, but also optimizes the utilization of encryption resources and maximizes cost-effectiveness.

[0100] The embodiment of the present invention provides a data hierarchical encryption method, which obtains target data and the usage scenario of the target data; determines the security level and exposure level of the target data; the security level represents the importance of the data; the exposure level represents the exposure risk of the data; determines the number of encryption rounds according to the security level and exposure level of the target data; determines at least one target encryption algorithm; and hierarchically encrypts the target data according to the number of encryption rounds and at least one target encryption algorithm to obtain encrypted data. The embodiment of the present invention determines the security level and exposure level of the target data by analyzing the target data and its usage scenario, and determines the number of encryption rounds accordingly. The data is hierarchically encrypted in combination with at least one target encryption algorithm. It can provide personalized encryption schemes according to the characteristics and needs of different data, effectively improve the encryption and decryption performance and security of the data, ensure that sensitive information is fully protected, and optimize encryption efficiency.

[0101] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0102] Reference Figure 3 , shows a structural block diagram of a data hierarchical encryption device provided by an embodiment of the present invention, which may specifically include the following modules:

[0103] A first acquisition module 301 is used to acquire target data and a usage scenario of the target data;

[0104] A first determination module 302 is used to determine the security level and exposure level of the target data; the security level represents the importance of the target data; the exposure level represents the exposure risk of the target data in the usage scenario;

[0105] A second determination module 303, configured to determine the number of encryption rounds according to the security level and exposure level of the target data;

[0106] A third determination module 304 is used to determine at least one target encryption algorithm from a plurality of preset encryption algorithms;

[0107] The first encryption module 305 is used to perform hierarchical encryption on the target data according to the number of encryption rounds and at least one target encryption algorithm to obtain encrypted data.

[0108] Optionally, the second determining module includes:

[0109] A first acquisition submodule is used to acquire a mapping relationship table; the mapping relationship table represents the relationship between the security level and exposure level of the target data and the number of encryption rounds;

[0110] The first determination submodule is used to determine the number of encryption rounds of the target data according to the mapping relationship table, the security level and the exposure level of the target data.

[0111] Optionally, the device further comprises:

[0112] A third determination module, configured to re-determine the exposure level of the target data when the usage scenario of the target data changes;

[0113] a fourth determination module, configured to redetermine the number of encryption rounds of the target data according to the mapping table, the security level of the target data and the redetermined exposure level;

[0114] A fifth determination module, configured to determine that the encrypted data is applicable to a changed usage scenario when the re-determined number of encryption rounds is unchanged relative to the original number of encryption rounds;

[0115] The sixth determination module is used to determine that the encrypted data is not suitable for the changed usage scenario when the re-determined number of encryption rounds changes relative to the original number of encryption rounds; determine the difference between the re-determined number of encryption rounds and the original number of encryption rounds; and encrypt or decrypt the encrypted data according to the difference in the number of rounds.

[0116] Optionally, the sixth determining module includes:

[0117] The first encryption submodule is used to encrypt the target data according to the difference when the difference is greater than zero; and to decrypt the target data according to the difference when the difference is less than zero.

[0118] Optionally, the device further comprises:

[0119] a seventh determination module, configured to determine the remaining number of decryption rounds of the encrypted data after the encrypted data is decrypted;

[0120] A first configuration module is used to generate a cache file of the encrypted data of the remaining number of decryption rounds, and configure an exposure time corresponding to the cache file; the exposure time represents a time allowed to decrypt the cache file;

[0121] The first deleting module is used to delete the cache file of the encrypted data if the cache file of the encrypted data is not decrypted within the exposure time.

[0122] Optionally, the first encryption module includes:

[0123] A second encryption submodule, configured to perform hierarchical encryption on the target data according to the number of encryption rounds and at least one target encryption algorithm to obtain encrypted data content;

[0124] The first is a submodule, used to use the target encryption algorithm and the number of encryption rounds as an information header;

[0125] The first merging submodule is used to merge the information header and the encrypted data content to obtain encrypted data.

[0126] Optionally, the first encryption module further includes:

[0127] A second determination submodule, used to determine the encryption version information symbol, the random symmetric key and the digest according to the encrypted data content;

[0128] The first adding submodule is used to add the encrypted version information symbol, the random symmetric key and the summary to the information header.

[0129] The embodiment of the present invention provides a data hierarchical encryption method, which obtains target data and the usage scenario of the target data; determines the security level and exposure level of the target data; the security level represents the importance of the data; the exposure level represents the exposure risk of the data; determines the number of encryption rounds according to the security level and exposure level of the target data; determines at least one target encryption algorithm; and hierarchically encrypts the target data according to the number of encryption rounds and at least one target encryption algorithm to obtain encrypted data. The embodiment of the present invention determines the security level and exposure level of the target data by analyzing the target data and its usage scenario, and determines the number of encryption rounds accordingly. The data is hierarchically encrypted in combination with at least one target encryption algorithm. It can provide personalized encryption schemes according to the characteristics and needs of different data, effectively improve the encryption and decryption performance and security of the data, ensure that sensitive information is fully protected, and optimize encryption efficiency.

[0130] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0131] An embodiment of the present invention further provides an electronic device, including:

[0132] It includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor. When the computer program is executed by the processor, the various processes of the above-mentioned data hierarchical encryption method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0133] An embodiment of the present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the various processes of the above-mentioned data hierarchical encryption method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0134] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0135] It will be appreciated by those skilled in the art that the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0136] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0137] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0138] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0139] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0140] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0141] The above is a detailed introduction to a data hierarchical encryption method and a data hierarchical encryption device provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A data hierarchical encryption method, the method comprising: Acquire target data and usage scenarios of the target data; Determine the security level and exposure level of the target data; The security level represents the importance of the target data; The exposure level represents the exposure risk of the target data in the usage scenario; Determining the number of encryption rounds according to the security level and exposure level of the target data; Determining at least one target encryption algorithm from a plurality of preset encryption algorithms; The target data is hierarchically encrypted according to the number of encryption rounds and at least one target encryption algorithm to obtain encrypted data.

2. The method according to claim 1, characterized in that Determining the number of encryption rounds according to the security level and exposure level of the target data includes: Obtaining a mapping relationship table; the mapping relationship table represents the relationship between the security level and exposure level of the target data and the number of encryption rounds; The number of encryption rounds of the target data is determined according to the mapping relationship table, the security level and the exposure level of the target data.

3. The method according to claim 2, characterized in that The method further comprises: When the usage scenario of the target data changes, re-determine the exposure level of the target data; Re-determining the number of encryption rounds of the target data according to the mapping table, the security level of the target data and the re-determined exposure level; When the re-determined number of encryption rounds is unchanged relative to the original number of encryption rounds, determining that the encrypted data is applicable to the changed usage scenario; When the re-determined number of encryption rounds changes relative to the original number of encryption rounds, determining that the encrypted data is not suitable for the changed usage scenario; determining a round number difference between the re-determined number of encryption rounds and the original number of encryption rounds; and encrypting or decrypting the encrypted data according to the round number difference.

4. The method according to claim 3, characterized in that The determining a difference between the re-determined number of encryption rounds and the original number of encryption rounds includes: When the difference is greater than zero, the target data is encrypted according to the difference; when the difference is less than zero, the target data is decrypted according to the difference.

5. The method according to claim 1, characterized in that The method further comprises: After the encrypted data is decrypted, determining the number of remaining decryption rounds of the encrypted data; Generate a cache file of the encrypted data for the remaining number of decryption rounds, and configure an exposure time corresponding to the cache file; the exposure time represents a time allowed to decrypt the cache file; When the cache file of the encrypted data is not decrypted within the exposure time, the cache file of the encrypted data is deleted.

6. The method according to claim 1, characterized in that The step of performing hierarchical encryption on the target data according to the number of encryption rounds and at least one target encryption algorithm to obtain encrypted data includes: According to the number of encryption rounds and at least one target encryption algorithm, the target data is hierarchically encrypted to obtain encrypted data content; Using the target encryption algorithm and the number of encryption rounds as an information header; The information header and the encrypted data content are combined to obtain encrypted data.

7. The method according to claim 6, characterized in that Also includes: Determine the encrypted version information symbol, the random symmetric key and the digest through the encrypted data content; The encrypted version information symbol, the random symmetric key and the digest are added to the information header.

8. A data hierarchical encryption device, the device comprising: A first acquisition module, used to acquire target data and a usage scenario of the target data; A first determination module, used to determine the security level and exposure level of the target data; The security level represents the importance of the target data; the exposure level represents the exposure risk of the target data in the usage scenario; A second determination module, configured to determine the number of encryption rounds according to the security level and exposure level of the target data; A third determination module, used to determine at least one target encryption algorithm from a plurality of preset encryption algorithms; The first encryption module is used to perform hierarchical encryption on the target data according to the number of encryption rounds and at least one target encryption algorithm to obtain encrypted data.

9. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein when the computer program is executed by the processor, the steps of the data hierarchical encryption method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the data hierarchical encryption method according to any one of claims 1 to 7 are implemented.

Images