Data encryption method, device, computer program product and data encryption system

Abstract

The present application provides a data encryption method, device, computer program product and data encryption system, the method comprising: obtaining data to be encrypted; classifying the data to be encrypted to obtain data to be encrypted of different security types; encrypting the data to be encrypted of all security types to obtain initial encrypted data of multiple security types, wherein the data to be encrypted of security types and the encryption methods correspond one to one; calculating the risk coefficient of the key of the initial encrypted data of all security types; when the risk coefficient is greater than or equal to a preset risk threshold, replacing the key to encrypt the data to be encrypted to obtain the target encrypted data. The present application solves the problem that the data encryption method in the prior art is poor, resulting in poor data security.

Description

Technical Field

[0001] The present application relates to the field of data protection technology, and in particular to a data encryption method, a data encryption device, a computer program product, and a data encryption system. Background Art

[0002] Scientific research data refers to important information such as experimental results, analytical data, and technical reports generated during the scientific research process. These data not only carry the core value of research results, but may also involve confidential technologies. Therefore, the security of scientific research data is of vital importance. If it is leaked, tampered with, or accessed without authorization, it will not only affect the research progress, but may also lead to the loss of confidential technologies and even endanger the reputation and competitiveness of scientific research institutions.

[0003] Therefore, the current solutions will encrypt the data, but the current solutions only perform simple key encryption on the data, which makes the sensitive data in the research projects under potential security threats for a long time. The poor encryption method of the data leads to poor data security. Summary of the invention

[0004] The main purpose of the present application is to provide a data encryption method, a data encryption device, a computer program product and a data encryption system, so as to at least solve the problem of poor data security caused by poor data encryption methods in the prior art.

[0005] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a data encryption method is provided, including: obtaining data to be encrypted; classifying the data to be encrypted to obtain data to be encrypted of different security types; encrypting the data to be encrypted of all security types to obtain initial encrypted data of multiple security types, wherein the data to be encrypted of security types and the encryption methods correspond one to one; calculating the risk coefficient of the key of the initial encrypted data of all security types; when the risk coefficient is greater than or equal to a preset risk threshold, replacing the key to encrypt the data to be encrypted to obtain target encrypted data.

[0006] Optionally, classifying the data to be encrypted to obtain the data to be encrypted of different security types includes: obtaining attribute information of the data to be encrypted, wherein the attribute information includes one or more of sensitivity level, importance and confidentiality; using a classification algorithm to classify the data to be encrypted according to the attribute information to obtain first data to be encrypted of a first security type, second data to be encrypted of a second security type and third data to be encrypted of a third security type, wherein the classification algorithm is one or more of a decision tree algorithm, a logistic regression algorithm, a random forest algorithm and a SVM algorithm, wherein the sensitivity level of the first data to be encrypted of the first security type is higher than the sensitivity level of the second data to be encrypted of the second security type, the sensitivity level of the second data to be encrypted of the second security type is higher than the sensitivity level of the third data to be encrypted of the third security type, the importance of the first data to be encrypted of the first security type is higher than the importance of the second data to be encrypted of the second security type, the importance of the second data to be encrypted of the second security type is higher than the importance of the third data to be encrypted of the third security type, the confidentiality of the first data to be encrypted of the first security type is higher than the confidentiality of the second data to be encrypted of the second security type, and the confidentiality of the second data to be encrypted of the second security type is higher than the confidentiality of the third data to be encrypted of the third security type.

[0007] Optionally, the data to be encrypted of all security types are encrypted to obtain initial encrypted data of multiple security types, including: using a first update frequency and a first encryption algorithm to encrypt the first data to be encrypted of the first security type to obtain first initial encrypted data, wherein the update frequency is the update speed of the key; using a second update frequency and a second encryption algorithm to encrypt the second data to be encrypted of the second security type to obtain second initial encrypted data, wherein the first update frequency is higher than the second update frequency, and the strength of the first encryption algorithm is higher than the strength of the second encryption algorithm; using a third update frequency and a third encryption algorithm to encrypt the third data to be encrypted of the third security type to obtain third initial encrypted data, wherein the second update frequency is higher than the third update frequency, and the strength of the second encryption algorithm is higher than the strength of the third encryption algorithm.

[0008] Optionally, the risk coefficients of the keys of the initial encrypted data of all security types are calculated, including: obtaining a key rotation frequency, wherein the key rotation frequency is a rotation frequency of the key in a unit time; obtaining a key failure rate, wherein the key failure rate is a frequency at which the key fails during use; and calculating the risk coefficients of the keys of the initial encrypted data of all security types based on the key rotation frequency and the key failure rate.

[0009] Optionally, obtaining the key rotation frequency includes: calculating the key rotation frequency according to a first formula, wherein the first formula is:

[0010]

[0011] KRFC i represents the key rotation frequency of the initial encrypted data of the i-th security type, represents the number of rotations of the mth key of the initial encrypted data of the i-th security type within a unit time, represents the usage time of the mth key of the initial encrypted data of the i-th security type in a unit time, represents the rotation time of the mth key of the initial encrypted data of the i-th security type within a unit time, represents the generation time of the mth key of the initial encrypted data of the i-th security type within a unit time, represents the number of encryption tasks waiting to be processed during rotation of the mth key of the initial encrypted data of the i-th security type within a unit time, i=1,2,3,...,k, m=1,2,3,...,g, k and g are both positive integers.

[0012] Optionally, obtaining the key expiration rate includes: calculating the key expiration rate according to a second formula, wherein the second formula is:

[0013]

[0014] KFRI i represents the key expiration rate of the initial encrypted data of the i-th security type, represents the number of failed rotations of the mth key of the initial encrypted data of the i-th security type within a unit time, represents the total number of rotations of the mth key of the initial encrypted data of the i-th security type within a unit time, represents the total amount of data backed up by the mth key of the initial encrypted data of the i-th security type in a unit time, It represents the ratio of the successful completion of the encryption task of the mth key of the initial encrypted data of the i-th security type within a unit time.

[0015] Optionally, based on the key rotation frequency and the key expiration rate, the risk coefficient of the key of the initial encrypted data of all security types is calculated, including: constructing a risk assessment model, wherein the risk assessment model is trained using multiple sets of training data, each set of the multiple sets of training data includes historical key rotation frequencies, historical key expiration rates, and historical risk coefficients corresponding to the historical key rotation frequencies and historical key expiration rates obtained within a historical time period; inputting the key rotation frequency and the key expiration rate into the risk assessment model to obtain the risk coefficients corresponding to the key rotation frequency and the key expiration rate.

[0016] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a data encryption device is provided, including: an acquisition unit, used to acquire data to be encrypted; a classification unit, used to classify the data to be encrypted to obtain the data to be encrypted of different security types; a first encryption unit, used to encrypt the data to be encrypted of all security types to obtain initial encrypted data of multiple security types, wherein the data to be encrypted of the security type and the encryption method have a one-to-one correspondence; a calculation unit, used to calculate the risk coefficient of the key of the initial encrypted data of all security types; a second encryption unit, used to replace the key to encrypt the data to be encrypted to obtain target encrypted data when the risk coefficient is greater than or equal to a preset risk threshold.

[0017] According to another aspect of the present application, a computer program product is provided, including a computer program, wherein when the computer program is executed by a processor, the steps of any one of the above-mentioned data encryption methods are implemented.

[0018] According to another aspect of the present application, a data encryption system is provided, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the one or more programs include an encryption method for executing any of the data described above.

[0019] By applying the technical solution of the present application, data can be managed in a hierarchical manner, corresponding encryption methods can be set according to data of different security levels (types), refined encryption processing can be implemented for data of different levels, and keys can be updated after encryption when the key risk is high. This can avoid data security vulnerabilities caused by expired keys, thereby improving data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The drawings constituting part of the present application are used to provide a further understanding of the present application. The exemplary embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0021] Figure 1 A hardware structure block diagram of a mobile terminal for executing a data encryption method provided in an embodiment of the present application is shown;

[0022] Figure 2 A schematic diagram of a data encryption method according to an embodiment of the present application is shown;

[0023] Figure 3 A schematic diagram of a flow chart of an optional data encryption method provided according to an embodiment of the present application is shown;

[0024] Figure 4 A structural block diagram of a data encryption device provided according to an embodiment of the present application is shown.

[0025] The above drawings include the following reference numerals:

[0026] 102, processor; 104, memory; 106, transmission device; 108, input and output devices. DETAILED DESCRIPTION

[0027] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0028] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0029] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0030] As introduced in the background technology, the poor data encryption method in the prior art leads to poor data security. To solve the above problems, the embodiments of the present application provide a data encryption method, a data encryption device, a computer program product and a data encryption system.

[0031] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0032] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 FIG. 1 is a hardware structure block diagram of a mobile terminal of a data encryption method according to an embodiment of the present invention. Figure 1 As shown, the mobile terminal may include one or more ( Figure 1 Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the mobile terminal may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the mobile terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0033] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as computer programs corresponding to the encryption method of data in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer programs stored in the memory 104, that is, the above method is implemented. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof. The transmission device 106 is used to receive or send data via a network. The above-mentioned specific examples of the network may include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0034] In this embodiment, a method for encrypting data running on a mobile terminal, a computer terminal or a similar computing device is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0035] Figure 2 FIG. 1 is a flow chart of a data encryption method according to an embodiment of the present application. Figure 2 As shown, the method comprises the following steps:

[0036] Step S201, obtaining data to be encrypted.

[0037] Specifically, by encrypting the data to be encrypted, the confidentiality and integrity of the data can be effectively protected to prevent unauthorized access or tampering of the data. The acquisition of the encrypted data requires strict permission control and identity authentication to ensure that only users with corresponding permissions can obtain the data. Encrypting the data to be encrypted can also improve the security of data transmission and storage, and prevent data from being stolen or tampered with during transmission.

[0038] Step S202: classify the data to be encrypted to obtain data to be encrypted of different security types.

[0039] Specifically, classifying the data to be encrypted can help determine the security level of the data, perform different encryption processing according to its sensitivity and importance, and then select the appropriate encryption algorithm and key length to protect the data. By classifying the data, differentiated protection of the data can be achieved to improve the security and confidentiality of the data. Encrypted data of different security types may require different levels of encryption protection to ensure the security of the data during storage, transmission and processing. Through a multi-level security mechanism, data can be encrypted and access controlled at different levels to improve the security and integrity of the data. It can more finely control the access rights of the data to prevent unauthorized access and tampering. Data of different security levels can be customized for encryption processing according to needs to ensure data security and privacy while improving the availability and credibility of the data.

[0040] Step S203, encrypting all security types of data to be encrypted to obtain multiple security types of initial encrypted data, wherein the security types of data to be encrypted and the encryption methods correspond one to one.

[0041] Specifically, by using different encryption methods to encrypt data of different security types, the protection level and complexity of the data can be increased, and the risk of data cracking can be reduced. Different encryption methods can also be selected according to the sensitivity and importance of the data to further enhance data security. Encrypting data of all security types can improve data integrity and reliability, ensure that data is not leaked or tampered with during transmission and storage, effectively protect data privacy and confidentiality, and improve data security levels.

[0042] Step S204, calculating the risk coefficients of the keys of all security types of initial encrypted data.

[0043] Specifically, by calculating the risk coefficient of the key, we can evaluate the security of the key, promptly discover possible security vulnerabilities and risks of the key, determine the various threats and attacks that the key may be subject to, and take corresponding measures to strengthen and protect it, which helps to optimize and improve the security mechanism and improve the effectiveness and reliability of the entire security mechanism.

[0044] Step S205: When the risk coefficient is greater than or equal to the preset risk threshold, the key is replaced to encrypt the data to be encrypted to obtain target encrypted data.

[0045] Specifically, when the risk factor is greater than or equal to the preset risk threshold, it means that the original key pair may be at risk of being leaked or cracked. In order to protect the data from being leaked or tampered with, the key needs to be replaced. By replacing the key to encrypt the encrypted data, the data security and privacy information protection capabilities can be effectively increased. By regularly replacing the key pair, the risk of the key being cracked or leaked can be effectively prevented, thereby improving the confidentiality and integrity of the data. It can also effectively prevent the data from being accessed and tampered with without authorization, ensure the security of the data during transmission and storage, effectively prevent various potential security threats and attacks, and ensure the security of the data.

[0046] Through this embodiment, data can be managed in a hierarchical manner, and corresponding encryption methods can be set according to data of different security levels (types). Refined encryption processing can be implemented for data of different levels. Keys can also be updated after encryption when the key risk is high. This can avoid data security vulnerabilities caused by expired keys, thereby improving data security.

[0047] In order to address the risks existing in the existing technology, this embodiment adopts hierarchical access control, data encryption, real-time monitoring and log auditing to protect data from different levels, and ensures the traceability of data access and compliance of operations through real-time monitoring and log recording. This multi-level protection method can effectively respond to complex security threats and ensure the security and integrity of data throughout its life cycle.

[0048] The existing data protection technology based on multi-level security mechanism jointly ensures the security and integrity of data through a variety of strict protection measures. First, the system implements hierarchical access control, and restricts access and operations to data of different levels according to the user's identity and authority, ensuring that only authorized personnel can perform specific operations. Secondly, the whole data encryption technology is adopted. Whether the data is in the storage stage or in network transmission, it is protected by a strong encryption algorithm to prevent the data from being intercepted or tampered with without authorization. At the same time, the real-time monitoring system continuously tracks the access and modification behavior of the data. Once abnormal activity is detected, an alarm is immediately triggered or protective measures are taken. In addition, the system also records the operations and access traces of all users through a detailed log audit function, so that any improper behavior can be traced back to ensure that security review and compliance audit can be carried out afterwards. Through the above-mentioned hierarchical and multi-angle security mechanism, data is strictly protected throughout the entire life cycle, thereby effectively preventing security risks such as data leakage, tampering, and unauthorized access.

[0049] In a specific implementation process, the data to be encrypted is classified to obtain data to be encrypted of different security types, which can be specifically implemented through the following steps: obtaining attribute information of the data to be encrypted, wherein the attribute information includes one or more of sensitivity level, importance and confidentiality; using a classification algorithm to classify the data to be encrypted according to the attribute information to obtain first data to be encrypted of a first security type, second data to be encrypted of a second security type and third data to be encrypted of a third security type, wherein the classification algorithm is one or more of a decision tree algorithm, a logistic regression algorithm, a random forest algorithm and a SVM algorithm, wherein the sensitivity level of the first data to be encrypted of the first security type is higher than the sensitivity level of the second data to be encrypted of the second security type, the sensitivity level of the second data to be encrypted of the second security type is higher than the sensitivity level of the third data to be encrypted of the third security type, the importance of the first data to be encrypted of the first security type is higher than the importance of the second data to be encrypted of the second security type, the importance of the second data to be encrypted of the second security type is higher than the importance of the third data to be encrypted of the third security type, the confidentiality of the first data to be encrypted of the first security type is higher than the confidentiality of the second data to be encrypted of the second security type, and the confidentiality of the second data to be encrypted of the second security type is higher than the confidentiality of the third data to be encrypted of the third security type.

[0050] In this scheme, by obtaining the attribute information of the data to be encrypted and classifying the data using a classification algorithm, data to be encrypted of different security types can be obtained. The security level of the data can be determined according to the different attributes of the data, and different encryption methods and measures can be used for encryption processing to protect the security of the data. The data is classified and encrypted according to the attribute information of the data, thereby realizing refined encryption of the data and improving the security and protection level of the data. The data is divided into different security types through a classification algorithm to further improve the security and protection level of the data. By performing multi-level encryption processing on the data, corresponding encryption measures can be taken according to the attribute information of the data, making the data more secure and reliable during transmission and storage. Different encryption methods are used for data of different security types to ensure the security and integrity of the data and effectively prevent data leakage and illegal access.

[0051] It should be noted that the above decision tree algorithm is a machine learning algorithm based on a tree structure, which is used for classification and regression tasks. The decision tree gradually divides the data set into different subsets through a series of splitting rules until a specific stopping condition is reached. In the classification task, the decision tree algorithm divides the data set into different categories according to the value of the feature, and finally generates a tree structure, in which each leaf node represents a category. In the regression task, the decision tree algorithm predicts the target variable according to the value of the feature; the above logistic regression algorithm is a statistical learning method widely used in classification problems. It is based on the linear regression model, and performs classification prediction by weighted summing of the input features and mapping the results to probability values ​​between [0,1] through a logical function (such as the sigmoid function); the above random forest algorithm is an ensemble learning method, which performs classification or regression through the integration of multiple decision trees. In the random forest, each decision tree is trained based on a subset obtained by randomly sampling the training set, which can increase the generalization ability of the model; the above SVM algorithm (Support Vector Support vector machine (SVM) is a supervised learning algorithm for classification and regression analysis. It is based on statistical learning theory and uses linear and nonlinear methods for classification and regression.

[0052] Optionally, the above data attributes may include but are not limited to: sensitivity level, data type, source device and purpose, etc.

[0053] Specifically, first, the system will collect metadata information of the data, such as the confidentiality of the data, the potential risk level, and the importance of the data to project decisions. Then, the system will use preset rules or weight models to score the sensitivity of the data and automatically divide the data into three security levels: high, medium, and low. The classification process can be achieved through algorithms such as rule engines and decision trees in the software. That is, software analysis tools can be used to automatically classify data according to its attributes to ensure the automation and consistency of data classification.

[0054] For example, the encrypted data can be classified by the following steps:

[0055] 1. Obtain attribute information of the data to be encrypted, including attributes such as sensitivity level, importance, and confidentiality.

[0056] 2. Use classification algorithms to classify encrypted data based on attribute information. Decision tree algorithms, logistic regression algorithms, random forest algorithms, and SVM algorithms can be used for classification.

[0057] 3. Design multi-level security types, such as setting the first security type, the second security type and the third security type.

[0058] 4. According to the classification result, the data to be encrypted are divided into first data to be encrypted of a first security type, second data to be encrypted of a second security type, and third data to be encrypted of a third security type.

[0059] If there is a scientific research data, which contains the content of an academic paper, this data can be classified according to the attribute information of the paper:

[0060] Attribute 1: Sensitivity level (high, medium, low);

[0061] Attribute 2: Importance (high, medium, low);

[0062] Attribute 3: confidentiality (high, medium, low);

[0063] Based on the above attribute information, the data can be classified into different security types through classification algorithms. For example, based on the results of the decision tree algorithm, the data can be classified as follows:

[0064] First security type: data with high sensitivity, high importance, and high confidentiality;

[0065] Second security type: data with medium sensitivity, medium importance, and medium confidentiality;

[0066] The third security type: data with low sensitivity, low importance, and low confidentiality;

[0067] Through the above classification method, different security processing can be performed on the data according to its attribute information, so as to better protect the security of the data.

[0068] In some embodiments, data to be encrypted of all security types are encrypted to obtain initial encrypted data of multiple security types, which can be specifically achieved through the following steps: using a first update frequency and a first encryption algorithm to encrypt first data to be encrypted of a first security type to obtain first initial encrypted data, wherein the update frequency is the update speed of the key; using a second update frequency and a second encryption algorithm to encrypt second data to be encrypted of a second security type to obtain second initial encrypted data, wherein the first update frequency is higher than the second update frequency, and the strength of the first encryption algorithm is higher than the strength of the second encryption algorithm; using a third update frequency and a third encryption algorithm to encrypt third data to be encrypted of a third security type to obtain third initial encrypted data, wherein the second update frequency is higher than the third update frequency, and the strength of the second encryption algorithm is higher than the strength of the third encryption algorithm.

[0069] In this solution, by using different update frequencies and encryption algorithms to encrypt data of different security types, the security and protection level of the data can be improved. According to the sensitivity and value of different data, different levels of encryption algorithms and update frequencies are used to effectively prevent data leakage and unauthorized access. By selecting a method with a higher update frequency and a stronger encryption algorithm to encrypt data, it can effectively prevent data from being accessed and stolen without authorization, thereby providing more comprehensive data protection and ensuring the security of data during transmission and storage.

[0070] Specifically, different encryption strategies and key management mechanisms are assigned to each level. This can be achieved by setting different encryption algorithms, key lengths, and update frequencies for each level. The software can automatically specify a suitable encryption scheme for each level of data based on the data classification results. For example, highly sensitive data can use a stronger encryption algorithm (such as AES-256) and set a more frequent key update cycle; medium-sensitive data uses standard algorithms such as AES-128 with a lower update frequency. The system can automatically generate and distribute keys for each level, monitor the key usage status in real time, and rotate and manage them according to preset strategies to ensure that encryption strategies are flexibly adjusted according to the security requirements of the data level.

[0071] Dividing data into layers according to sensitivity levels and security requirements, and assigning corresponding encryption strategies and key management mechanisms to different layers can effectively improve the system's ability to cope with the risk of encryption key failure. Targeted encryption measures can be taken for data of different sensitivities to ensure that high-risk data is more closely protected. At the same time, it optimizes system resources and avoids redundancy problems caused by using the same encryption strategy for all data. It can not only dynamically adapt to key update delays, but also effectively improve the long-term security of data and prevent the risk of data leakage caused by encryption key failure.

[0072] It should be noted that the above-mentioned AES-256 algorithm is a symmetric encryption algorithm that uses a 256-bit key for encryption and decryption. It is a variant of the Advanced Encryption Standard (AES) with high security and performance, and is suitable for encryption needs to protect sensitive data and information; the above-mentioned AES-128 uses a 128-bit key to encrypt and decrypt data. It is one of the Advanced Encryption Standards (AES), which groups plaintext data into 128-bit group sizes and performs encryption processing through a series of rounds.

[0073] During the specific implementation process, the risk coefficients of the keys of the initial encrypted data of all security types are calculated, which can be achieved through the following steps: obtaining the key rotation frequency, where the key rotation frequency is the rotation frequency of the key in unit time; obtaining the key failure rate, where the key failure rate is the frequency of the key failure during use; based on the key rotation frequency and the key failure rate, the risk coefficients of the keys of the initial encrypted data of all security types are calculated.

[0074] In this scheme, calculating the key rotation frequency and key expiration rate can help evaluate and manage the security of keys. The higher the key rotation frequency and the lower the key expiration rate, the better the key management and the higher the security. Otherwise, there may be risks. By calculating the risk coefficient of the key, we can better understand the key management situation, and then more accurately evaluate the risk level of the key, timely discover possible security risks and take corresponding measures to repair and improve them.

[0075] Specifically, the key rotation status information of each level of data in the data backup process is obtained in real time, and analyzed after acquisition to generate the key rotation frequency coefficient and key failure rate index of each level of data respectively, including the following steps:

[0076] 1. Real-time acquisition of key rotation status information of data at each level during the data backup process, and pre-processing after acquisition. Information acquisition can be achieved through real-time interaction between the monitoring module in the software and the key management system. The key management system will record key information. The monitoring module can capture the data in real time through periodic polling or event-driven methods. When a new key rotation event occurs, the system will immediately store the key-related status information in the database or log file for subsequent analysis. The data acquisition module in the software should support the classification and collection of data at different levels, and automatically obtain relevant key rotation information according to the progress of the data backup task.

[0077] Among them, the main purpose of preprocessing is to ensure that the data obtained from the key management system is accurate, complete, and in a consistent format so that subsequent analysis can proceed smoothly. The key rotation status information may include fields in different formats and incomplete fields. For example, some key generation time formats are not uniform, or there are null values ​​in the task queue data. Therefore, the preprocessing step needs to perform formatting, missing value filling, and outlier detection. The specific preprocessing can be achieved through the software's rule engine. For example, all timestamps can be uniformly converted to a standard format (such as Coordinated Universal Time, UTC). Null values ​​can be filled using interpolation methods, and outliers can be filtered or corrected using statistical methods. The preprocessed data will be more standardized to ensure that there will be no data errors or inconsistencies in subsequent analysis and coefficient generation.

[0078] 2. Extracting the key update performance information and key failure probability information from the preprocessed key rotation status information of each level of data can be achieved through the data processing module in the software. The specific method is as follows: first, the software module will identify the relevant field data from the preprocessed key rotation status information according to the preset rules and data classification standards, and classify it as "key update performance information". For fields related to key rotation failure (such as the number of rotation failures, task completion rate, etc.), the system will filter these data through specific conditions and classify them as "key failure probability information". In addition, the extraction process can be performed through the rule-based filter or data marker in the software to automatically identify and classify different key status information. The extracted information will be stored in different data structures for subsequent analysis and calculation, ensuring that each level of data has an independent analysis dimension.

[0079] 3. Analyze the key update performance information and key failure probability information in the key rotation status information extracted from each level of data, and generate the key rotation frequency coefficient and key failure rate index of each level of data respectively.

[0080] Optionally, the above-mentioned key information may include but is not limited to: generation time, number of rotations, task queue length and encryption task execution status, etc.; the above-mentioned related field data may include but is not limited to: key generation time, number of rotations and task queue length and other data.

[0081] In some embodiments, obtaining the key rotation frequency can be specifically implemented by the following steps: calculating the key rotation frequency according to a first formula, wherein the first formula is:

[0082]

[0083] KRFC irepresents the key rotation frequency of the initial encrypted data of the i-th security type, Indicates the number of rotations of the mth key of the initial encrypted data of the i-th security type in a unit time. Indicates the usage time of the mth key of the initial encrypted data of the i-th security type in unit time, Indicates the rotation time of the mth key of the initial encrypted data of the i-th security type in unit time, Indicates the generation time of the mth key of the initial encrypted data of the i-th security type in unit time, represents the number of encryption tasks waiting to be processed during rotation of the mth key of the initial encrypted data of the i-th security type in unit time, i=1,2,3,...,k, m=1,2,3,...,g, k and g are both positive integers.

[0084] In this scheme, the key rotation frequency is calculated according to the first formula to determine the number of rotations of each key in unit time for the initial encrypted data of each security type. By adjusting the key rotation frequency according to the requirements of different security types, the number of key rotations can be better controlled to ensure that data is fully protected at different security levels. Adjusting the key rotation frequency can balance the relationship between system security and performance, ensuring that the system maintains good performance while maintaining high security. The key rotation frequency can be flexibly adjusted according to actual needs to meet the requirements of different security levels, effectively protect the confidentiality and integrity of data, and prevent keys from being cracked or leaked.

[0085] The logic for obtaining the key rotation frequency coefficients of each level of data is as follows:

[0086] 1. Extract the key update performance information from the key rotation status information of each level of data that has been preprocessed, including the generation time, rotation time, rotation times of each key in a period of time during the data backup process of each level of data, and the number of encryption tasks waiting to be processed when each key is rotated, and mark them as and Indicates the generation time of the mth key of the i-th level data within a period of time during the data backup process, Indicates the rotation time of the mth key of the i-th level data during the data backup process. It indicates the number of rotations of the mth key of the i-th level data within a period of time during the data backup process. It indicates the number of encryption tasks waiting to be processed when the mth key of the i-th level data is rotated during the data backup process within a period of time.

[0087] 2. Extracting the key update performance information of the pre-processed data at each level can be achieved through the software's log analysis module and the interface of the key management system. First, the key management system records the generation time, rotation time and rotation frequency of each key. This information is usually stored in log files or databases. The software can periodically obtain and parse these records through interface calls. Specifically, by analyzing the timestamps and event records in the logs, the key generation time and rotation time are extracted, and the number of rotations is calculated. The encryption task queue length can be obtained by accessing the task processing queue data in the task management system to record the number of tasks waiting to be processed when the key is rotated. Through the rule engine or data marker, the system can automatically extract and classify these quantitative data and classify them into "key update performance information" to ensure the accuracy and automation of data processing.

[0088] 3. According to the formula: Calculate the usage time of each key for each level of data during the data backup process

[0089] 4. Calculate the key rotation frequency coefficient of each level of data. The specific calculation formula is as follows:

[0090]

[0091] To comprehensively evaluate the key rotation frequency and efficiency of each level of data, by and the duration of the key usage By analyzing, we can calculate the rotation frequency of the key in unit time, where: It reflects the actual usage time of each key from generation to rotation. The longer the time, the slower the key rotation and the lower the frequency coefficient. It indicates the number of times the key is rotated during this time period. The more times, the higher the rotation frequency, so the coefficient will increase, and the encryption task queue length Indicates the number of encryption tasks waiting to be processed during key rotation. The longer the queue is and the greater the system load is, the less effective the rotation frequency will be. By summing up these values ​​and dividing them by the total number of keys g at this level, the comprehensive key rotation frequency coefficient for the entire level can be calculated, thereby better evaluating the efficiency and potential security of the system in managing key rotation.

[0092] Among them, the key rotation frequency coefficient KRFC of the i-th level data iThere is a negative correlation between the size of and the risk level of key expiration. Specifically, the larger the key rotation frequency coefficient is, the more frequently the data keys at this level are rotated, and the shorter the time the keys stay in the system, which means that the risk of key expiration is relatively low. Therefore, the risk level of key expiration for data at this level is also reduced accordingly. On the contrary, the smaller the key rotation frequency coefficient is, the less likely the keys are rotated or the task queue is too long, the longer the key usage time is, and the system relies on the same key for encryption operations for a longer period of time, which increases the possibility of key expiration. Therefore, the risk level of key expiration for data at this level will also increase.

[0093] In the specific implementation process, the key expiration rate is obtained, which can be implemented by the following steps: the key expiration rate is calculated according to the second formula, where the second formula is:

[0094]

[0095] KFRI i represents the key expiration rate of the initial encrypted data of the i-th security type, Indicates the number of failed rotations of the mth key of the initial encrypted data of the i-th security type within a unit time. Indicates the total number of rotations of the mth key of the initial encrypted data of the i-th security type in a unit time. Indicates the total amount of data backed up by the mth key for the initial encrypted data of the i-th security type in a unit time. It represents the ratio of the successful completion of the encryption task of the mth key for the initial encrypted data of the i-th security type within a unit time.

[0096] In this scheme, the key failure rate calculated according to the second formula can measure the key failure of the initial encrypted data of a specific security type in unit time, that is, the ratio of the number of key failures during the rotation process to the total number of rotations, and then evaluate the efficiency and security of key management, timely discover the failure of keys and take corresponding measures to repair or update the keys. Calculating the key failure rate can help improve data security and protection. By monitoring the key failure rate, problems in the key rotation process can be discovered in a timely manner to avoid the risk of data leakage or destruction. Evaluating the key failure rate is helpful in formulating and adjusting security strategies and improving the overall data protection level.

[0097] Specifically, the logic for obtaining the key expiration rate index of each level of data is as follows:

[0098] 1. Extract the key failure probability information from the key rotation status information of each level of data that has been preprocessed, including the number of rotation failures of each key in each level of data within a period of time during the data backup process, the total number of rotations, the total amount of data backed up, and the proportion of successful completion of the encryption task, and mark them as and Indicates the number of failed rotations of the mth key of the i-th level data within a period of time during the data backup process. It indicates the total number of rotations of the mth key of the i-th level data within a period of time during the data backup process. It indicates the total amount of data backed up by the mth key in the i-th level data during the data backup process. It represents the ratio of successful completion of the encryption task of the mth key for the i-th level data within a period of time during the data backup process, i=1,2,3,.k., m=1,2,3,...,g, k and g are both positive integers.

[0099] 2. Extracting the key failure probability information from the pre-processed data at each level can be achieved through the interaction of the software's log analysis module, the key management system, and the task management system. First, the number of key rotation failures and the total number of key rotations can be extracted from the log of the key management system. The system records each key rotation event, including the success and failure status. By analyzing the event type in the log, the software can count the number of key rotation successes and failures for each level of data within a specific time period. The total amount of data backup can be extracted through the records of the data backup system. The data can be directly obtained through the backup log or database query. The proportion of successful completion of encryption tasks is counted through the task queue of the task management system. The software will record the completion status of each encryption task (success or failure), and calculate the completion rate of the encryption task based on the ratio of the number of successful tasks to the total number of tasks. After unified formatting and cleaning, the above quantitative data can be used to generate "key failure probability information" to provide reliable data support for subsequent analysis and calculation.

[0100] 3. Calculate the key failure rate index of each level of data. The specific calculation formula is:

[0101]

[0102] This formula can calculate the key failure rate index of each level of data, with the aim of comprehensively evaluating the risk of key rotation failure. First, the number of key rotation failures It directly reflects the frequency of key failures during use over a period of time. The more failures, the higher the failure rate. Secondly, the total number of key rotations. It reflects the frequency of key updates in the system within the same time period. The more rotations there are, the smaller the impact of a single failure is. Therefore, it is in the denominator. The total amount of data backup Indicates the workload of the system during this time period. The more data is backed up, the greater the system load is, and the failure rate may increase. Therefore, it is also in the denominator, encryption task completion rate It indicates the efficiency of the system in processing tasks. The higher the success rate, the better the stability of the system. Therefore, the larger the value, the smaller the failure rate. By taking the weighted average of all the above factors, the formula provides a comprehensive key failure rate index, which is used to evaluate the failure risk of data at different levels.

[0103] Among them, the key failure rate index KFRI of the i-th level data i The size of is positively correlated with the key expiration risk level of the data at this level. Specifically, the larger the key expiration rate index is, the higher the frequency of key failures in the rotation process of the data at this level, the lower the success rate of encryption tasks, and the heavier the system load, which indicates that the key expiration risk of the data at this level is higher. On the contrary, the smaller the key expiration rate index is, the smoother the key rotation is, the higher the task completion rate is, the data backup work is carried out smoothly, the system operation is more stable, and thus the key expiration risk is lower. Therefore, the key expiration rate index can be used to evaluate and predict the key expiration risk level of data at different levels.

[0104] In some embodiments, the risk coefficients of the keys of all security types of initial encrypted data are calculated based on the key rotation frequency and the key failure rate. This can be specifically achieved through the following steps: constructing a risk assessment model, wherein the risk assessment model is trained using multiple sets of training data, and each set of training data in the multiple sets of training data includes historical key rotation frequencies, historical key failure rates, and historical risk coefficients corresponding to historical key rotation frequencies and historical key failure rates obtained within a historical time period; inputting the key rotation frequency and the key failure rate into the risk assessment model to obtain the risk coefficients corresponding to the key rotation frequency and the key failure rate.

[0105] In this scheme, building a risk assessment model can more accurately evaluate the impact of key rotation frequency and key failure rate on data security. The risk assessment model obtained through training can predict possible future risk factors based on the key rotation frequency and key failure rate in historical data, so as to take corresponding security measures in time to ensure the security of data. By inputting the key rotation frequency and key failure rate into the risk assessment model, the corresponding risk factor can be obtained, thereby better understanding the security status of the system and formulating corresponding key management strategies. At the same time, the risk assessment model obtained through training with multiple sets of training data can more accurately reflect the risk situation in different time periods, and can also help optimize key rotation and failure strategies, improve the security and stability of the system, and reduce potential security risks.

[0106] A risk assessment model is constructed for the key rotation frequency coefficient and key failure rate index of each level of data generated to generate the risk coefficient of each level of data, specifically including the following steps:

[0107] 1. Collect the key rotation frequency coefficients, key failure rate indexes and corresponding risk coefficients of several data at various levels generated in the past period of time, and calibrate them as and Among them, x represents the key rotation frequency coefficients of several levels of data generated in the past period of time, several key failure rate indices and the corresponding risk coefficient numbers, x = 3, 4, 5, ..., d, d is a positive integer, and the data collected in the past period of time is formed into a historical data set.

[0108] The key rotation frequency coefficient, key failure rate index and corresponding risk coefficient of each level of data generated in the past period of time can be collected through the log management module, database query and regular scheduling tasks in the software system. First, the system will automatically record the key rotation frequency coefficient and key failure rate index into the database after each calculation. By defining a unique identifier for the data (such as data level number, timestamp, etc.), it can be ensured that the generation records of these data in different time periods are accurate. The software system can set regular automated task scheduling (such as weekly or monthly) to efficiently collect these historical data and batch extract the key rotation frequency coefficient, key failure rate index and risk coefficient generated within a specified time range from the database. The collection process can extract relevant data from the database through SQL query statements or API interfaces to ensure that the data is accurately and completely acquired, and the possible missing data can be supplemented through the historical records of the log file. During the collection process, the data cleaning module can ensure that the collected data is non-duplicate and free of gaps, ensuring that subsequent analysis is accurate.

[0109] Among them, the value of x is a positive integer greater than or equal to 3, specifically because there are three unknown numbers β 0 , β 1 and β 2 In order to solve the above regression coefficients, at least three independent equations must be formed to obtain the solution through the simultaneous equations. If the value of x is 3 or greater, it means that there can be at least three data points, namely, the key rotation frequency coefficients, key failure rate indexes and corresponding risk coefficients of several levels of data, so as to generate enough equations to solve the three regression coefficients, ensuring that the regression model can generate accurate regression coefficients β through multiple historical data training. 0 , β 1 and β 2 , and thus more accurately predict the risk factor.

[0110] In addition, selecting x ≥ 3 can also enhance the robustness of the model. As more historical data are included in the training, the model can better capture the impact of the key rotation frequency coefficient and the key failure rate index on the risk factor, thereby improving the accuracy and stability of the prediction, which can meet the basic needs of understanding the set of equations and improve the model's generalization ability for future data.

[0111] 2. Select the multivariate regression model as the risk assessment model, and train it through the historical data set to determine the value of the regression coefficient according to the formula: Among them, β 0 , β 1 and β 2 is the regression coefficient.

[0112] The multivariate regression model is a statistical model used to study the impact of multiple independent variables on a dependent variable. In this step, the multivariate regression model is selected as the risk assessment model because both the key rotation frequency coefficient and the key failure rate index may affect the risk coefficient, and multivariate regression can simultaneously consider the impact of these two independent variables, thereby generating a more comprehensive risk prediction model. 0 is a constant term, indicating that and The basic risk level when both are zero, β 1 yes The regression coefficient of β represents the impact of each unit change in key rotation frequency on the risk factor, 2 is The regression coefficient represents the impact of the key failure rate on the risk factor. By training and determining the above regression coefficients, the model can quantify the contribution of key rotation frequency and failure rate to risk, thereby more accurately evaluating the key failure risk level of the data.

[0113] 3. By minimizing the error between the predicted value and the actual value, the regression coefficient is optimized and the regression coefficient β is finally determined. 0 , β 1 and β 2 The value of .

[0114] The regression coefficient can be optimized by the Ordinary Least Squares (OLS) or Gradient Descent algorithm in the software. First, the system compares the actual value in the historical data (for example, the real risk coefficient) with the predicted value generated by the regression model to calculate the error of each data point (that is, the difference between the predicted value and the actual value). In the least squares method, the software calculates the sum of the squares of the errors of all data points. The goal is to find the regression coefficient β that minimizes the sum of the errors. 0 , β 1 and β 2 The software optimizes the regression coefficients through repeated iterative calculations and eventually finds a combination of coefficients that makes the predicted value as close to the actual value as possible, to ensure that the prediction results of the regression model have maximum accuracy and reliability, thereby more accurately evaluating the impact of the key rotation frequency coefficient and the key failure rate index on the risk factor, making future risk assessments more effective.

[0115] 4. Use the finalized regression coefficient to input the key rotation frequency coefficient KRFC of each level of data generated in real time into the constructed risk assessment model i and key failure rate index KFRI i , generate risk coefficients FC for each level of data in real time i .

[0116] The risk coefficient FC of each level of data generated i The pre-set risk factor threshold interval [FC min ,FC max ] to compare, evaluate the risk level of key expiration of each level of data according to the comparison results, and divide the data at each level into high-risk data, medium-risk data and low-risk data according to the evaluation results. The specific comparison analysis and division are as follows:

[0117] If FC i <FC min, if the key expiration risk level of the data at this level is low risk, then the data at this level is classified as low-risk data. This means that the key rotation of the data at this level is frequent and stable, the key expiration rate index is low, and the system has no obvious failures during encryption tasks and data backup. The specific impact is that the key management of this type of data is relatively stable, does not require frequent monitoring or intervention, the data security is relatively high, and system resources can be more allocated to medium and high-risk data processing, reducing the overall management burden.

[0118] If FC min ≤FC i ≤FC max , the key expiration risk level of the data at this level is medium risk, then the data at this level is classified as medium risk data. This situation means that there are certain potential risks in the key management of the data, which may be due to the low frequency of key rotation or occasional failure, but the overall situation is still within the controllable range. The specific impact is that the system needs to monitor this data regularly and take preventive measures, such as increasing the frequency of key rotation or checking the system load in a timely manner, to ensure that the key management problem does not deteriorate to a higher risk level.

[0119] If FC i >FC max , the key failure risk level of the data at this level is high risk, then the data at this level is classified as high-risk data. This situation indicates that the risk of key failure is very high, key rotation failures may occur frequently, encryption tasks cannot be completed smoothly, the system load is serious, and the security of the data may be threatened. The specific impact is that the system must take emergency measures immediately, such as immediately updating the key or increasing the rotation frequency, and may even need to suspend some data operations until key management returns to normal to prevent data leakage or security damage.

[0120] In addition, the pre-set risk factor threshold interval can be determined through the historical data analysis module and risk assessment model training in the software system. First, the system will collect and analyze data from the past period of time, including the key rotation frequency coefficient, key failure rate index and the corresponding actual risk situation. The historical data can be processed through regression analysis, clustering algorithm or statistical analysis model to identify the characteristic values ​​of different risk levels. The software can automatically calculate the risk factor distribution corresponding to each risk level and set the FC based on these distributions. min and FC max The system can optimize these thresholds through multiple iterations and model training to make them more consistent with the risk pattern of actual data, thereby dynamically adjusting the risk interval to ensure that under different environmental and data conditions, the risk factor threshold interval can accurately divide high, medium and low risk data.

[0121] Based on the classification results of data at each level, corresponding security measures are taken for data at different risk levels, specifically:

[0122] 1. For low-risk data with a low risk level of key expiration, the security measures taken are to regularly monitor the key rotation status without additional intervention.

[0123] Implementation of measures for low-risk data: For low-risk data, the system can set up an automated monitoring module to regularly collect and analyze key rotation status information. The specific implementation method is that the software obtains the rotation log from the key management system at regular intervals (such as daily or weekly) through scheduling tasks, and analyzes data such as key generation time, rotation time, and rotation number to ensure the normal operation of key management. The monitoring module will generate reports or log records for administrators to check. This is done to ensure that the system does not perform unnecessary intervention when running stably, save computing resources, and ensure data security and sustainability.

[0124] 2. For medium-risk data with a medium risk level for key expiration, the security measures taken are to increase the frequency of key rotation and monitor key expiration in real time.

[0125] Implementation of measures for medium-risk data: For medium-risk data, the system can set up a dynamic adjustment mechanism to monitor the key rotation frequency and key expiration through the real-time monitoring module, and take immediate action when potential risks are found. The specific implementation method is that the system will increase the rotation frequency of the key, shorten the rotation period, and adjust the key generation and expiration parameters to adapt it to the load of the current data backup and encryption tasks. In addition, the software will enable the real-time alarm function, and send an alarm to the administrator if it detects a key rotation failure or an increased risk of key expiration. This preventive measure ensures that key management of medium-risk data does not get out of control, while providing sufficient response time for adjustments.

[0126] 3. For high-risk data with a high risk level of key expiration, the security measures taken are to immediately replace the key, suspend some data encryption operations, and give priority to high-priority encryption tasks.

[0127] Measures for high-risk data: For high-risk data, the system can enable the emergency response module to immediately replace the key and suspend some data encryption operations. Specifically, the software monitors the risk of key failure in real time. Once a high-risk state is detected, the system will automatically generate a new key to replace the old key and suspend some low-priority encryption tasks. At the same time, the task scheduler will give priority to high-priority encryption tasks to ensure the security of critical data. Through such an emergency response mechanism, the system can respond quickly when key management fails to prevent data security from being seriously threatened.

[0128] After that, we will continue to monitor the data backup and key rotation execution at each level, dynamically adjust the encryption task scheduling priority of each level of data, regularly update the risk assessment model, and optimize the protection strategy of each level of data. The specific steps are as follows:

[0129] 1. Continuously monitor the execution of data backup and key rotation at all levels: Continuous monitoring can be performed through the real-time monitoring module in the software. The system will continuously obtain the log data of key rotation and the status information of the backup task. By analyzing these logs and data, the software can identify the success rate of key rotation, the length of the task queue and the task processing status. The specific implementation method is that the automated script running in the background of the system regularly obtains data from the key management and task management systems, and monitors the execution of tasks in real time to ensure that the system can detect abnormal situations in the first time, such as key rotation failure or task delay, so as to make corresponding adjustments to ensure data security.

[0130] 2. Dynamically adjust the encryption task scheduling priority of each level of data: The priority management mechanism of the task scheduling module can be used to dynamically adjust the encryption task priority. The specific implementation method is that the software automatically adjusts the encryption task priority of different data levels according to the real-time risk assessment results. For high-risk data, the system will adjust the algorithm to schedule it to the high-priority queue to ensure that the encryption tasks of these data are processed first, while for low-risk data, the system will schedule it to a lower priority queue and postpone processing. Through this dynamic adjustment method, the system can ensure the reasonable allocation of resources, focus on protecting high-risk data, and improve the efficiency of overall data protection.

[0131] 3. Regularly update the risk assessment model: The software can use the machine learning module to achieve regular updates of the risk assessment model. The specific implementation method is that the system will automatically collect newly generated key rotation frequency, failure rate index and other data in the background, and regularly train and optimize the model. Through the accumulation of historical data, the system can continuously adjust the coefficients in the regression model and update the threshold range to make the model more accurately reflect the risk level of the current data. The above update mechanism ensures that the system can respond to the changing data environment in a timely manner and prevent inaccurate risk predictions due to model aging.

[0132] 4. Optimize the protection strategies for data at all levels: The optimization of protection strategies can be achieved through the strategy management module. Specifically, the system automatically generates key management strategies and encryption strategies that adapt to the current situation based on the latest risk assessment results and data level classification. For example, for data with increased risk levels, the system can increase the key rotation frequency or encryption strength; for data with reduced risk levels, the system resources can be appropriately reduced. By analyzing real-time monitoring and historical data, the protection strategy can be automatically adjusted to ensure a balance between data security and resource efficiency, so as to reasonably allocate system resources according to actual needs and ensure the long-term security of data.

[0133] The technical solution provided by the above-mentioned embodiments of the present application solves the following problems: In energy data research projects, when the system needs to regularly encrypt and back up the generated sensitive data, as the amount of data continues to increase, the system must frequently rotate and update the encryption keys. However, due to the lag of the key management system, the keys may not be updated in time, resulting in the problem of key expiration. Since the encryption keys are not rotated on time, the system will continue to use expired keys to encrypt the data, which directly leads to a decrease in the security of the backup data and faces the risk of being cracked at some point in the future. The existing technology is unable to evaluate and predict the risk of key expiration in real time, and is unable to promptly remind or take measures to deal with it. This will cause the sensitive data in the scientific research project to be under potential security threats for a long time, thereby affecting the integrity of the data and the confidentiality of the project. If this problem cannot be effectively solved, the security mechanism of the entire scientific research project will be seriously threatened, which may lead to data leakage or failure to meet long-term storage security requirements.

[0134] It also has the following beneficial effects:

[0135] 1. Data is managed hierarchically through a multi-level security mechanism, and encryption strategies are adjusted dynamically according to sensitivity levels and security requirements, effectively solving the problem that traditional technologies cannot accurately protect data at different levels. The real-time monitoring of key rotation frequency and the close integration of data backup ensure that the system can promptly detect and handle key failures, avoiding data security vulnerabilities caused by the use of expired keys. This flexible hierarchical encryption solution not only improves the security of the overall system, but also improves the utilization efficiency of encryption resources.

[0136] 2. The proposed key rotation frequency coefficient and key failure rate index provide a digital and quantifiable evaluation method for key management. This innovation enables the system to dynamically generate risk coefficients for data through risk assessment models and take corresponding security measures for data of different risk levels, thus avoiding the problem of the inability to effectively predict and respond to key failure in existing technologies. The dynamic risk management mechanism based on real-time data analysis not only enhances the system's ability to respond to potential security threats, but also reduces errors and delays that may be caused by manual intervention, thereby improving the system's automated management level.

[0137] 3. By continuously monitoring the backup process of data at all levels and the execution of key rotation, the system can dynamically adjust the priority of encryption tasks and regularly update the risk assessment model to ensure that the protection strategy is always in an optimized state. This dynamic adjustment mechanism effectively solves the potential risk problems caused by the lag of the key management system, and reasonably allocates resources when the system load is large or the task backlog is large, giving priority to high-risk data, thereby improving the overall system's resilience and efficiency. This long-term, dynamic security mechanism design not only ensures the long-term storage security of data, but also provides an efficient and scalable solution to meet the high requirements of modern scientific research projects for data security.

[0138] In order to enable those skilled in the art to more clearly understand the technical solution of the present application, the implementation process of the data encryption method of the present application will be described in detail below in conjunction with specific embodiments.

[0139] This embodiment relates to a specific data encryption method, such as Figure 3 As shown, the following steps are included:

[0140] Step S1: In the energy data research project, the generated research data is divided into several levels according to the sensitivity level and security requirements, and different encryption strategies and key management mechanisms are assigned to each level.

[0141] Step S2: Acquire the key rotation status information of scientific research data at each level in the data backup process in real time, and analyze it after acquisition to generate the key rotation frequency coefficient and key failure rate index of scientific research data at each level respectively.

[0142] Step S3: Construct a risk assessment model for the key rotation frequency coefficient and key failure rate index of each level of scientific research data generated, generate the risk coefficient of each level of scientific research data, and analyze it after generation to evaluate the key expiration risk level of each level of scientific research data, and divide the scientific research data at each level into high-risk scientific research data, medium-risk scientific research data and low-risk scientific research data according to the evaluation results.

[0143] Step S4: Based on the classification results of scientific research data at various levels, take corresponding security measures for scientific research data of different risk levels.

[0144] Step S5: Continuously monitor the execution of data backup and key rotation at all levels, dynamically adjust the encryption task scheduling priority of data at all levels, regularly update the risk assessment model, and optimize the protection strategy of scientific research data at all levels.

[0145] The present application embodiment also provides a data encryption device. It should be noted that the data encryption device of the present application embodiment can be used to execute the encryption method for data provided by the present application embodiment. The device is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions thereof will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and contemplated.

[0146] The following is an introduction to the data encryption device provided in the embodiments of the present application.

[0147] Figure 4 is a structural block diagram of a data encryption device according to an embodiment of the present application. Figure 4 As shown, the device includes: an acquisition unit 41, a classification unit 42, a first encryption unit 43, a calculation unit 44 and a second encryption unit 45.

[0148] The acquisition unit 41 is used to acquire the data to be encrypted.

[0149] The classification unit 42 is used to classify the data to be encrypted to obtain data to be encrypted of different security types.

[0150] The first encryption unit 43 is used to encrypt all security types of data to be encrypted to obtain initial encrypted data of multiple security types, wherein the security types of data to be encrypted and the encryption methods correspond one to one.

[0151] The calculation unit 44 is used to calculate the risk coefficient of the key of the initial encrypted data of all security types.

[0152] The second encryption unit 45 is used to replace the key to encrypt the data to be encrypted to obtain target encrypted data when the risk coefficient is greater than or equal to a preset risk threshold.

[0153] Through this embodiment, data can be managed in a hierarchical manner, and corresponding encryption methods can be set according to data of different security levels (types). Refined encryption processing can be implemented for data of different levels. Keys can also be updated after encryption when the key risk is high. This can avoid data security vulnerabilities caused by expired keys, thereby improving data security.

[0154] In a specific implementation process, the classification unit includes a first acquisition module and a classification module, the first acquisition module is used to acquire attribute information of the data to be encrypted, wherein the attribute information includes one or more of sensitivity level, importance and confidentiality; the classification module is used to adopt a classification algorithm to classify the data to be encrypted according to the attribute information to obtain first data to be encrypted of a first security type, second data to be encrypted of a second security type and third data to be encrypted of a third security type, wherein the classification algorithm is one or more of a decision tree algorithm, a logistic regression algorithm, a random forest algorithm and a SVM algorithm, wherein the sensitivity level of the first data to be encrypted of the first security type is higher than the sensitivity level of the second data to be encrypted of the second security type, the sensitivity level of the second data to be encrypted of the second security type is higher than the sensitivity level of the third data to be encrypted of the third security type, the importance of the first data to be encrypted of the first security type is higher than the importance of the second data to be encrypted of the second security type, the importance of the second data to be encrypted of the second security type is higher than the importance of the third data to be encrypted of the third security type, the confidentiality of the first data to be encrypted of the first security type is higher than the confidentiality of the second data to be encrypted of the second security type, and the confidentiality of the second data to be encrypted of the second security type is higher than the confidentiality of the third data to be encrypted of the third security type.

[0155] In this scheme, by obtaining the attribute information of the data to be encrypted and classifying the data using a classification algorithm, data to be encrypted of different security types can be obtained. The security level of the data can be determined according to the different attributes of the data, and different encryption methods and measures can be used for encryption processing to protect the security of the data. The data is classified and encrypted according to the attribute information of the data, thereby realizing refined encryption of the data and improving the security and protection level of the data. The data is divided into different security types through a classification algorithm to further improve the security and protection level of the data. By performing multi-level encryption processing on the data, corresponding encryption measures can be taken according to the attribute information of the data, making the data more secure and reliable during transmission and storage. Different encryption methods are used for data of different security types to ensure the security and integrity of the data and effectively prevent data leakage and illegal access.

[0156] In some embodiments, the first encryption unit includes a first encryption module, a second encryption module and a third encryption module, the first encryption module is used to encrypt first data to be encrypted of a first security type using a first update frequency and a first encryption algorithm to obtain first initial encrypted data, wherein the update frequency is the update speed of the key; the second encryption module is used to encrypt second data to be encrypted of a second security type using a second update frequency and a second encryption algorithm to obtain second initial encrypted data, wherein the first update frequency is higher than the second update frequency, and the strength of the first encryption algorithm is higher than the strength of the second encryption algorithm; the third encryption module is used to encrypt third data to be encrypted of a third security type using a third update frequency and a third encryption algorithm to obtain third initial encrypted data, wherein the second update frequency is higher than the third update frequency, and the strength of the second encryption algorithm is higher than the strength of the third encryption algorithm.

[0157] In this solution, by using different update frequencies and encryption algorithms to encrypt data of different security types, the security and protection level of the data can be improved. According to the sensitivity and value of different data, different levels of encryption algorithms and update frequencies are used to effectively prevent data leakage and unauthorized access. By selecting a method with a higher update frequency and a stronger encryption algorithm to encrypt data, it can effectively prevent data from being accessed and stolen without authorization, thereby providing more comprehensive data protection and ensuring the security of data during transmission and storage.

[0158] During the specific implementation process, the above-mentioned calculation unit includes a second acquisition module, a third acquisition module and a calculation module. The second acquisition module is used to obtain the key rotation frequency, wherein the key rotation frequency is the rotation frequency of the key in unit time; the third acquisition module is used to obtain the key failure rate, wherein the key failure rate is the frequency of the key failure during use; the calculation module is used to calculate the risk coefficient of the key of the initial encrypted data of all security types according to the key rotation frequency and the key failure rate.

[0159] In this scheme, calculating the key rotation frequency and key expiration rate can help evaluate and manage the security of keys. The higher the key rotation frequency and the lower the key expiration rate, the better the key management and the higher the security. Otherwise, there may be risks. By calculating the risk coefficient of the key, we can better understand the key management situation, and then more accurately evaluate the risk level of the key, timely discover possible security risks and take corresponding measures to repair and improve them.

[0160] In some embodiments, the second acquisition module includes a first calculation submodule, and the first calculation submodule is used to calculate the key rotation frequency according to a first formula, wherein the first formula is:

[0161]

[0162] KRFC i represents the key rotation frequency of the initial encrypted data of the i-th security type, Indicates the number of rotations of the mth key of the initial encrypted data of the i-th security type in a unit time. Indicates the usage time of the mth key of the initial encrypted data of the i-th security type in unit time, Indicates the rotation time of the mth key of the initial encrypted data of the i-th security type in unit time, Indicates the generation time of the mth key of the initial encrypted data of the i-th security type in unit time, represents the number of encryption tasks waiting to be processed during rotation of the mth key of the initial encrypted data of the i-th security type in unit time, i=1,2,3,...,k, m=1,2,3,...,g, k and g are both positive integers.

[0163] In this scheme, the key rotation frequency is calculated according to the first formula to determine the number of rotations of each key in unit time for the initial encrypted data of each security type. By adjusting the key rotation frequency according to the requirements of different security types, the number of key rotations can be better controlled to ensure that data is fully protected at different security levels. Adjusting the key rotation frequency can balance the relationship between system security and performance, ensuring that the system maintains good performance while maintaining high security. The key rotation frequency can be flexibly adjusted according to actual needs to meet the requirements of different security levels, effectively protect the confidentiality and integrity of data, and prevent keys from being cracked or leaked.

[0164] In a specific implementation process, the third acquisition module includes a second calculation submodule, and the second calculation submodule is used to calculate the key expiration rate according to a second formula, wherein the second formula is:

[0165]

[0166] KFRI i represents the key expiration rate of the initial encrypted data of the i-th security type, Indicates the number of failed rotations of the mth key of the initial encrypted data of the i-th security type within a unit time. Indicates the total number of rotations of the mth key of the initial encrypted data of the i-th security type in a unit time. Indicates the total amount of data backed up by the mth key for the initial encrypted data of the i-th security type in a unit time. It represents the ratio of the successful completion of the encryption task of the mth key for the initial encrypted data of the i-th security type within a unit time.

[0167] In this scheme, the key failure rate calculated according to the second formula can measure the key failure of the initial encrypted data of a specific security type in unit time, that is, the ratio of the number of key failures during the rotation process to the total number of rotations, and then evaluate the efficiency and security of key management, timely discover the failure of keys and take corresponding measures to repair or update the keys. Calculating the key failure rate can help improve data security and protection. By monitoring the key failure rate, problems in the key rotation process can be discovered in a timely manner to avoid the risk of data leakage or destruction. Evaluating the key failure rate is helpful in formulating and adjusting security strategies and improving the overall data protection level.

[0168] In some embodiments, the above-mentioned calculation module includes a construction submodule and an input submodule. The construction submodule is used to construct a risk assessment model, wherein the risk assessment model is trained using multiple sets of training data, and each set of training data in the multiple sets of training data includes historical key rotation frequencies, historical key failure rates, and historical risk coefficients corresponding to historical key rotation frequencies and historical key failure rates obtained within a historical time period; the input submodule is used to input the key rotation frequency and key failure rate into the risk assessment model to obtain the risk coefficients corresponding to the key rotation frequency and key failure rate.

[0169] In this scheme, building a risk assessment model can more accurately evaluate the impact of key rotation frequency and key failure rate on data security. The risk assessment model obtained through training can predict possible future risk factors based on the key rotation frequency and key failure rate in historical data, so as to take corresponding security measures in time to ensure the security of data. By inputting the key rotation frequency and key failure rate into the risk assessment model, the corresponding risk factor can be obtained, thereby better understanding the security status of the system and formulating corresponding key management strategies. At the same time, the risk assessment model obtained through training with multiple sets of training data can more accurately reflect the risk situation in different time periods, and can also help optimize key rotation and failure strategies, improve the security and stability of the system, and reduce potential security risks.

[0170] The data encryption device includes a processor and a memory. The acquisition unit, classification unit, first encryption unit, calculation unit, and second encryption unit are all stored in the memory as program units, and the processor executes the program units stored in the memory to implement corresponding functions. The modules are all located in the same processor; or, the modules are located in different processors in any combination.

[0171] The processor includes a kernel, which retrieves the corresponding program unit from the memory. One or more kernels can be set, and the problem of poor data security caused by poor data encryption in the prior art can be solved by adjusting kernel parameters.

[0172] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0173] An embodiment of the present invention provides a data encryption system, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the one or more programs include an encryption method for executing any of the above data.

[0174] An embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium includes a stored program, wherein when the program is running, a device where the computer-readable storage medium is located is controlled to execute a data encryption method.

[0175] An embodiment of the present invention provides a processor, which is used to run a program, wherein a method for encrypting data is executed when the program is running.

[0176] An embodiment of the present invention provides a device, which includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, at least the following steps are implemented: obtaining data to be encrypted; classifying the data to be encrypted to obtain data to be encrypted of different security types; encrypting the data to be encrypted of all security types to obtain initial encrypted data of multiple security types, wherein the data to be encrypted of the security types correspond to the encryption methods one by one; calculating the risk coefficient of the key of the initial encrypted data of all security types; and when the risk coefficient is greater than or equal to a preset risk threshold, replacing the key to encrypt the data to be encrypted to obtain target encrypted data.

[0177] The devices in this article can be servers, PCs, PADs, mobile phones, etc.

[0178] A computer program product includes a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the data encryption method in each embodiment of the present application are implemented.

[0179] The present application also provides a data encryption system, comprising one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the one or more programs include an encryption method for executing any of the above-mentioned data.

[0180] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0181] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0182] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0183] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1A function specified in one or more boxes.

[0184] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0185] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0186] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0187] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0188] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0189] The above are only preferred embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A data encryption method, characterized in that: include: Obtain the data to be encrypted; Classifying the data to be encrypted to obtain the data to be encrypted of different security types; Encrypting the data to be encrypted of all security types to obtain initial encrypted data of multiple security types, wherein the data to be encrypted of the security types correspond to the encryption methods one by one; Calculate the risk factor of the key of the initial encrypted data of all security types; When the risk coefficient is greater than or equal to a preset risk threshold, the key is replaced to encrypt the data to be encrypted to obtain target encrypted data.

2. The method according to claim 1, characterized in that The data to be encrypted is classified to obtain data to be encrypted of different security types, including: Acquire attribute information of the data to be encrypted, wherein the attribute information includes one or more of sensitivity level, importance and confidentiality; A classification algorithm is adopted to classify the data to be encrypted according to the attribute information to obtain first data to be encrypted of a first security type, second data to be encrypted of a second security type, and third data to be encrypted of a third security type, wherein the classification algorithm is one or more of a decision tree algorithm, a logistic regression algorithm, a random forest algorithm, and a SVM algorithm, wherein the sensitivity level of the first data to be encrypted of the first security type is higher than the sensitivity level of the second data to be encrypted of the second security type, the sensitivity level of the second data to be encrypted of the second security type is higher than the sensitivity level of the third data to be encrypted of the third security type, the importance of the first data to be encrypted of the first security type is higher than the importance of the second data to be encrypted of the second security type, the importance of the second data to be encrypted of the second security type is higher than the importance of the third data to be encrypted of the third security type, the confidentiality of the first data to be encrypted of the first security type is higher than the confidentiality of the second data to be encrypted of the second security type, and the confidentiality of the second data to be encrypted of the second security type is higher than the confidentiality of the third data to be encrypted of the third security type.

3. The method according to claim 2, characterized in that Encrypting the data to be encrypted of all security types to obtain initial encrypted data of multiple security types, including: Using a first update frequency and a first encryption algorithm, encrypting the first to-be-encrypted data of the first security type to obtain first initial encrypted data, wherein the update frequency is an update speed of the key; Using a second update frequency and a second encryption algorithm, encrypting the second to-be-encrypted data of the second security type to obtain second initial encrypted data, wherein the first update frequency is higher than the second update frequency, and the strength of the first encryption algorithm is higher than the strength of the second encryption algorithm; The third data to be encrypted of the third security type is encrypted using a third update frequency and a third encryption algorithm to obtain third initial encrypted data, wherein the second update frequency is higher than the third update frequency, and the strength of the second encryption algorithm is higher than the strength of the third encryption algorithm.

4. The method according to claim 2, characterized in that: Calculate the risk factor of the key for the initial encrypted data of all security types, including: Obtaining a key rotation frequency, wherein the key rotation frequency is a rotation frequency of the key within a unit time; Obtaining a key failure rate, wherein the key failure rate is a frequency at which the key fails during use; The risk coefficient of the key of the initial encrypted data of all security types is calculated according to the key rotation frequency and the key expiration rate.

5. The method according to claim 4, characterized in that Get the key rotation frequency, including: The key rotation frequency is calculated according to a first formula, wherein the first formula is: KRFC i represents the key rotation frequency of the initial encrypted data of the i-th security type, represents the number of rotations of the mth key of the initial encrypted data of the i-th security type within a unit time, represents the usage time of the mth key of the initial encrypted data of the i-th security type in a unit time, represents the rotation time of the mth key of the initial encrypted data of the i-th security type within a unit time, represents the generation time of the mth key of the initial encrypted data of the i-th security type within a unit time, represents the number of encryption tasks waiting to be processed during rotation of the mth key of the initial encrypted data of the i-th security type within a unit time, i=1,2,3,...,k, m=1,2,3,...,g, k and g are both positive integers.

6. The method according to claim 4, characterized in that Get the key expiration rate, including: The key expiration rate is calculated according to a second formula, wherein the second formula is: KFRI i represents the key expiration rate of the initial encrypted data of the i-th security type, represents the number of failed rotations of the mth key of the initial encrypted data of the i-th security type within a unit time, represents the total number of rotations of the mth key of the initial encrypted data of the i-th security type within a unit time, represents the total amount of data backed up by the mth key of the initial encrypted data of the i-th security type in a unit time, It represents the ratio of the successful completion of the encryption task of the mth key of the initial encrypted data of the i-th security type within a unit time.

7. The method according to claim 4, characterized in that According to the key rotation frequency and the key expiration rate, Calculating the risk factor of the key of the initial encrypted data of all security types comprises: Constructing a risk assessment model, wherein the risk assessment model is trained using multiple sets of training data, each set of training data in the multiple sets of training data includes a historical key rotation frequency, a historical key failure rate, and a historical risk coefficient corresponding to the historical key rotation frequency and the historical key failure rate obtained in a historical time period; The key rotation frequency and the key failure rate are input into the risk assessment model to obtain the risk coefficient corresponding to the key rotation frequency and the key failure rate.

8. A data encryption device, characterized in that: include: An acquisition unit, used for acquiring data to be encrypted; A classification unit, used for classifying the data to be encrypted to obtain the data to be encrypted of different security types; A first encryption unit, used for encrypting the data to be encrypted of all security types to obtain initial encrypted data of multiple security types, wherein the data to be encrypted of the security types correspond to the encryption methods one by one; A calculation unit, used for calculating the risk coefficient of the key of the initial encrypted data of all security types; The second encryption unit is used to replace the key to encrypt the data to be encrypted to obtain target encrypted data when the risk coefficient is greater than or equal to a preset risk threshold.

9. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the data encryption method according to any one of claims 1 to 7 are implemented.

10. A data encryption system, characterized in that: include: One or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the one or more programs include an encryption method for executing data described in any one of claims 1 to 7.

Images