Data encryption and decryption method and device, equipment, storage medium and program product

Abstract

The invention provides a data encryption and decryption method and device, equipment, a storage medium and a program product, and relates to the technical field of data processing. The data encryption method comprises the following steps: performing multi-level encryption connection processing on plaintext data to obtain an encryption string and an encryption key, and encrypting a key for decrypting the encryption string to obtain the encryption key; confusing the encrypted string to obtain a confused ciphertext; performing digital signature on the confused ciphertext to obtain a signature string; and generating target encrypted data based on the confusion ciphertext, the signature string, the encryption key and the processing parameters of the confusion processing, and sending the target encrypted data to a receiving end. According to the technical scheme of the invention, the problem of insufficient security of a pure asymmetric encrypted signature is solved, and the operation performance of the system is effectively ensured at the same time.

Description

Background Art

[0002] When different systems exchange information through the network, if it is transmitted in plain text or simply encrypted, it is easy to be intercepted and spread to the network. Therefore, it is necessary to consider security issues such as anti-leakage and anti-tampering from the perspective of distrust. The encryption strength of existing data encryption increases with the increase of the key length used. On the one hand, the longer the key length, the longer the encryption and decryption time will be. It is difficult to balance the two. On the other hand, with the improvement of cryptographic technology and computer computing power, the difficulty of cracking existing data encryption schemes has been continuously reduced, resulting in more and more security threats.

[0003] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0004] The purpose of the present disclosure is to provide a data encryption method, a data encryption device, a data decryption method, a data encryption device, a data decryption device, an electronic device, a computer-readable storage medium and a computer program product, which at least to some extent overcome the problem in the related art that encryption security and system performance cannot be taken into account at the same time.

[0005] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0006] According to one aspect of the present disclosure, there is provided a data encryption method, which is applied to a sending end, and includes: performing multi-level encryption connection processing on plaintext data to obtain an encrypted string and an encryption key, wherein a key for decrypting the encrypted string is encrypted to obtain the encryption key; performing obfuscation processing on the encrypted string to obtain an obfuscated ciphertext; performing digital signing on the obfuscated ciphertext to obtain a signature string; generating target encrypted data based on the obfuscated ciphertext, the signature string, the encryption key, and processing parameters of the obfuscation processing, and sending the target encrypted data to a receiving end.

[0007] In one embodiment of the present disclosure, a multi-level encryption connection process is performed on plaintext data to obtain an encrypted string, including: adding a pre-generated random number to the plaintext data to form merged data; segmenting the merged data based on a segmentation algorithm to obtain multiple segments of segmented data; concatenating and encrypting the multiple segments of segmented data based on a progressive encryption method to obtain an initial encrypted string; and cascading encryption processing on the initial encrypted string to obtain the encrypted string.

[0008] In one embodiment of the present disclosure, the multiple segments of segmented data are concatenated and encrypted based on a progressive encryption method to obtain an initial encrypted string, including: for the first segment of segmented data among the multiple segments of segmented data, encrypting the random number and the first segment of segmented data to obtain a first encrypted segment; for the second segment of segmented data among the multiple segments of segmented data, encrypting the first encrypted segment, the second segment of segmented data and the random number to obtain a second encrypted segment; for other segments of segmented data among the multiple segments of segmented data, encrypting them progressively in sequence based on the previous encrypted segment and the random number until the last segment of segmented data is reached to obtain the initial encrypted string.

[0009] In one embodiment of the present disclosure, performing cascade encryption processing on the initial encrypted string to obtain the encrypted string includes: performing multi-level encryption on the initial encrypted string and the random number based on a preset number of encryption times to obtain the encrypted string.

[0010] In one embodiment of the present disclosure, multi-level encryption connection processing is performed on plaintext data, which also includes: performing the multi-level encryption processing based on a symmetric encryption algorithm; encrypting the key for decrypting the encrypted string to obtain the encryption key, including: encrypting the key of the symmetric encryption algorithm based on the public key of an asymmetric encryption algorithm to obtain the encryption key.

[0011] In one embodiment of the present disclosure, the encrypted string is subjected to obfuscation processing to obtain an obfuscated ciphertext, including: performing a first obfuscation processing on the encrypted string to obtain a first processed ciphertext, and calculating a check code of the first processed ciphertext; and performing a second obfuscation processing on the first processed ciphertext based on the check code to obtain a second processed ciphertext as the obfuscated ciphertext.

[0012] In one embodiment of the present disclosure, a first obfuscation process is performed on the encrypted string to obtain a first processed ciphertext, and a check code of the first processed ciphertext is calculated, including: performing a staggered process on the encrypted string according to a staggered rule to obtain the first processed ciphertext; concatenating a pre-generated random number with the first processed ciphertext to obtain a concatenated ciphertext; and calculating a cyclic redundancy check code of the concatenated ciphertext based on a cyclic redundancy check algorithm as a check code of the first processed ciphertext, wherein the processing parameters of the first obfuscation process include the parameters of the staggered process.

[0013] In one embodiment of the present disclosure, a second obfuscation process is performed on the first processed ciphertext based on the check code to obtain a second processed ciphertext, including: performing a remainder calculation with the first processed ciphertext as the denominator and the check code as the numerator to obtain a remainder; and performing a shuffle operation on the first processed ciphertext based on the length value of the remainder to obtain the second processed ciphertext, wherein the processing parameters of the second obfuscation process include the length value of the remainder.

[0014] In one embodiment of the present disclosure, target encrypted data is generated based on the obfuscated ciphertext, the signature string, the encryption key, and the processing parameters of the obfuscation process, including: generating the target encrypted data based on the obfuscated ciphertext, the signature string, the encryption key, the processing parameters of the obfuscation process, a pre-generated random number used, the remainder, and the corresponding position information.

[0015] In one embodiment of the present disclosure, digitally signing the obfuscated ciphertext to obtain a signature string includes: digitally signing the obfuscated ciphertext and a pre-generated random number based on a private key to obtain the signature string.

[0016] According to another aspect of the present disclosure, a data decryption method is provided, which is applied to a receiving end, and includes: in response to acquired target encrypted data, respectively extracting obfuscated ciphertext, signature string, encryption key and processing parameters of obfuscation processing from the target encrypted data; decrypting the encryption key to obtain a decryption key; restoring the obfuscated ciphertext to an encrypted string based on the processing parameters of the obfuscation processing; performing multi-level decryption and segmentation processing on the encrypted string based on the decryption key to obtain plaintext data; and verifying the plaintext data based on the signature string.

[0017] In one embodiment of the present disclosure, the obfuscated ciphertext is restored to an encrypted string based on the processing parameters of the obfuscation process, including: the target encrypted data also includes a remainder, the obfuscation process parameters include a length value of the remainder, and the obfuscated ciphertext includes a second processed ciphertext; based on the length value of the remainder, the second processed ciphertext is restored in a disordered manner to obtain a first processed ciphertext; the obfuscation process parameters also include parameters of a misalignment process, and based on the parameters of the misalignment process, the first processed ciphertext is restored in a misaligned manner to obtain the encrypted string.

[0018] In one embodiment of the present disclosure, the encrypted string is subjected to multi-level decryption and segmentation processing based on the decryption key to obtain plaintext data, including: performing cascade decryption processing on the encrypted string based on the decryption key to obtain an initial encrypted string; segmenting and decrypting the initial encrypted string based on the decryption key in a decreasing decryption manner to obtain multiple segments of segmented data; and merging the multiple segments of segmented data to obtain the plaintext data.

[0019] In one embodiment of the present disclosure, in response to the acquired target encrypted data, the obfuscated ciphertext, the signature string, the encryption key, and the processing parameters of the obfuscation processing are respectively extracted from the target encrypted data, including: in response to the acquired target encrypted data, extracting the corresponding position information; and extracting the obfuscated ciphertext, the signature string, the encryption key, and the processing parameters of the obfuscation processing based on the corresponding position information.

[0020] According to another aspect of the present disclosure, there is provided a data encryption device, comprising: an encryption module, used to perform multi-level encryption connection processing on plaintext data to obtain an encrypted string and an encryption key, wherein a key for decrypting the encrypted string is encrypted to obtain the encryption key; an obfuscation processing module, used to perform obfuscation processing on the encrypted string to obtain an obfuscated ciphertext; a signature module, used to digitally sign the obfuscated ciphertext to obtain a signature string; and a generation module, used to generate target encrypted data based on the obfuscated ciphertext, the signature string, the encryption key and processing parameters of the obfuscation processing, and send the target encrypted data to a receiving end.

[0021] According to another aspect of the present disclosure, there is provided a data decryption device, comprising: an extraction module, for extracting, in response to acquired target encrypted data, respectively obfuscated ciphertext, a signature string, an encryption key and processing parameters of the obfuscation process from the target encrypted data; a first decryption module, for decrypting the encryption key to obtain a decryption key; a restoration module, for restoring the obfuscated ciphertext to an encrypted string based on the processing parameters of the obfuscation process; a second decryption module, for performing multi-level decryption and segmentation processing on the encrypted string based on the decryption key to obtain plaintext data; and a verification module, for verifying the plaintext data based on the signature string.

[0022] According to another aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; the processor is configured to perform the above-mentioned data encryption method or data decryption method by executing the executable instructions.

[0023] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the above-mentioned data encryption method or data decryption method is implemented.

[0024] According to another aspect of the present disclosure, a computer program product is provided, on which a computer program is stored, and when the computer program is executed by a processor, the above-mentioned data encryption method or data decryption method is implemented.

[0025] The data encryption and decryption scheme provided by the embodiments of the present disclosure obtains an encrypted string by performing multi-level encryption connection processing on the plaintext data to be encrypted, and further performs obfuscation processing on the encrypted string to obtain obfuscated ciphertext, thereby combining the obfuscated ciphertext, signature string, encryption key and other processing parameters together to generate target encrypted data. These data are subjected to multiple encryption, obfuscation and signing processes to ensure the security and integrity of the data, which not only solves the problem of insufficient security of simple asymmetric encryption signatures, but also effectively guarantees the performance of system operation.

[0026] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0028] Figure 1 A schematic diagram showing a data encryption system according to an embodiment of the present disclosure is shown;

[0029] Figure 2 A flow chart of a data encryption method in an embodiment of the present disclosure is shown;

[0030] Figure 3 Another data encryption method flow chart in the embodiment of the present disclosure is shown;

[0031] Figure 4 A flow chart of another data encryption method in an embodiment of the present disclosure is shown;

[0032] Figure 5 A flow chart of another data encryption method in an embodiment of the present disclosure is shown;

[0033] Figure 6 A flow chart of another data encryption method in an embodiment of the present disclosure is shown;

[0034] Figure 7 A flow chart of a data decryption method in an embodiment of the present disclosure is shown;

[0035] Figure 8 A flow chart of a data decryption method in an embodiment of the present disclosure is shown;

[0036] Fig. 9 A schematic diagram of a data encryption device in an embodiment of the present disclosure is shown;

[0037] Fig.10A schematic diagram of a data decryption device in an embodiment of the present disclosure is shown;

[0038] Fig.11 A structural block diagram of a network system in an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0039] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that the disclosure will be more comprehensive and complete and to fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0040] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0041] When different systems interact with each other through communication networks, they always need to consider security issues such as anti-leakage and anti-tampering based on a lack of trust. Digital encryption technology is used to solve data leakage and data tampering problems and ensure data privacy, data integrity and consistency.

[0042] The RSA asymmetric encryption algorithm is one of many algorithms that implement digital encryption and signature technology. Its confidentiality strength increases with the increase of its key length, but the longer the key, the longer it takes to encrypt and decrypt. Therefore, on the one hand, it is necessary to comprehensively consider the sensitivity of the data to be protected, whether it is worth the cost for the attacker to crack it, and the response time required by the system, especially for systems with high user perception; on the other hand, with the leapfrog development of cryptographic technology and computer computing power, the difficulty of cracking the RSA algorithm continues to decrease, making the system using the RSA algorithm face more and more security threats.

[0043] The solution provided in the present application obtains an encrypted string by performing multi-level encryption connection processing on the plaintext data to be encrypted, and further performs obfuscation processing on the encrypted string to obtain obfuscated ciphertext, thereby combining the obfuscated ciphertext, signature string, encryption key and other processing parameters together to generate target encrypted data. These data are encrypted, obfuscated and signed multiple times to ensure the security and integrity of the data, which not only solves the problem of insufficient security of simple asymmetric encryption signatures, but also effectively guarantees the performance of system operation.

[0044] Figure 1 1 is a schematic diagram of a computer system provided by an exemplary embodiment of the present application. The system includes: a plurality of terminals 120 and a server cluster 140.

[0045] The terminal 120 may be a mobile terminal such as a mobile phone, a game console, a tablet computer, an e-book reader, smart glasses, an MP4 (Moving Picture Experts Group Audio Layer IV) player, a smart home device, an AR (Augmented Reality) device, a VR (Virtual Reality) device, or the terminal 120 may also be a personal computer (PC), such as a laptop computer and a desktop computer.

[0046] The terminal 120 may be installed with an application for providing data encryption.

[0047] The terminal 120 is connected to the server cluster 140 via a communication network. Optionally, the communication network is a wired network or a wireless network.

[0048] The server cluster 140 is a server, or is composed of several servers, or is a virtualization platform, or is a cloud computing service center. The server cluster 140 is used to provide background services for applications that provide statistics of service commodities. Optionally, the server cluster 140 undertakes the main computing work and the terminal 120 undertakes the secondary computing work; or, the server cluster 140 undertakes the secondary computing work and the terminal 120 undertakes the main computing work; or, the terminal 120 and the server cluster 140 adopt a distributed computing architecture for collaborative computing.

[0049] In some optional embodiments, one of the server cluster 140 and the terminal 120 is used to store data encryption program information, and the other is used to store data decryption program.

[0050] In some optional embodiments, one terminal 120 is used to store data encryption program information, and another terminal 120 is used to store data decryption program.

[0051] In some optional embodiments, one of the server clusters 140 is used to store data encryption program information, and the other is used to store data decryption program information.

[0052] Optionally, the client of the application installed in different terminals 120 is the same, or the client of the application installed on the two terminals 120 is the client of the same type of application of different control system platforms. Based on the different terminal platforms, the specific form of the client of the application may also be different, for example, the application client may be a mobile client, a PC client or a World Wide Web (Web) client.

[0053] Those skilled in the art will appreciate that the number of the terminals 120 may be more or less. For example, there may be only one terminal, or there may be dozens or hundreds of terminals, or a greater number. The embodiment of the present application does not limit the number and device type of the terminals.

[0054] Optionally, the system may also include a management device ( Figure 1 (not shown), the management device is connected to the server cluster 140 via a communication network. Optionally, the communication network is a wired network or a wireless network.

[0055] Optionally, the above-mentioned wireless network or wired network uses standard communication technology and / or protocol. The network is usually the Internet, but it can also be any network, including but not limited to a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), a mobile, wired or wireless network, a dedicated network or any combination of a virtual private network). In some embodiments, the data exchanged through the network is represented by technologies and / or formats including Hyper Text Mark-up Language (HTML), Extensible Markup Language (XML), etc. In addition, conventional encryption technologies such as Secure Socket Layer (SSL), Transport Layer Security (TLS), Virtual Private Network (VPN), Internet Protocol Security (IPsec) can also be used to encrypt all or some links. In other embodiments, customized and / or dedicated data communication technologies can also be used to replace or supplement the above-mentioned data communication technologies.

[0056] To facilitate understanding, several terms involved in this application are first explained below.

[0057] SM2 is an elliptic curve public key cryptography algorithm, and SM2 is an asymmetric encryption.

[0058] SM4 is a standard packet data algorithm for wireless LANs, with symmetric encryption, and both the key length and packet length are 128 bits.

[0059] CRC32 (Cyclic Redundancy Check) is a commonly used checksum algorithm used to detect errors in data transmission or storage. It calculates a 32-bit checksum value by performing polynomial division on the data, calculates the checksum value again at the receiving end, and compares it with the checksum value at the sending end to determine whether the data has changed or is erroneous.

[0060] The following will describe in more detail the various steps of the data encryption method in this example implementation in conjunction with the accompanying drawings and embodiments.

[0061] Figure 2 A flow chart of a data encryption method in an embodiment of the present disclosure is shown.

[0062] like Figure 2 As shown, a data encryption method according to an embodiment of the present disclosure includes:

[0063] Step S202, performing multi-level encryption connection processing on the plaintext data to obtain an encrypted string and an encryption key, wherein the key for decrypting the encrypted string is encrypted to obtain the encryption key.

[0064] In some embodiments, multi-level encryption connection processing refers to encryption processing in a cascade manner, that is, first performing a first-level encryption on part of the data, and then combining the encrypted data with the unencrypted data for encryption again, and so on, until the connection processing of all plaintext data is completed.

[0065] In some embodiments, multi-level encrypted connection processing may use different encryption algorithms and keys to perform multiple encryption operations to enhance data security.

[0066] In some embodiments, multi-level encrypted connection processing may use the same encryption algorithm and key for multiple encryptions to reduce the time consumption of encryption and decryption while ensuring the security of encryption and decryption.

[0067] In some embodiments, the SM4 algorithm is used to perform multi-level encryption processing.

[0068] In some embodiments, an encrypted string may be generated through layer-by-layer encryption, and an encryption key for decrypting the encrypted string may be generated.

[0069] In some embodiments, the key is a key used by the SM4 algorithm, and the SM2 algorithm is used to encrypt the key to obtain an encrypted key.

[0070] Step S204, performing obfuscation processing on the encrypted string to obtain an obfuscated ciphertext.

[0071] Step S206: digitally sign the obfuscated ciphertext to obtain a signature string.

[0072] In some embodiments, the obfuscated ciphertext is digitally signed to verify the authenticity and integrity of the data. The digital signature uses a private key to sign the data, and the receiving end can use the corresponding public key to verify whether the signature of the data is valid.

[0073] Step S208, generating target encrypted data based on the obfuscated ciphertext, the signature string, the encryption key, and the processing parameters of the obfuscation process, and sending the target encrypted data to the receiving end.

[0074] Among them, the obfuscated ciphertext is the encrypted ciphertext, the signature string is used for verification, the encryption key decrypts the encrypted ciphertext, and the processing parameters of the obfuscation process are used to restore the obfuscation process at the receiving end.

[0075] In this embodiment, an encrypted string is obtained by performing multi-level encryption connection processing on the plaintext data to be encrypted, and the encrypted string is further obfuscated to obtain obfuscated ciphertext, so that the obfuscated ciphertext, signature string, encryption key and other processing parameters are combined together to generate target encrypted data. These data are encrypted, obfuscated and signed multiple times to ensure the security and integrity of the data, which not only solves the problem of insufficient security of simple asymmetric encryption signatures, but also effectively guarantees the performance of system operation.

[0076] In some embodiments, performing obfuscation processing on the encrypted string to obtain obfuscated ciphertext includes: performing a first obfuscation processing on the encrypted string to obtain a first processed ciphertext, and calculating a check code of the first processed ciphertext.

[0077] In some embodiments, obfuscation processing includes but is not limited to data misalignment processing, data disorder processing, data steganography processing, data blurring, data conversion, XOR operations, and the like.

[0078] In some embodiments, the first obfuscation process is performed on the encrypted string to increase the complexity and security of the data.

[0079] In some embodiments, a checksum of the first processed ciphertext is calculated to ensure data integrity and accuracy.

[0080] In some embodiments, a second obfuscation process is performed on the first processed ciphertext based on the verification code to obtain a second processed ciphertext.

[0081] In some embodiments, a second obfuscation process is performed based on the checksum of the first processed ciphertext to further increase the obfuscation level and security of the data and generate a second processed ciphertext.

[0082] In some embodiments, the first obfuscation process is a misalignment process, and the second obfuscation process is a disorder process.

[0083] like Figure 3 As shown, in one embodiment of the present disclosure, a multi-level encryption connection process is performed on the plaintext data to obtain an encrypted string, including:

[0084] Step S302, adding the pre-generated random number to the plaintext data to form merged data.

[0085] Among them, a set of random numbers is first generated, and then these random numbers are merged with the original plaintext data to form new merged data. By adding random numbers, the security of the data is effectively improved and the difficulty of cracking is increased.

[0086] In some embodiments, in multiple steps using random numbers, the same random number may be used or each step may use a different random number.

[0087] Step S304, segmenting the merged data based on a segmentation algorithm to obtain multiple segments of segmented data.

[0088] The merged data will be cut according to the set segmentation algorithm to obtain multiple fragmented data blocks, each of which is called a segmented data.

[0089] In some embodiments, the segmentation algorithm includes but is not limited to an adaptive segmentation algorithm, a threshold-based segmentation algorithm, a window-based segmentation algorithm, a feature point-based segmentation algorithm, and the like.

[0090] Step S306, concatenating and encrypting the multiple segments of data based on a progressive encryption method to obtain an initial encrypted string.

[0091] Among them, multiple segments of split data will be encrypted progressively in sequence, that is, the encryption result of the previous data block will be used as the input for the encryption of the next data block until all the split data are encrypted to obtain an initial encrypted string.

[0092] Step S308, performing cascade encryption processing on the initial encrypted string to obtain an encrypted string.

[0093] The initial encrypted string will be cascaded encrypted again, using a multi-layer encryption algorithm or multiple encryption processes to finally obtain the final encrypted string.

[0094] In this embodiment, by adding random numbers and performing multiple protection measures such as segmentation processing, progressive encryption and cascade encryption, the security of the data is effectively improved, the difficulty of cracking is increased, and the risk of data leakage is reduced. The use of progressive encryption and cascade encryption makes the encryption process more complicated, increases resistance to malicious attacks, and improves the security of the system.

[0095] like Figure 4 As shown, in one embodiment of the present disclosure, multiple segments of segmented data are concatenated and encrypted based on a progressive encryption method to obtain an initial encrypted string, including:

[0096] Step S402: For a first segment of segmented data among multiple segments of segmented data, encrypt the random number and the first segment of segmented data to obtain a first encrypted segment.

[0097] Herein, a random number is first selected, and then the random number and the first segmented data are encrypted to generate a first encrypted segment.

[0098] Step S404: For the second segment of the multiple segmented data, the first encrypted segment, the second segment of the segmented data and the random number are encrypted to obtain a second encrypted segment.

[0099] The first encrypted segment, the second segmented data, and the random number used previously will be simultaneously involved in the encryption operation to generate the second encrypted segment.

[0100] Step S406, for other segmented data in the multiple segmented data, encrypt them sequentially and progressively based on the previous encrypted segment and the random number until the last segmented data is reached to obtain the initial encrypted string.

[0101] Among them, the previous encrypted segment and random number will be used as the encryption input of the current segment segment data, and progressive encryption operations will be performed in sequence until all segment data are processed to obtain the initial encrypted string.

[0102] In some embodiments, the progressive encryption process may use the SM4 algorithm for encryption processing.

[0103] In this embodiment, the encrypted previous encryption segment is applied to the encryption processing of the next encryption segment to implement a progressive encryption of multiple segments of segmented data formed by segmenting plaintext data. After completing the encryption operation of the last segment of segmented data, the initial encryption string of the encryption segments containing all the previous segmented data can be obtained. Each segmented data is processed in a progressive encryption manner, so that the encryption of each data block depends on the previous encryption result, which increases the security of the data transmission process. Moreover, since each segmented data undergoes multiple layers of encryption processing, it helps to ensure the integrity of the data during transmission and storage, and prevent data tampering and damage.

[0104] In one embodiment of the present disclosure, cascade encryption is performed on the initial encrypted string to obtain the encrypted string, including: performing multi-level encryption on the initial encrypted string and a random number based on a preset number of encryptions to obtain the encrypted string.

[0105] The number of encryptions is used to indicate how many times the initial encrypted string and random number are to be encrypted in cascade. The initial encrypted string and random number are used as initial inputs to perform the first encryption operation and obtain the first encryption result. Then the encryption result is used together with the random number as input for the second encryption operation, and so on, until the preset number of encryptions is reached. After multiple cascade encryptions, the final encrypted string is obtained.

[0106] In this embodiment, multiple cascade encryptions increase the complexity and depth of encryption, thereby improving the ability to resist attacks without increasing the difficulty of decryption, thereby increasing the security of data transmission.

[0107] In one embodiment of the present disclosure, performing multi-level encryption connection processing on plaintext data also includes: performing multi-level encryption processing based on a symmetric encryption algorithm.

[0108] In some embodiments, the asymmetric encryption algorithm is the SM4 algorithm.

[0109] The encryption key is obtained by encrypting the key for decrypting the encrypted string, including: encrypting the key of the symmetric encryption algorithm based on the public key of the asymmetric encryption algorithm to obtain the encryption key.

[0110] In some embodiments, the asymmetric encryption algorithm is the SM2 algorithm.

[0111] In this embodiment, by using the SM2 algorithm and the SM4 algorithm for encryption, the encryption processing performance is better and the obtained encrypted data is more secure.

[0112] like Figure 5 As shown, in one embodiment of the present disclosure, performing a first obfuscation process on the encrypted string to obtain a first processed ciphertext, and calculating a check code of the first processed ciphertext, includes:

[0113] Step S502, performing a stagger process on the encrypted string according to a stagger rule to obtain a first processed ciphertext.

[0114] The first obfuscation process is dislocation processing. By rearranging the position of the data, the order of the original data becomes chaotic, increasing the complexity and incomprehensibility of the data. Through dislocation processing, the security and confidentiality of the data can be effectively improved.

[0115] Step S504: concatenate the pre-generated random number with the first processed ciphertext to obtain a concatenated ciphertext.

[0116] The pre-generated random number is concatenated with the first processed ciphertext obtained through the dislocation process. The concatenated ciphertext is concatenated with the random number and the first processed ciphertext. This processing method can make the encryption result more random, increase the difficulty of cracking, and improve the security of the data.

[0117] Step S506, calculating a cyclic redundancy check code of the concatenated ciphertext based on a cyclic redundancy check algorithm as a check code of the first processed ciphertext, wherein the processing parameters of the first obfuscation process include parameters of the misalignment process.

[0118] In some embodiments, a purely digital cyclic redundancy check code is obtained by the CRC32 algorithm. The cyclic redundancy check code is a verification method used to detect errors in data transmission or storage. The check code is obtained by calculating the data and appended to the data for verification at the receiving end. The cyclic redundancy check algorithm can effectively detect whether errors or tampering have occurred in the spliced ​​ciphertext during transmission or storage, thereby ensuring the integrity and reliability of the data.

[0119] In this embodiment, the degree of data obfuscation is increased through dislocation processing and splicing operations, thereby protecting the privacy and security of the data.

[0120] In one embodiment of the present disclosure, digitally signing the obfuscated ciphertext to obtain a signature string includes: digitally signing the obfuscated ciphertext and a pre-generated random number based on a private key to obtain a signature string.

[0121] In this embodiment, a pair of public and private keys is first generated, and then the obfuscated ciphertext and the pre-generated random number are used as input, and the digital signature is calculated using the private key, and finally a digital signature string is obtained. In the verification stage, the recipient can use the sender's public key to verify the signature string to ensure the integrity and authenticity of the data.

[0122] In one embodiment of the present disclosure, performing a second obfuscation process on a first processed ciphertext based on a check code to obtain a second processed ciphertext includes:

[0123] The second obfuscation process is a disorder process, which uses the first process ciphertext as the denominator and the check code as the numerator to perform a remainder calculation to obtain a remainder.

[0124] A scramble operation is performed on the first processed ciphertext based on the length value of the remainder to obtain a second processed ciphertext, wherein the processing parameters of the second obfuscation process include the length value of the remainder.

[0125] In some embodiments, based on the length value of the remainder, a shuffle operation is performed on the first processed ciphertext, that is, the original data is rearranged according to a certain rule to obtain the second processed ciphertext.

[0126] In this embodiment, through the check code and remainder calculation, it can be verified whether the data has been tampered with during the transmission process. The disorder processing changes the order of the first processed ciphertext, thereby increasing the complexity and incomprehensibility of the data, so as to further improve the transmission security.

[0127] In one embodiment of the present disclosure, target encrypted data is generated based on obfuscated ciphertext, signature string, encryption key and processing parameters of obfuscation processing, including: generating target encrypted data based on obfuscated ciphertext, signature string, encryption key, processing parameters of obfuscation processing, used pre-generated random numbers, remainders and corresponding position information.

[0128] In some embodiments, the target encrypted data also includes location information of the above data.

[0129] like Figure 6 As shown, according to another embodiment of the present disclosure, a data encryption method is applied to a server, comprising:

[0130] Step S602: The server generates two random numbers R1 and R2, a symmetric encryption key M1 and encryption times C according to preset rules.

[0131] Step S604, merging the plaintext data with at least one of the random numbers, and segmenting the data according to a segmentation algorithm to obtain multiple segments of segmented data N1 to Nn.

[0132] Step S606: encrypt M1 using the public key of asymmetric encryption to obtain the encryption key Cm.

[0133] Among them, asymmetric encryption uses SM2 algorithm.

[0134] Step S608, merge the random number and the segmented data N1, use the symmetric encryption algorithm to generate the encrypted string CR1, and then generate the encrypted string CR2 by adding CR1+N2+R1, and perform segmented encryption progressively to obtain the initial encrypted string CRn.

[0135] Among them, the symmetric encryption algorithm adopts the SM4 algorithm.

[0136] Step S610, performing cascade encryption on CRn+R2 to obtain an encrypted string CRnc.

[0137] Step S612: The encrypted string CRnc is shifted according to a preset rule to obtain a first processed ciphertext CRnc-K.

[0138] Step S614, concatenate the random number R1 and the ciphertext CRnc-K in sequence, and obtain a purely digital cyclic redundancy check code through the CRC32 algorithm.

[0139] Step S616: perform a remainder operation with the first processed ciphertext CRnc-K as the denominator and the check code as the numerator to obtain a remainder L1.

[0140] Step S618: Perform a shuffle operation on the first processed ciphertext CRnc-K based on the length value of L1 to obtain a second processed ciphertext CRnc-L.

[0141] Step S620: Use the server private key to digitally sign the ciphertext CRnc-L and the random number R1 to obtain a signature string S1.

[0142] Step S622, the random numbers R1 and R2, the hexadecimal value of the length of the ciphertext CRnc-L, the ciphertext CRnc-L, the remainder L1, the encryption key Cm and the signature string S1 are combined and sent to the client.

[0143] In this embodiment, the server first uses a segmentation algorithm to segment the plaintext data according to preset rules, and then uses the symmetric algorithm SM4 to perform segmented encryption and cascade encryption on the segmented data, and performs dislocation processing on the ciphertext obtained after the final encryption according to the preset rules, uses the asymmetric encryption algorithm SM2 to encrypt the secret key of the symmetric algorithm SM4, and performs shuffling processing, and signs the encrypted string and the random number through the national secret algorithm, and then merges the signature string length and the random number based on the CRC32 redundancy algorithm to obtain the subscript value, and performs shuffling operations on the signature string through the subscript value. Finally, the encryption and signature as well as the random number and the bit information in the preset rules that have been specially processed are merged and transmitted, and double-layer encryption is performed through the digital encryption signature algorithm SM2 and the encryption algorithm SM4. At the same time, the data is segmented and encrypted in a progressive manner, and the encrypted string is obfuscated. On this basis, the CRC32 algorithm is introduced to shuffle the encrypted string of the data, and finally a national secret digital signature is performed, which not only solves the problem of insufficient security of asymmetric encryption signature alone, but also effectively guarantees the performance of system operation.

[0144] like Figure 7 As shown, a data decryption method according to an embodiment of the present disclosure is applied to a receiving end, comprising:

[0145] Step S702, in response to the acquired target encrypted data, respectively extracting the obfuscated ciphertext, the signature string, the encryption key and the processing parameters of the obfuscation process from the target encrypted data.

[0146] Step S704: decrypt the encryption key to obtain a decryption key.

[0147] In some embodiments, the encryption key is decrypted using the private key of the SM2 algorithm to obtain a decryption key.

[0148] Step S706, restoring the obfuscated ciphertext to an encrypted string based on the processing parameters of the obfuscation process.

[0149] In some embodiments, the obfuscated ciphertext, ie, the second processed ciphertext, is first restored to the first processed ciphertext using the obfuscation processing parameters, and then the first processed ciphertext is restored to the encrypted string.

[0150] Step S708, performing multi-level decryption and segmentation processing on the encrypted string based on the decryption key to obtain plaintext data.

[0151] The encrypted string is decrypted using a decryption key, and the plaintext data is obtained layer by layer.

[0152] Step S710: verify the plaintext data based on the signature string.

[0153] Among them, the plaintext data is verified based on the signature string to ensure that the data has not been tampered with or damaged during transmission and processing, thereby improving the integrity and reliability of the data.

[0154] In this embodiment, necessary information is extracted from the target encrypted data, the encryption key is decrypted to obtain the decryption key, the encrypted string before the obfuscation process is restored based on the obfuscation parameters, the encrypted string is decrypted based on the decryption key, and finally the plaintext data is verified based on the signature string. This can effectively ensure the secure transmission, decryption processing and integrity verification of the data, and ensure the efficiency of the decryption process.

[0155] In one embodiment of the present disclosure, the obfuscated ciphertext is restored to an encrypted string based on the processing parameters of the obfuscation process, including: the target encrypted data also includes a remainder, the obfuscation process parameters include the length value of the remainder, and the obfuscated ciphertext is a second processed ciphertext; based on the length value of the remainder, the second processed ciphertext is restored in a disordered manner to obtain the first processed ciphertext; the obfuscation process parameters also include parameters of the misalignment process, and the first processed ciphertext is restored in a misaligned manner based on the parameters of the misalignment process to obtain an encrypted string.

[0156] In this embodiment, the obfuscation processing parameters include the length value of the remainder. According to the length value of the remainder, the second processed ciphertext is subjected to a disordered restoration operation to obtain the first processed ciphertext. The obfuscation processing parameters also include a dislocation processing parameter. Based on this parameter, the first processed ciphertext is subjected to a dislocation restoration operation to finally obtain an encrypted string, thereby being able to effectively realize the restoration processing of the encrypted data.

[0157] In one embodiment of the present disclosure, a multi-level decryption and segmentation process is performed on the encrypted string based on a decryption key to obtain plaintext data, including: performing cascade decryption processing on the encrypted string based on the decryption key to obtain an initial encrypted string; segmenting and decrypting the initial encrypted string based on a decreasing decryption method based on the decryption key to obtain multiple segments of segmented data; and merging the multiple segments of segmented data to obtain plaintext data.

[0158] In this embodiment, the decryption key is used to perform cascade decryption processing on the encrypted string, decrypting it layer by layer until the initial encrypted string is restored. Based on the decryption key, the initial encrypted string is segmented and decrypted in a decreasing decryption manner. Each segmentation and decryption operation can obtain a segmented data until multiple segments of segmented data are obtained. Finally, the multiple segments of segmented data are merged to ensure that the merged data is completely consistent with the original plaintext data, thereby ensuring data integrity.

[0159] In one embodiment of the present disclosure, in response to the acquired target encrypted data, obfuscated ciphertext, signature string, encryption key and processing parameters of the obfuscation processing are respectively extracted from the target encrypted data, including: in response to the acquired target encrypted data, extracting corresponding position information; extracting obfuscated ciphertext, signature string, encryption key and processing parameters of the obfuscation processing based on the corresponding position information.

[0160] like Figure 8 As shown, a data decryption method according to another embodiment of the present disclosure is applied to a client, comprising:

[0161] Step S802: receiving target encrypted data and location information of different information in the target encrypted data.

[0162] Step S804: extract the second processed ciphertext and encryption key, as well as obfuscation processing parameters from the target encrypted data.

[0163] Step S806: The obfuscation processing parameters include the length value of the remainder. Based on the length value of the remainder, the second processed ciphertext is restored in random order to obtain the first processed ciphertext.

[0164] Step S808: The obfuscation processing parameters also include the misalignment processing parameters. The first processed ciphertext is misaligned and restored based on the misalignment processing parameters to obtain an encrypted string.

[0165] Step S810: Perform cascade decryption processing on the encrypted string based on the decryption key to obtain an initial encrypted string.

[0166] Step S812, segment and decrypt the initial encrypted string based on the decryption key in a decreasing decryption manner to obtain multiple segments of segmented data.

[0167] Step S814, merging the multiple segments of segmented data to obtain plaintext data.

[0168] Step S816: verify the plaintext data based on the signature string.

[0169] Step S818: Verification is passed, and business operations are performed based on the plaintext data.

[0170] Step S820: If verification fails, the data is discarded.

[0171] In this embodiment, the client first performs a forward operation on the disordered ciphertext and signature string to obtain the correct encryption key and signature string, and then decrypts the symmetric key encryption string through the asymmetric encryption private key to obtain the symmetric encryption key. The encrypted string can then be cascaded and progressively decrypted in segments through the secret key to ultimately obtain the plaintext data, and finally the signature string is verified.

[0172] It should be noted that the above figures are only schematic illustrations of the processes included in the method according to an exemplary embodiment of the present invention, and are not intended to be limiting. It is easy to understand that the processes shown in the above figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0173] Refer to the following Fig. 9 The data encryption device 900 according to the embodiment of the present invention is described. Fig. 9 The data encryption device 900 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0174] The data encryption device 900 is in the form of a hardware module. The components of the data encryption device 900 may include but are not limited to: an encryption module 902, which is used to perform multi-level encryption connection processing on plaintext data to obtain an encrypted string and an encryption key, wherein the key for decrypting the encrypted string is encrypted to obtain the encryption key; an obfuscation processing module 904, which is used to perform obfuscation processing on the encrypted string to obtain an obfuscated ciphertext; a signature module 906, which is used to digitally sign the obfuscated ciphertext to obtain a signature string; a generation module 908, which is used to generate target encrypted data based on the obfuscated ciphertext, the signature string, the encryption key, and the processing parameters of the obfuscation processing, and send the target encrypted data to the receiving end.

[0175] Refer to the following Fig.10 The data decryption device 1000 according to the embodiment of the present invention is described. Fig.10 The data decryption device 1000 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0176] The data decryption device 1000 is in the form of a hardware module. The components of the data decryption device 1000 may include but are not limited to: an extraction module 1002, which is used to extract the obfuscated ciphertext, the signature string, the encryption key and the processing parameters of the obfuscation process from the target encrypted data in response to the acquired target encrypted data; a first decryption module 1004, which is used to decrypt the encryption key to obtain the decryption key; a restoration module 1006, which is used to restore the obfuscated ciphertext to the encryption string based on the processing parameters of the obfuscation process; a second decryption module 1008, which is used to perform multi-level decryption and segmentation processing on the encryption string based on the decryption key to obtain plaintext data; and a verification module 1010, which is used to verify the plaintext data based on the signature string.

[0177] It will be appreciated by those skilled in the art that various aspects of the present invention may be implemented as a system, method or program product. Therefore, various aspects of the present invention may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as a "circuit", "module" or "system".

[0178] Refer to the following Fig.11 The electronic device 1100 according to this embodiment of the present invention is described. Fig.11 The electronic device 1100 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0179] like Fig.11 As shown, the electronic device 1100 is in the form of a general computing device. The components of the electronic device 1100 may include but are not limited to: at least one processing unit 1110, at least one storage unit 1120, and a bus 1130 connecting different system components (including the storage unit 1120 and the processing unit 1110).

[0180] The storage unit stores program codes, which can be executed by the processing unit 1110, so that the processing unit 1110 performs the steps according to various exemplary embodiments of the present invention described in the above “Exemplary Method” section of this specification. For example, the processing unit 1110 can perform the following steps: Figure 2 The scheme described in steps S202 to S210 shown in FIG.

[0181] The storage unit 1120 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 11201 and / or a cache storage unit 11202 , and may further include a read-only storage unit (ROM) 11203 .

[0182] The storage unit 1120 may also include a program / utility 11204 having a set (at least one) of program modules 11205, such program modules 11205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0183] Bus 1130 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0184] The electronic device 1100 may also communicate with one or more external devices 1170 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 1100, and / or communicate with any device that enables the electronic device 1100 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 1150. Furthermore, the electronic device 1100 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 1160. As shown, the network adapter 1160 communicates with other modules of the electronic device 1100 via a bus 1130. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 1100, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0185] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or an electronic device, etc.) to execute the method according to the implementation of the present disclosure.

[0186] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the above method of the present specification is stored. In some possible implementations, various aspects of the present invention may also be implemented in the form of a program product, which includes a program code, and when the program product is run on an electronic device, the program code is used to enable the electronic device to perform the steps according to various exemplary implementations of the present invention described in the above "Exemplary Method" section of the present specification.

[0187] The program product for implementing the above method according to an embodiment of the present invention may adopt a portable compact disk read-only memory (CD-ROM) and include program code, and may be run on an electronic device, such as a personal computer. However, the program product of the present invention is not limited thereto, and in this document, a readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, apparatus, or device.

[0188] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0189] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0190] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0191] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0192] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0193] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0194] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or an electronic device, etc.) to execute the method according to the implementation of the present disclosure.

[0195] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any modification, use or adaptation of the present disclosure, which follows the general principles of the present disclosure and includes common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the appended claims.

Claims

1. A data encryption method, characterized in that: Applied to the sending end, including: Performing multi-level encryption connection processing on the plaintext data to obtain an encrypted string and an encryption key, wherein the encryption key is obtained by encrypting a key for decrypting the encrypted string; Obfuscating the encrypted string to obtain an obfuscated ciphertext; Digitally signing the obfuscated ciphertext to obtain a signature string; Target encrypted data is generated based on the obfuscated ciphertext, the signature string, the encryption key, and processing parameters of the obfuscation process, and the target encrypted data is sent to a receiving end.

2. The data encryption method according to claim 1, characterized in that: Perform multi-level encryption connection processing on the plaintext data to obtain an encrypted string, including: Adding a pre-generated random number to the plaintext data to form combined data; Segment the merged data based on a segmentation algorithm to obtain multiple segments of segmented data; Concatenate and encrypt the multiple segments of data based on a progressive encryption method to obtain an initial encrypted string; The initial encrypted string is subjected to cascade encryption processing to obtain the encrypted string.

3. The data encryption method according to claim 2, characterized in that: The multiple segments of segmented data are concatenated and encrypted based on a progressive encryption method to obtain an initial encrypted string, including: For a first segment of the multiple segments of data, encrypt the random number and the first segment of data to obtain a first encrypted segment; For a second segment of the multiple segments of data, encrypt the first encrypted segment, the second segment of data, and the random number to obtain a second encrypted segment; For the other segments of the multiple segments of data, encryption is performed in sequence based on the previous encrypted segment and the random number until the last segment of data is reached to obtain the initial encrypted string.

4. The data encryption method according to claim 2, characterized in that: Performing cascade encryption processing on the initial encrypted string to obtain the encrypted string includes: Based on a preset number of encryption times, the initial encrypted string and the random number are encrypted in multiple stages to obtain the encrypted string.

5. The data encryption method according to claim 1, characterized in that: Performing multi-level encryption connection processing on the plaintext data also includes: performing the multi-level encryption processing based on a symmetric encryption algorithm; The key for decrypting the encrypted string is encrypted to obtain the encryption key, comprising: encrypting the key of the symmetric encryption algorithm based on the public key of the asymmetric encryption algorithm to obtain the encryption key.

6. The data encryption method according to claim 1, characterized in that: Obfuscating the encrypted string to obtain an obfuscated ciphertext includes: Performing a first obfuscation process on the encrypted string to obtain a first processed ciphertext, and calculating a check code of the first processed ciphertext; The first processed ciphertext is subjected to a second obfuscation process based on the verification code to obtain a second processed ciphertext as the obfuscated ciphertext.

7. The data encryption method according to claim 6, characterized in that: Performing a first obfuscation process on the encrypted string to obtain a first processed ciphertext, and calculating a check code of the first processed ciphertext, including: Performing dislocation processing on the encrypted string according to a dislocation rule to obtain the first processed ciphertext; Concatenate the pre-generated random number with the first processed ciphertext to obtain a concatenated ciphertext; Calculating a cyclic redundancy check code of the concatenated ciphertext based on a cyclic redundancy check algorithm as a check code of the first processed ciphertext, The processing parameters of the first obfuscation process include the parameters of the misalignment process.

8. The data encryption method according to claim 6, characterized in that: Performing a second obfuscation process on the first processed ciphertext based on the verification code to obtain a second processed ciphertext includes: Taking the first processed ciphertext as the denominator and the check code as the numerator, performing a remainder calculation to obtain a remainder; Performing a shuffle operation on the first processed ciphertext based on the length value of the remainder to obtain the second processed ciphertext, The processing parameters of the second obfuscation process include the length value of the remainder.

9. The data encryption method according to claim 8, characterized in that: Generating target encrypted data based on the obfuscated ciphertext, the signature string, the encryption key, and the processing parameters of the obfuscation process includes: The target encrypted data is generated based on the obfuscated ciphertext, the signature string, the encryption key, the processing parameters of the obfuscation process, the used pre-generated random number, the remainder, and the corresponding position information.

10. The data encryption method according to any one of claims 1 to 9, characterized in that: The obfuscated ciphertext is digitally signed to obtain a signature string, including: The obfuscated ciphertext and the pre-generated random number are digitally signed based on a private key to obtain the signature string.

11. A data decryption method, characterized in that: Applied to the receiving end, including: In response to the acquired target encrypted data, respectively extracting the obfuscated ciphertext, the signature string, the encryption key, and the processing parameters of the obfuscation process from the target encrypted data; Decrypting the encryption key to obtain a decryption key; Restoring the obfuscated ciphertext to an encrypted string based on the processing parameters of the obfuscation process; Performing multi-level decryption and segmentation processing on the encrypted string based on the decryption key to obtain plaintext data; The plaintext data is verified based on the signature string.

12. The data decryption method according to claim 11, characterized in that: The target encrypted data further includes a remainder, the obfuscation processing parameter includes a length value of the remainder, the obfuscated ciphertext includes a second processed ciphertext, and restoring the obfuscated ciphertext to an encrypted string based on the obfuscation processing parameter includes: Based on the length value of the remainder, performing random restoration on the second processed ciphertext to obtain the first processed ciphertext; The obfuscation processing parameters also include misalignment processing parameters, and the first processed ciphertext is misaligned and restored based on the misalignment processing parameters to obtain the encrypted string.

13. The data decryption method according to claim 11, characterized in that: The encrypted string is subjected to multi-level decryption and segmentation processing based on the decryption key to obtain plaintext data, including: Performing cascade decryption processing on the encrypted string based on the decryption key to obtain an initial encrypted string; Based on the decryption key, the initial encrypted string is segmented and decrypted in a decreasing decryption manner to obtain multiple segments of segmented data; The multiple segments of segmented data are merged to obtain the plaintext data.

14. The data decryption method according to any one of claims 11 to 13, characterized in that: In response to the acquired target encrypted data, the obfuscated ciphertext, the signature string, the encryption key, and the processing parameters of the obfuscation process are respectively extracted from the target encrypted data, including: In response to the acquired target encrypted data, extracting corresponding location information; The obfuscated ciphertext, the signature string, the encryption key and the processing parameters of the obfuscation process are respectively extracted based on the corresponding position information.

15. A data encryption device, characterized in that: Applied to the sending end, including: An encryption module, used for performing multi-level encryption connection processing on plain text data to obtain an encryption string and an encryption key, wherein the encryption key is obtained by encrypting a key for decrypting the encryption string; An obfuscation processing module, used to perform obfuscation processing on the encrypted string to obtain an obfuscated ciphertext; A signature module, used to digitally sign the obfuscated ciphertext to obtain a signature string; A generation module is used to generate target encrypted data based on the obfuscated ciphertext, the signature string, the encryption key and the processing parameters of the obfuscation process, and send the target encrypted data to a receiving end.

16. A data decryption device, characterized in that: Applied to the receiving end, including: An extraction module, configured to extract, in response to the acquired target encrypted data, the obfuscated ciphertext, the signature string, the encryption key, and the processing parameters of the obfuscation process from the target encrypted data; A first decryption module, used to decrypt the encryption key to obtain a decryption key; A restoration module, used for restoring the obfuscated ciphertext to an encrypted string based on the processing parameters of the obfuscation process; A second decryption module, used to perform multi-level decryption and segmentation processing on the encrypted string based on the decryption key to obtain plaintext data; A verification module is used to verify the plaintext data based on the signature string.

17. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; The processor is configured to execute the data encryption method according to any one of claims 1 to 10 or the data decryption method according to claims 11 to 14 by executing the executable instructions.

18. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the data encryption method according to any one of claims 1 to 10 or the data decryption method according to claims 11 to 14 is implemented.

19. A computer program product having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the data encryption method according to any one of claims 1 to 10 or the data decryption method according to claims 11 to 14 is implemented.

Images