Data encryption method

Abstract

The invention relates to a data encryption method. The method comprises the following steps: determining a first public and private key pair and a second encryption and decryption key pair; the first public and private key pair comprises a first public key and a first private key; the second encryption and decryption key pair comprises a second encryption key and a second decryption key; based on the first public key, encrypting the plaintext data to obtain a data encryption result; storing the first private key in a preset key library, and encrypting the preset key library; code obfuscation is carried out on a target program used for decrypting the encrypted preset key library, and a program obfuscation result is obtained; based on a second encryption key, encrypting a file to which the data encryption result belongs to obtain a file encryption result; and based on the first public key, encrypting the second decryption key to obtain a key encryption result. By encrypting the plaintext data and providing additional protection for the obtained data encryption result and the first private key for decryption, the security of the data can be improved.

Description

Technical Field

[0001] The present disclosure relates to the field of data security technology, and in particular to a data encryption method. Background Art

[0002] With the development of Internet technology, massive amounts of data are generated every moment, including data that should not be leaked, such as user information, data assets, and business secrets. Therefore, data security has gradually become a focus of attention.

[0003] There is an urgent need for a method that can improve data security. Summary of the invention

[0004] In view of this, the present disclosure proposes a data encryption method to improve data security.

[0005] According to one aspect of the present disclosure, there is provided a data encryption method, comprising:

[0006] Determine a first public-private key pair and a second encryption-decryption key pair; the first public-private key pair includes a first public key and a first private key; the second encryption-decryption key pair includes a second encryption key and a second decryption key;

[0007] Encrypt the plaintext data based on the first public key to obtain a data encryption result;

[0008] Storing the first private key in a preset key library and encrypting the preset key library;

[0009] Perform code obfuscation on the target program used to decrypt the encrypted preset key library to obtain a program obfuscation result;

[0010] Based on the second encryption key, encrypt the file to which the data encryption result belongs to, to obtain a file encryption result;

[0011] Based on the first public key, the second decryption key is encrypted to obtain a key encryption result.

[0012] According to another aspect of the present disclosure, a computer program product for data decryption is provided, the program product comprising: a file encryption result, a key encryption result, a program obfuscation result, and an encrypted preset key library;

[0013] The file encryption result is obtained by encrypting the file to which the data encryption result belongs based on the second encryption key in advance; the data encryption result is obtained by encrypting the plaintext data based on the first public key in advance;

[0014] The key encryption result is obtained by encrypting the second decryption key based on the first public key in advance;

[0015] The encrypted preset key library stores a first private key;

[0016] The program obfuscation result is obtained by pre-obfuscating the target program in the program product for decrypting the encrypted preset key library;

[0017] The program product performs the following steps when running:

[0018] Calling the program to obfuscate the result, decrypting the encrypted preset key library, and determining the first private key in the decrypted preset key library;

[0019] Decrypting the key encryption result based on the determined first private key to obtain a second decryption key;

[0020] Decrypting the file encryption result based on the obtained second decryption key to obtain the file to which the data encryption result belongs, and determining the data encryption result from the obtained file;

[0021] Based on the determined first private key, the determined data encryption result is decrypted to obtain the plaintext data.

[0022] According to another aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing processor-executable instructions; wherein the processor is configured to implement the above method when executing the instructions stored in the memory.

[0023] According to another aspect of the present disclosure, a non-volatile computer-readable storage medium is provided, on which computer program instructions are stored, wherein the computer program instructions implement the above method when executed by a processor.

[0024] According to another aspect of the present disclosure, a computer program product is provided, including a computer-readable code, or a non-volatile computer-readable storage medium carrying the computer-readable code. When the computer-readable code runs in a processor of an electronic device, the processor in the electronic device executes the above method.

[0025] According to the above embodiment, by encrypting plaintext data and providing additional protection for the obtained data encryption result and the first private key used for decryption, the security of data can be improved.

[0026] According to the following detailed description of exemplary embodiments with reference to the accompanying drawings, other features and aspects of the present disclosure will become clear.It should be understood that the above general description and the following detailed description are only exemplary and explanatory and cannot limit the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate exemplary embodiments, features, and aspects of the disclosure and, together with the description, serve to explain the principles of the disclosure.

[0028] Figure 1 A flow chart showing a data encryption method according to an embodiment of the present disclosure is shown;

[0029] Figure 2 A schematic diagram showing the principle of a data encryption method according to an embodiment of the present disclosure;

[0030] Figure 3 A structural diagram of a business system according to an embodiment of the present disclosure is shown;

[0031] Figure 4 A schematic diagram showing the principle of a data decryption method according to an embodiment of the present disclosure;

[0032] Figure 5 A schematic diagram of a secondary password page according to an embodiment of the present disclosure is shown;

[0033] Figure 6 A schematic diagram showing a page of a vocabulary encryption tool according to an embodiment of the present disclosure;

[0034] Figure 7 A schematic diagram of a page showing a sensitive word ciphertext word list according to an embodiment of the present disclosure;

[0035] Figure 8 A schematic diagram of a code obfuscated page according to an embodiment of the present disclosure is shown;

[0036] Fig. 9 A schematic diagram of a decompiled page according to an embodiment of the present disclosure is shown;

[0037] Fig.10 A schematic diagram of a page showing document encryption according to an embodiment of the present disclosure is shown;

[0038] Fig.11 A schematic diagram of a page for editing a vocabulary library version according to an embodiment of the present disclosure is shown;

[0039] Fig.12 A schematic diagram showing a page of different versions of a vocabulary library according to an embodiment of the present disclosure;

[0040] Fig.13 A flowchart showing vocabulary management and user review according to an embodiment of the present disclosure is shown;

[0041] Fig.14 It is a block diagram of a device 1900 for implementing the method of the embodiment of the present disclosure, according to an exemplary embodiment. DETAILED DESCRIPTION

[0042] Various exemplary embodiments, features and aspects of the present disclosure will be described in detail below with reference to the accompanying drawings. The same reference numerals in the accompanying drawings represent elements with the same or similar functions. Although various aspects of the embodiments are shown in the accompanying drawings, the drawings are not necessarily drawn to scale unless otherwise specified.

[0043] The word “exemplary” is used exclusively herein to mean “serving as an example, example, or illustration.” Any embodiment described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.

[0044] In addition, in order to better illustrate the present disclosure, numerous specific details are given in the following specific embodiments. It should be understood by those skilled in the art that the present disclosure can also be implemented without certain specific details. In some examples, methods, means, components and circuits well known to those skilled in the art are not described in detail in order to highlight the subject matter of the present disclosure.

[0045] With the development of Internet technology, massive amounts of data are generated every moment, including data that should not be leaked, such as user information, data assets, and business secrets. Therefore, data security has gradually become a focus of attention.

[0046] There is an urgent need for a method that can improve data security.

[0047] In order to solve the above problems, an embodiment of the present disclosure provides a data encryption method.

[0048] In this method, the first encryption key may be used to encrypt the plaintext data to obtain the ciphertext data.

[0049] Afterwards, the ciphertext data itself and the corresponding first decryption key can be protected respectively. The first decryption key can be used to decrypt the ciphertext encrypted by the first encryption key.

[0050] The corresponding first decryption key may be further protected in other ways, specifically, the first decryption key may be stored in a key store KeyStore, which itself is encrypted and protected, thereby improving the security of the first decryption key and increasing the cost of cracking and obtaining the first decryption key.

[0051] As for the keystore KeyStore, the corresponding decryption program, that is, the decryption program used to decrypt the keystore KeyStore, can be protected by code obfuscation, thereby improving the security of the keystore and increasing the difficulty and cost of cracking the keystore and the decryption program by reverse engineering.

[0052] The ciphertext data itself can be further protected by additional encryption. The ciphertext data is usually stored in a file, which can contain some metadata of the plaintext data, such as the number, size, and brief information of the plaintext data, so that additional encryption protection can be performed on the entire file to which the ciphertext data belongs.

[0053] For this additional encryption, since the first decryption key is protected by the key library, the first encryption key can also be used for protection.

[0054] Of course, other second encryption keys may also be used for encryption, and the corresponding second decryption key may be encrypted and protected by the first encryption key. The second decryption key may be used to decrypt the ciphertext encrypted by the second encryption key.

[0055] The method can improve data security by encrypting plaintext data and providing additional protection for decryption keys and ciphertext data.

[0056] A data encryption method provided by an embodiment of the present disclosure is explained in detail below.

[0057] The method flow does not limit the execution subject. The method flow can be applied to a server, a user terminal, or any electronic device or computing device.

[0058] Figure 1 A flow chart of a data encryption method according to an embodiment of the present disclosure is shown. Figure 1 As shown, the method may include the following steps:

[0059] S101: Determine a first public-private key pair and a second encryption-decryption key pair.

[0060] The first public-private key pair may include a first public key and a first private key; the first private key may be used to decrypt ciphertext encrypted using the first public key.

[0061] The second encryption / decryption key pair may include a second encryption key and a second decryption key; the second decryption key may be used to decrypt the ciphertext encrypted using the second encryption key.

[0062] S102: Encrypt the plaintext data based on the first public key to obtain a data encryption result.

[0063] S103: Store the first private key in a preset key library, and encrypt the preset key library.

[0064] S104: Perform code obfuscation on the target program used to decrypt the encrypted preset key library to obtain a program obfuscation result.

[0065] S105: Encrypt the file to which the data encryption result belongs based on the second encryption key to obtain a file encryption result.

[0066] S106: Encrypt the second decryption key based on the first public key to obtain a key encryption result.

[0067] The method process can improve data security by encrypting plaintext data and providing additional protection for the obtained data encryption result and the first private key used for decryption.

[0068] Wherein, by storing the first private key in a preset key library and encrypting the preset key library, the security of the first private key is improved.

[0069] By performing code obfuscation on the target program used to decrypt the encrypted preset key library, the difficulty and cost of reverse engineering the target program can be increased, thereby improving the security of the preset key library and the security of the first private key in the preset key library.

[0070] By encrypting the file to which the data encryption result belongs, the security of the data encryption result can be improved.

[0071] By encrypting the second decryption key with the first public key, the security of the second decryption key can be improved, and by reusing the first public key encryption, the security of the already protected first private key can be utilized, and there is no need to repeatedly protect the first private key, thereby reducing the protection cost.

[0072] In the process of this method, the first public key can be used to encrypt plaintext data, and the second decryption key can be encrypted. Accordingly, the first private key can be protected by a preset key library and code obfuscation. Through this step, the decryption keys of two different encryption objects can be protected at the same time, thereby improving data security while further reducing the amount of calculation, improving the efficiency of encryption protection, and reducing the cost of encryption protection.

[0073] Furthermore, since the first public key is used to encrypt the key, the data volume of the key is relatively small, thereby reducing the amount of calculation, improving the efficiency of encryption protection, and reducing the cost of encryption protection.

[0074] The method flow does not limit the specific execution order of the steps.

[0075] It is understandable that the execution order of determining the first public-private key pair and determining the second encryption / decryption key pair in S101 is not limited. The first public-private key pair and the second encryption / decryption key pair may be determined in parallel, or the first public-private key pair may be determined first and then the second encryption / decryption key pair may be determined.

[0076] Optionally, different steps with dependencies can be limited in order of execution. For example, S105 needs to encrypt the file to which the data encryption result belongs, that is, it needs to execute the data encryption result obtained by S102, so it can be executed after S102 is completed. For different steps without dependencies, the order of execution can be unlimited, and they can be executed in parallel or one after another. For example, S102, S103, S104 and S106 can be executed in parallel; or S106 and S103 can be executed first, and then S102 and S104. Other similar examples will not be repeated.

[0077] For ease of understanding, the present disclosure also provides a process example of a data encryption method.

[0078] Figure 2 FIG. 1 is a schematic diagram showing the principle of a data encryption method according to an embodiment of the present disclosure. Figure 2 As shown, for the plaintext data, the data encryption result can be obtained by encrypting with the first public key, and then the file to which the data encryption result belongs can be encrypted with the second encryption key to obtain the file encryption result. After that, the first private key can be stored in the preset key library, and the preset key library can be encrypted. The code obfuscation can also be performed on the target program used to decrypt the encrypted preset key library to obtain the program obfuscation result. The second decryption key can also be encrypted with the first public key to obtain the key encryption result.

[0079] This method process is not limited to a specific application scenario.

[0080] It is understandable that the process of this method can protect plaintext data through operations such as encryption, improve the security of plaintext data, and increase the difficulty and cost of cracking decryption keys and plaintext data.

[0081] In an example application scenario, plaintext data may be required to execute a business. Therefore, when executing the business, it is necessary to obtain the plaintext data through a decryption step based on the encryption protection result of the method process, and execute the corresponding business based on the plaintext data, thereby improving data security during the business execution process.

[0082] For the convenience of description, the device that encrypts and protects the plaintext data through the process of this method is called the business party device, and the corresponding organization is called the business party. The business party can be the holder, controller or manager of the plaintext data.

[0083] Specifically, the business party itself needs plaintext data to execute business. For security reasons, the business party encrypts and protects it locally through the process of this method. When it is necessary to execute business, the encryption protection result of the method process is locally obtained by the business party through a decryption step to obtain plaintext data, and the corresponding business is executed based on the plaintext data.

[0084] Specifically, the user may need the plaintext data of the business party to execute the business. In one case, the business party sends the encryption protection result of the process of this method to the user terminal, so that the user terminal obtains the plaintext data through the decryption step for the encryption protection result of the process of this method, and executes the corresponding business based on the plaintext data. In another case, the user terminal may initiate a business request, and the business party decrypts the plaintext data locally, executes the corresponding business, and returns the business execution result to the user terminal. The local business party may be the server.

[0085] For ease of understanding, Figure 3 FIG. 1 shows a structural diagram of a business system according to an embodiment of the present disclosure. Figure 3 As shown, it includes a business party and multiple user terminals. The specific explanation of the business party and the user terminal can be found above. The business party device can specifically be a server.

[0086] In another application scenario example, different devices may need to exchange plaintext data. For data security reasons, the sending end may encrypt and protect the plaintext data based on the process of this method, and send the encrypted protection result to the receiving end, which decrypts the encrypted protection result to obtain the plaintext data, thereby improving data security during data transmission. In one example, the sending end may be the above-mentioned business party device, and the receiving end may be the above-mentioned user terminal.

[0087] The method flow is not limited to specific plaintext data. Optionally, the plaintext data may be at least one of the following: business data plaintext, user information plaintext, commercial secret plaintext, and project information plaintext, etc.

[0088] In a specific example, the plaintext data may specifically be a sensitive word list. The plaintext data may specifically include at least one sensitive word plaintext. In a specific business, sensitive word proofreading or sensitive word review may be performed on the text based on the plaintext data, specifically, whether the text contains any sensitive word in the plaintext data. The present disclosure does not limit the specific form of sensitive words, which may specifically be in the form of characters, words, phrases, search formulas, etc. Therefore, the process of the present method may be to encrypt and protect the plaintext of sensitive words.

[0089] It is understandable that this method is for encrypting and protecting a single plaintext data, but for multiple different plaintext data, this method can be used to encrypt and protect them respectively, and other steps and explanations in this method can also be applied to different plaintext data.

[0090] Among them, different public keys can be used to encrypt different plaintext data, and the corresponding private keys can be stored in the preset key library respectively, so that by obfuscating the code of the target program, several different private keys stored in the preset key library can be protected together.

[0091] After these different plaintext data are encrypted, different data encryption results can be deployed in different files. Specifically, different encryption keys can be used to encrypt the different files as a whole; or they can be deployed in the same file, so that the second encryption key can be used to encrypt the entire file. In this way, these different data encryption results can be protected together with the help of file encryption, reducing the cost of encryption protection.

[0092] In an optional embodiment, different plaintext data may be encrypted based on different public keys (for the convenience of distinction, each public key is referred to as a target public key here) to obtain a data encryption result containing several ciphertext data. The public key and the plaintext data may correspond one to one, so that the only corresponding plaintext data may be encrypted based on any public key. Any public key may be used to encrypt only one plaintext data, and any plaintext data may be encrypted using only one public key.

[0093] Accordingly, the target private keys corresponding to the aforementioned target public keys can be stored in a preset key library, and the preset key library can be encrypted. Code obfuscation is performed on the target program used to decrypt the encrypted preset key library to obtain a program obfuscation result.

[0094] Correspondingly, the file to which the data encryption result belongs can be encrypted based on the second encryption key to obtain a file encryption result.

[0095] Accordingly, the second decryption key can be encrypted based on the aforementioned target public keys to obtain a key encryption result. This embodiment does not limit the specific encryption method. The second decryption key can be encrypted using any of the aforementioned target public keys, or multiple target public keys can be nested to encrypt the second decryption key.

[0096] In a specific example, the plaintext data may be at least one sensitive word plaintext in the sensitive word list. The above different plaintext data may specifically be different sensitive word plaintexts in the sensitive word list. For example, the sensitive word list may contain 1,000 sensitive word plaintexts, so 10 groups of data may be divided, each group containing 100 sensitive word plaintexts, and each group of data is used as plaintext data, so that 10 plaintext data may be obtained.

[0097] The following is a detailed explanation of each aspect of the method.

[0098] The method flow does not limit the form and determination method of the first public-private key pair. Specifically, the first public-private key pair stored in advance may be directly determined, or the first public-private key pair may be created in real time.

[0099] The process of this method does not limit the form and determination method of the second encryption and decryption key pair. The second encryption and decryption key pair can be an asymmetric key or a symmetric key. The second encryption key can be the same as the second decryption key. Specifically, the second encryption and decryption key pair stored in advance can be directly determined, or the second encryption and decryption key pair can be created in real time. Among them, the second encryption and decryption key pair can be generated by a key generation algorithm, or the second encryption and decryption key pair set by an administrator or other user can be obtained.

[0100] The process of this method does not limit the specific way of encrypting the plaintext data. Optionally, the plaintext data as a whole can be encrypted based on the first public key; the plaintext data can also include several pieces of data, so each piece of data in the plaintext data can be encrypted based on the first public key; or the plaintext data can include several pieces of data, and these data can be divided into several groups, so each group of data in the plaintext data can be encrypted based on the first public key.

[0101] In a specific example, the plaintext data may include at least one sensitive word plaintext. Encrypting the plaintext data based on the first public key may specifically be, for each sensitive word plaintext in the plaintext data, encryption based on the first public key is performed to obtain a data encryption result including several sensitive word ciphertexts; or encryption based on the first public key is performed to different groups of sensitive word plaintexts in the plaintext data, to obtain a data encryption result including several groups of sensitive word ciphertexts, wherein any group of sensitive word plaintexts may include at least one sensitive word plaintext.

[0102] Therefore, optionally, the plaintext data may include: at least one sensitive word plaintext; based on the first public key, the plaintext data is encrypted to obtain a data encryption result, which may specifically be: based on the first public key, different sensitive word plaintexts are encrypted respectively to obtain a data encryption result containing several sensitive word ciphertexts.

[0103] This embodiment can perform encryption protection on the plaintext of sensitive words, and can improve the security of the plaintext of sensitive words and increase the difficulty and cost of cracking the ciphertext of sensitive words by encrypting the plaintext of different sensitive words respectively.

[0104] This method process explains the encryption protection for plain text data. When the plain text data needs to be used, the encryption protection result needs to be decrypted.

[0105] The method flow does not limit the specific execution subject of decryption. Specifically, it can be the execution subject of the method flow itself, or other devices can perform decryption. For the corresponding scenario explanation, please refer to the explanation of the application scenario above.

[0106] Therefore, optionally, the method may further include at least one of the following:

[0107] 1) In the first preset case, a decryption step is performed based on the encrypted preset key library, the key encryption result, the program obfuscation result and the file encryption result.

[0108] 2) Under the second preset condition, the encrypted preset key library, key encryption result, program obfuscation result and file encryption result are sent to the receiving end, so that the receiving end performs the decryption step based on the encrypted preset key library, key encryption result, program obfuscation result and file encryption result.

[0109] This embodiment can provide multi-angle and multi-faceted encryption protection so that a comprehensive encryption protection result is required to execute the decryption step. If any one of the encryption protection results is missing during cracking, it will be difficult to crack the data, thereby improving data security and increasing the cost and difficulty of cracking.

[0110] The present embodiment does not limit the specific first preset situation. Optionally, it may be at least one of the following: 1) determining that plaintext data needs to be used; 2) determining that decryption is required; 3) receiving a service request for using plaintext data, and the like.

[0111] In a specific example, when the business party needs to use plain text data to perform business, for example, when the business party needs to use sensitive words in plain text for text review, the decryption step can be performed locally; or the user terminal sends a business request to the business party, so that the business party performs the decryption step locally, uses plain text data to perform business, and returns the business execution result to the user terminal to improve data security. Among them, the business party can be the execution subject of the process of this method, and specifically can be the business party device.

[0112] This embodiment does not limit the specific second preset situation. Optionally, the encryption protection result (the encrypted preset key library, the key encryption result, the program obfuscation result, and the file encryption result) can be directly sent to the receiving end; or the encryption protection result can be sent to the receiving end when it is determined that the receiving end has a need to obtain plaintext data.

[0113] This embodiment does not limit the specific sending method. Optionally, the encryption protection result can be sent directly, or a business software can be constructed based on the encryption protection result, and the constructed business software can be sent to the receiving end. The receiving end can install this business software. It is also possible to construct a computer program product based on the encryption protection result. For specific explanations, please refer to the explanation of the business software.

[0114] The constructed computer program product may include encryption protection results, may have the ability to execute decryption steps, and may also use the plaintext data obtained by decryption to perform business, thereby limiting the decryption process and plaintext data within the computer program product, improving data security, and increasing the difficulty and cost of cracking from the outside.

[0115] Specifically, the receiving end may run the computer program product so that the computer program product performs the decryption step. Therefore, optionally, in the second preset case, a computer program product may be constructed based on the encrypted preset key library, the key encryption result, the program obfuscation result, and the file encryption result, and the constructed computer program product may be sent to the receiving end so that the receiving end performs the decryption step based on the computer program product.

[0116] The computer program product may be used to perform the decryption step, and may also be used to perform services based on the plaintext data obtained by decryption. Specifically, the computer program product may perform the decryption step in a memory or a trusted execution environment, and may store the plaintext data obtained by decryption in the memory or the trusted execution environment without displaying it to the user. The computer program product may also perform services based on the plaintext data obtained by decryption in the memory or the trusted execution environment.

[0117] Optionally, the above decryption step can also be performed in a memory or a trusted execution environment. The decrypted plaintext data can be stored in the memory or the trusted execution environment. The decrypted plaintext data can also be used to execute business in the memory or the trusted execution environment. Based on the memory or the trusted execution environment, data security can be improved and the risk of data leakage can be reduced.

[0118] The process of this method does not limit the specific decryption steps, as long as the plaintext data can be decrypted according to the above encryption protection result.

[0119] Optionally, the decryption step may include: calling the program obfuscation result, decrypting the encrypted preset key library, and determining the first private key in the decrypted preset key library; based on the determined first private key, decrypting the key encryption result to obtain a second decryption key; based on the obtained second decryption key, decrypting the file encryption result to obtain the file to which the data encryption result belongs, and determining the data encryption result from the obtained file; based on the determined first private key, decrypting the determined data encryption result to obtain plaintext data.

[0120] This embodiment can provide multi-angle and multi-faceted encryption protection so that a comprehensive encryption protection result is required to execute the decryption step. If any one of the encryption protection results is missing during cracking, it will be difficult to crack the data, thereby improving data security and increasing the cost and difficulty of cracking.

[0121] Among them, the program obfuscation result obtained through code obfuscation can run normally, while increasing the difficulty and cost of reverse engineering.

[0122] The decryption step specifically corresponds to each step in the encryption method. For example, if the first public key is used for encryption, the first private key is used for decryption. This embodiment does not limit the execution order of each step in the decryption step.

[0123] Optionally, the determined first private key can be stored in a cache, so as to facilitate calling the first private key in the cache, decrypting the ciphertext required in the data encryption result, and obtaining the required plaintext data portion. Storing the first private key in the cache can facilitate calling and improve decryption efficiency and decryption speed.

[0124] For example, the plaintext data may specifically be at least one sensitive word plaintext. During the encryption process, each sensitive word plaintext may be encrypted based on the first public key. The data encryption result may include at least one sensitive word ciphertext. Thus, the determined first private key may be stored in the cache, and the required one or more sensitive word ciphertexts may be determined from the data encryption result, and the first private key in the cache may be used for decryption to obtain the required sensitive word plaintext.

[0125] For ease of understanding, the present disclosure also provides a process example of a data decryption method.

[0126] Figure 4 FIG. 1 is a schematic diagram showing a data decryption method according to an embodiment of the present disclosure. Figure 4 As shown, the specific steps can refer to the explanation of the above decryption steps.

[0127] The method flow does not limit the specific form of the preset key library. Optionally, the preset key library can be in the form of a KeyStore, a file for storing keys, or a collection for storing keys.

[0128] The method flow also does not limit the specific way of encrypting the preset key library. Optionally, symmetric encryption or asymmetric encryption can be used.

[0129] The method flow does not limit the specific source of the target program. Optionally, it can be to determine a pre-stored target program for decrypting the encrypted preset key library, or to generate a target program for decrypting the encrypted preset key library in real time.

[0130] The specific encryption and decryption method of the preset key store KeyStore may be fixed, so that the target program can be generated in advance.

[0131] The method flow does not limit the specific form of the target program, which may be a dynamic link library (DLL) file format or other file formats.

[0132] The method flow does not limit the specific content of the target program. Optionally, the target program may include a decryption key for decrypting the encrypted preset key library, an access path for accessing the preset key library, an interface for decrypting the encrypted preset key library, and the like.

[0133] This method flow does not limit the way to perform code obfuscation on the target program. Among them, code obfuscation (Obfuscated code), also known as junk instructions, is a technology that converts the code of a computer program into a functionally equivalent form but difficult to read and understand. The main purpose of code obfuscation is to protect the program from being cracked or tampered with by reverse engineering, by modifying the structure and logic of the code to make it difficult to read and understand by the human eye or reverse engineering tools. Although the function of the code will not change, its readability and traceability are greatly reduced, which makes it difficult for malicious users to analyze and tamper with the program in order to hide implementation details and enhance security.

[0134] Optionally, you can use automated tools to obfuscate the target program. Different obfuscation tools are available for different programming languages ​​and technology stacks. For example, automated tools include Dotfuscator, ProGuard, UglifyJS, ConfuserEx, etc.

[0135] Optionally, the code obfuscation may be performed on the entire target program or on part of the target program, and specifically, code obfuscation may be performed on part of the decryption function, for example, a decryption key for decrypting an encrypted preset key library, an access path for accessing the preset key library, a function code for decryption, and the like.

[0136] Therefore, optionally, code obfuscation is performed on a target program used to decrypt a preset key library to obtain a program obfuscation result. Specifically, code obfuscation may be performed on content in the target program related to the preset key library to obtain a program obfuscation result.

[0137] This embodiment does not limit the specific content related to the preset key library in the target program. Optionally, the content related to the preset key library in the target program may specifically include at least one of the following: 1) a decryption key for decrypting the encrypted preset key library; 2) an access path for accessing the preset key library; 3) a function code for decrypting the encrypted preset key library; 4) an interface for decrypting the encrypted preset key library, etc.

[0138] This embodiment can perform code obfuscation on the content related to the preset key library in the target program to reduce the amount of code obfuscation content, thereby improving the efficiency of data encryption protection and reducing the cost of data encryption protection.

[0139] The process of this method does not limit the specific form and determination method of the file to which the data encryption result belongs. Optionally, the plaintext data can be replaced with the ciphertext data obtained after the plaintext data is encrypted as the data encryption result, so that it can be determined that the file to which the plaintext data belongs can be the file to which the data encryption result belongs; or the plaintext data in the copy of the plaintext data can be replaced with the above ciphertext data as the data encryption result, so that it can be determined that the copy file or the file to which the copy belongs can be the file to which the data encryption result belongs.

[0140] In a specific example, the plaintext data may be at least one sensitive word plaintext in a sensitive word list, and encryption may replace each sensitive word plaintext in the sensitive word list with a corresponding sensitive word ciphertext. Accordingly, the sensitive word list itself may be a table file or table document (such as an Excel document), so that it can be determined that the sensitive word list, as a table file or table document, may be the file to which the data encryption result belongs.

[0141] The method flow does not limit the encryption method of the file to which the data encryption result belongs based on the second encryption key. Specifically, it can be to encrypt the file itself, or it can be to encrypt the file permissions. For example, the file opening permission is encrypted, and the file can be opened if the decryption is successful.

[0142] In a specific example, an Excel document can be deployed as a sensitive word list for storing sensitive words. At least one sensitive word plaintext can be pre-stored therein, and each sensitive word plaintext can be encrypted by the first public key to obtain the corresponding sensitive word ciphertext, and the sensitive word plaintext is replaced with the corresponding sensitive word ciphertext. The sensitive word plaintext in the sensitive word list can be the plaintext data in the process of this method, the sensitive word ciphertext in the sensitive word list can be the data encryption result in the process of this method, and the Excel document of the sensitive word list can be the file to which the data encryption result in the process of this method belongs. Afterwards, the Excel document of the sensitive word list can be encrypted, and specifically, the opening permission of the sensitive word list can be encrypted.

[0143] It can be understood that the file to which the data encryption result belongs may contain metadata of the data encryption result or plaintext data. For example, the plaintext of sensitive words in the sensitive word list can be protected by encryption. The sensitive word list can also include the total number of sensitive words, classification, size, length, remarks and other information, thereby improving data security by encrypting and protecting the entire file.

[0144] In an optional embodiment, data updates may also occur for encrypted plaintext data, so that various versions of plaintext data can be stored to facilitate comparison, review, and backtracking.

[0145] The process of this method does not limit the way of storing historical versions of plaintext data. Optionally, the current version of plaintext data can be stored before the plaintext data is encrypted based on the first public key; the current data encryption result can be stored as the current version after the plaintext data is encrypted based on the first public key; or the current file encryption result can be stored as the current version after the file encryption result is obtained. Among them, by storing the encryption result as the current version, data security can be improved, and decryption is also required when using the historical version of data, which increases the difficulty and cost of cracking the historical version of data.

[0146] Therefore, optionally, the method may further include at least one of the following:

[0147] 1) When the data encryption result is obtained, the current data encryption result and the corresponding data identification information are stored.

[0148] 2) When the file encryption result is obtained, the current file encryption result and the corresponding file identification information are stored.

[0149] It is understandable that, in the case of determining the plaintext data, the current plaintext data and the corresponding plaintext identification information may also be stored.

[0150] In this embodiment, by storing the current data encryption result and / or file encryption result as version data, operations such as data comparison, historical version review and backtracking can be facilitated, and the security of the version data can be improved.

[0151] This embodiment does not limit the specific form of the data identification information and the file identification information. Optionally, the data identification information may be at least one of the following: time identification information, timestamp information, version identification, version number, etc. For the explanation of the file identification information and the plain text identification information, please refer to the explanation of the data identification information.

[0152] Among them, as the plaintext data is updated, the current data encryption result and the corresponding data identification information can be stored each time a new data encryption result is obtained, so that multiple historical versions of data can be obtained. Similarly, as the plaintext data is updated, the current file encryption result and the corresponding file identification information can be stored each time a new file encryption result is obtained.

[0153] In addition to the execution subject of the method flow being able to retain version data, in an optional embodiment, the receiving end can also retain version data. The receiving end can be a device for receiving the encryption protection result of the method flow and performing the above decryption step.

[0154] Optionally, the receiving end may directly store the received file encryption result as the current version. Specifically, the receiving end may store the current file encryption result and the corresponding file identification information when receiving the file encryption result. The receiving end may also store the current data encryption result and the corresponding data identification information when obtaining the data encryption result during the execution of the above decryption step. The receiving end may also store the current plaintext data and the corresponding plaintext identification information when obtaining the plaintext data during the execution of the above decryption step. For a specific explanation, please refer to the above embodiment.

[0155] The method flow does not limit the specific way of updating the plaintext data.

[0156] In an optional embodiment, when it is determined that the plaintext data needs to be updated, the plaintext data may be updated, specifically, the plaintext data may be updated directly, or the plaintext data may be obtained based on the above decryption step and then updated.

[0157] Optionally, the method flow may further include: determining the update result of the plaintext data. Update permissions may be set for the plaintext data, for example, only the administrator user may update the plaintext data, thereby improving the security of the data. Therefore, the update result of the administrator user for the plaintext data may be determined, specifically, the update result of the administrator user for the plaintext data may be obtained.

[0158] Accordingly, identity authentication can be performed for the administrator user, thereby improving data security. The method flow does not limit the specific identity authentication method, which can be biometric information authentication, password authentication, secondary password authentication, etc.

[0159] Therefore, optionally, the method flow may further include: if the administrator user identity authentication is successful, determining the update result of the administrator user for the plaintext data. The specific update may include at least one of the following: adding, deleting and modifying the plaintext data.

[0160] After obtaining the new plaintext data, that is, the updated result of the plaintext data, the previous encryption protection result can be further adjusted. The method flow does not limit the specific adjustment method, and can specifically re-execute the method flow for the updated result of the plaintext data; or only adjust part of the encryption protection result.

[0161] Optionally, the method process may also include: determining the update result of the plaintext data; encrypting the determined update result based on the first public key to obtain a new data encryption result; encrypting the file to which the new data encryption result belongs based on the second encryption key to obtain a new file encryption result.

[0162] Among them, this embodiment can update the data encryption result and the file encryption result to improve data security. Since the encryption key used is the same as the previous method flow, the protection step of the first private key and the protection step of the second decryption key in the method flow do not need to be repeated, and the previous preset key library, program obfuscation result and key encryption result can be reused, thereby improving the efficiency of encryption protection and data update and reducing the cost of encryption protection and data update.

[0163] After obtaining new data encryption results and new file encryption results, the corresponding subsequent processes can also be adjusted.

[0164] Optionally, when performing the decryption step, it can be based on the encrypted preset key library, the key encryption result, the program obfuscation result, and the new file encryption result. Accordingly, in an embodiment where the encrypted protection result needs to be sent to the receiving end to perform the decryption step, the new file encryption result can be further sent to the receiving end so that the receiving end can be based on the encrypted preset key library, the key encryption result, the program obfuscation result, and the new file encryption result.

[0165] The disclosed embodiment also provides a data decryption method embodiment based on the above data encryption method embodiment. The method can be used to decrypt the encryption protection result obtained by the above data encryption method embodiment. The method process does not limit the execution subject, and the encryption protection result can be obtained from an external device or pre-stored locally.

[0166] The method may include the following steps:

[0167] S201: calling a program to obfuscate the result, decrypting the encrypted preset key library, and determining a first private key in the decrypted preset key library.

[0168] S202: Based on the determined first private key, decrypt the key encryption result to obtain a second decryption key.

[0169] S203: Decrypt the file encryption result based on the obtained second decryption key to obtain the file to which the data encryption result belongs, and determine the data encryption result from the obtained file.

[0170] S204: Based on the determined first private key, decrypt the determined data encryption result to obtain plaintext data.

[0171] This embodiment does not limit the specific method of determining the first private key in the preset key library. Optionally, when storing the first private key in the preset key library, an identifier can be set for the first private key to facilitate locating the first private key from the preset key library according to the identifier during the decryption process; or when storing the first private key in the preset key library, the first private key can be stored in a specified location (for example, the first key) to facilitate directly obtaining the first private key from a fixed location during the decryption process. In the case where multiple keys are stored in the preset key library, the first private key can also be determined from the preset key library through the above embodiment.

[0172] The specific explanation of the process of this method can be found in the above embodiments.

[0173] The disclosed embodiment also provides another data decryption method embodiment.

[0174] The method can complete encryption in advance through the above data encryption method embodiment to obtain an encryption protection result, so that the encryption protection result can be decrypted. The method process does not limit the execution subject, and the encryption protection result can be obtained from an external device or pre-stored locally.

[0175] The method may include the following steps:

[0176] S301: Determine the file encryption result, the key encryption result, the program obfuscation result and the encrypted preset key library.

[0177] Among them, the file encryption result is obtained by encrypting the file to which the data encryption result belongs based on the second encryption key in advance; the data encryption result is obtained by encrypting the plaintext data based on the first public key in advance; the key encryption result is obtained by encrypting the second decryption key based on the first public key in advance; the first private key is stored in the encrypted preset key library; the program obfuscation result is obtained by obfuscating the code of the target program used to decrypt the encrypted preset key library in advance. The explanation of the specific encryption process can be found in the above embodiment.

[0178] S302: calling the program to obfuscate the result, decrypting the encrypted preset key library, and determining the first private key in the decrypted preset key library.

[0179] S303: Based on the determined first private key, decrypt the key encryption result to obtain a second decryption key.

[0180] S304: Decrypt the file encryption result based on the obtained second decryption key to obtain the file to which the data encryption result belongs, and determine the data encryption result from the obtained file.

[0181] S305: Based on the determined first private key, decrypt the determined data encryption result to obtain plaintext data.

[0182] The method process can specifically be run in memory or a trusted execution environment, thereby improving the security of plaintext data and the decryption process.

[0183] The specific explanation of the process of this method can be found in the above embodiments.

[0184] The present disclosure also provides a computer program product embodiment.

[0185] The computer program product may include an encryption protection result obtained in advance based on the above data encryption method embodiment, so that decryption can be performed during the operation of the computer program product to facilitate the use of plain text data to perform corresponding services. The encryption protection result in the computer program product may be obtained from an external device or may be pre-stored locally.

[0186] Optionally, a computer program product for data decryption may include: a file encryption result, a key encryption result, a program obfuscation result, and an encrypted preset key library.

[0187] Among them, the file encryption result is obtained by encrypting the file to which the data encryption result belongs based on the second encryption key in advance; the data encryption result is obtained by encrypting the plaintext data based on the first public key in advance; the key encryption result is obtained by encrypting the second decryption key based on the first public key in advance; the first private key is stored in the encrypted preset key library; the program obfuscation result is obtained by obfuscating the code of the target program in the computer program product used to decrypt the encrypted preset key library in advance. The explanation of the specific encryption process can be found in the above embodiment.

[0188] When the computer program product is run, it can perform the following steps:

[0189] S401: calling a program to obfuscate the result, decrypting the encrypted preset key library, and determining a first private key in the decrypted preset key library.

[0190] S402: Based on the determined first private key, decrypt the key encryption result to obtain a second decryption key.

[0191] S403: Decrypt the file encryption result based on the obtained second decryption key to obtain the file to which the data encryption result belongs, and determine the data encryption result from the obtained file.

[0192] S404: Based on the determined first private key, decrypt the determined data encryption result to obtain plaintext data.

[0193] This embodiment does not limit the construction method of the computer program product, and it can be constructed based on the above encryption protection result. It is understandable that the computer program product can be in the form of software.

[0194] This embodiment does not limit the specific conditions for executing the decryption step. Specifically, the decryption step, that is, S401-S404, may be executed when decryption is required, or the decryption step may be executed when the user successfully verifies his / her identity.

[0195] Specifically, the computer program product may be run in a memory or a trusted execution environment, thereby improving the security of plaintext data and the decryption process.

[0196] The specific explanation of this embodiment can refer to the above embodiment.

[0197] The disclosed embodiment also provides an embodiment of a sensitive word review method.

[0198] In this method, the encrypted plaintext data can be at least one sensitive word plaintext, and the plaintext data (sensitive word plaintext) can be used to review multimedia content such as text, specifically to determine whether multimedia content such as text contains sensitive word plaintext.

[0199] The method may include the following steps:

[0200] S501: Determine the file encryption result, the key encryption result, the program obfuscation result and the encrypted preset key library.

[0201] Among them, the file encryption result is obtained by encrypting the file to which the data encryption result belongs based on the second encryption key in advance; the data encryption result is obtained by encrypting at least one sensitive word plaintext based on the first public key in advance; the key encryption result is obtained by encrypting the second decryption key based on the first public key in advance; the first private key is stored in the encrypted preset key library; the program obfuscation result is obtained by code obfuscation in advance for the target program used to decrypt the encrypted preset key library; the explanation of the specific encryption process can be found in the above embodiment.

[0202] S502: calling a program to obfuscate the result, decrypting the encrypted preset key library, and determining a first private key in the decrypted preset key library.

[0203] S503: Based on the determined first private key, decrypt the key encryption result to obtain a second decryption key.

[0204] S504: Decrypt the file encryption result based on the obtained second decryption key to obtain the file to which the data encryption result belongs, and determine the data encryption result from the obtained file.

[0205] S505: Based on the determined first private key, decrypt the determined data encryption result to obtain at least one sensitive word plaintext.

[0206] S506: Review based on the obtained plain text of at least one sensitive word.

[0207] The process of this method does not limit the review method, and specifically, it can be to search whether the target text contains sensitive words in plain text, or to search whether the text part in the target image contains sensitive words in plain text, etc. It can also be to select part of the sensitive words in plain text for review.

[0208] The method process can specifically be run in memory or a trusted execution environment, thereby improving the security of the sensitive word plaintext and decryption process.

[0209] The specific explanation of the process of this method can be found in the above embodiments.

[0210] The disclosed embodiment also provides a computer program product embodiment for sensitive word review.

[0211] A computer program product for sensitive word review, which may include: file encryption results, key encryption results, program obfuscation results, and an encrypted preset key library;

[0212] Among them, the file encryption result is obtained by encrypting the file to which the data encryption result belongs based on the second encryption key in advance; the data encryption result is obtained by encrypting at least one sensitive word plaintext based on the first public key in advance; the key encryption result is obtained by encrypting the second decryption key based on the first public key in advance; the first private key is stored in the encrypted preset key library; the program obfuscation result is obtained by code obfuscation in advance for the target program in the computer program product used to decrypt the encrypted preset key library; the explanation of the specific encryption process can be found in the above embodiment.

[0213] When the computer program product is run, it can perform the following steps:

[0214] S601: calling a program to obfuscate the result, decrypting the encrypted preset key library, and determining a first private key in the decrypted preset key library.

[0215] S602: Based on the determined first private key, decrypt the key encryption result to obtain a second decryption key.

[0216] S603: Decrypt the file encryption result based on the obtained second decryption key to obtain the file to which the data encryption result belongs, and determine the data encryption result from the obtained file.

[0217] S604: Based on the determined first private key, decrypt the determined data encryption result to obtain at least one sensitive word plaintext.

[0218] S605: Review based on the obtained plain text of at least one sensitive word.

[0219] This embodiment does not limit the construction method of the computer program product for sensitive word review, and can specifically be constructed based on the above encryption protection result.

[0220] The specific explanation of this embodiment can refer to the above embodiment.

[0221] The embodiment of the present disclosure also provides an application embodiment.

[0222] In this application embodiment, it may be related to the field of content security review, and the vocabulary used for review is encrypted.

[0223] In the field of content security review, a word list is usually maintained to assist in identifying and handling sensitive, prohibited or inappropriate content. This word list may contain many types of words, including but not limited to the following: descriptions of violent acts, indecent or provocative language, hate speech or inflammatory language, words that invade the privacy of others, personal identity information (such as name, ID number, mobile phone number, home address or email address, etc.), copyright infringement and pirated content words, pirated movie, software or music names, infringing content descriptions or links, expressions involving copyright issues, other sensitive words, insulting or derogatory language, malicious attacks or rumor-mongering words, and words involving vulgarity, violence or bad information.

[0224] During the content security review process, this word list can be used to screen multimedia content such as text, images, audio, and video to ensure that the content complies with relevant laws, policies, and social ethics. At the same time, as society continues to develop and change, this word list will continue to be updated and improved to adapt to new sensitive information and challenges.

[0225] Please note that since the vocabulary in the field of content security review involves many sensitive and banned words, it is necessary to strictly follow relevant laws, regulations and ethical standards in actual application to ensure the legal and compliant use and processing of this information. At the same time, it is also necessary to strengthen the research and development and application of technical means to improve the accuracy and efficiency of content security review. Due to the particularity of sensitive and banned word lists, they should not be made public or circulated on the public Internet, so the content of the word list needs to be encrypted.

[0226] Currently, encryption algorithms for sensitive words and banned words can be divided into three categories: symmetric encryption algorithms, asymmetric encryption algorithms, and hash algorithms. Commonly used encryption algorithms include symmetric encryption algorithms (such as AES, DES, 3DES), asymmetric encryption algorithms (such as RSA, ECC), and hash algorithms (such as SHA-256, MD5).

[0227] Although existing encryption algorithms guarantee data security to a certain extent, they still have some shortcomings and limitations. The following is a summary of the shortcomings of several common encryption algorithms:

[0228] 1. Symmetric encryption algorithm (such as DES, 3DES, AES, etc.).

[0229] 1. Complex key management: In symmetric encryption algorithms, the same key is used for encryption and decryption. Therefore, the transmission and storage of keys becomes a problem. If the key is leaked, the security of encryption will be seriously threatened. In addition, as the number of keys increases, the complexity of key management also increases.

[0230] 2. Performance bottleneck: Although modern symmetric encryption algorithms such as AES have been optimized in terms of computing speed and memory requirements, they may still face performance bottlenecks when processing large amounts of data.

[0231] 2. Asymmetric encryption algorithm (such as RSA, ECC, etc.).

[0232] 1. Slow encryption and decryption speed: In asymmetric encryption algorithms, the encryption and decryption process is relatively complex, so the speed is slow. This limits the application of asymmetric encryption algorithms in large data volume scenarios.

[0233] 2. Key length selection: The key length of an asymmetric encryption algorithm is critical to security. If the key length is too short, it is easy to be cracked; if the key length is too long, it will affect the speed of encryption and decryption. Therefore, it is necessary to reasonably select the key length to balance security and performance.

[0234] 3. Hash algorithm (such as MD5, SHA-1, etc.).

[0235] 1. Security issues: Older hash algorithms such as MD5 have serious security issues, such as collision attacks. This means that attackers can construct different input data to produce the same hash value, thereby destroying the integrity of the data. Although SHA-1 is more secure than MD5, it has also gradually exposed security vulnerabilities.

[0236] 2. Irreversibility: The hash algorithm is one-way, that is, the original data cannot be restored from the hash value. Although this protects the privacy of the data to a certain extent, it also makes data recovery impossible.

[0237] 4. The challenges posed by quantum computing to encryption algorithms.

[0238] With the development of quantum computing technology, the security of traditional encryption algorithms has been challenged unprecedentedly. Quantum computers can crack many traditional encryption algorithms, such as RSA and ECC, in a short period of time. Therefore, developing encryption algorithms that can resist quantum computing attacks has become a current research hotspot.

[0239] 5. Other limitations

[0240] 1. Key transfer problem: Whether it is a symmetric encryption algorithm or an asymmetric encryption algorithm, there is a key transfer problem. If the key is intercepted or tampered with during the transfer process, it will lead to encryption failure or data leakage.

[0241] 2. Complexity of algorithm implementation and deployment: The implementation and deployment of encryption algorithms require professional knowledge and skills. If the implementation is improper or the deployment is not rigorous, the security of the encryption algorithm may be greatly reduced.

[0242] 3. Social engineering attacks: Attackers may obtain users' sensitive information (such as passwords, keys, etc.) through deception, inducement, etc., thereby bypassing the protection of encryption algorithms.

[0243] In summary, although the existing encryption algorithms have guaranteed the security of data to a certain extent, they still have many shortcomings and limitations. Therefore, in practical applications, it is necessary to comprehensively consider factors such as algorithm security, performance, key management, etc., select a suitable encryption algorithm and take corresponding security measures to ensure data security.

[0244] Since existing encryption algorithms have many shortcomings and limitations, this embodiment mainly makes up for the above shortcomings and limitations. That is, after the sensitive and banned word lists in the field of content security review are encrypted using the method of this embodiment, users can hardly crack the word list without knowing the password. When the system program or site needs to use the ciphertext word list, it can open and read the word list file and automatically decrypt the word list document content without providing a password, and perform subsequent sensitive word matching and other operations.

[0245] This embodiment also provides functions such as generation of the latest version of sensitive and banned word lists, backup and query of historical versions, etc.

[0246] The specific steps of implementing the technology in this embodiment are as follows:

[0247] 1. This embodiment involves the creation of sensitive and banned word lists. Only authorized personnel can create word lists, so a secondary password for the word library login page is designed in the system. Only by entering the correct secondary password can you enter the word library list page, add and maintain the sensitive word list. Figure 5 A schematic diagram of a secondary password page according to an embodiment of the present disclosure is shown.

[0248] 2. Due to the many shortcomings and limitations of existing encryption algorithms, this embodiment uses a combination of multiple algorithms to achieve encryption of vocabulary content. The specific steps are as follows:

[0249] The sensitive word database of the word list can be divided into sensitive, standard expression, proofreading correction, bad orientation and other categories. The stored content can be a single entry, a combination of multiple words or a Solr search formula. Each sensitive word needs to be encrypted using the RSA encryption algorithm.

[0250] In this embodiment, the vocabulary encryption tool is used in the following steps:

[0251] 2.1 The default password of the vocabulary file is: 1.

[0252] 2.2 A 6-digit password will be automatically generated when the tool is loaded and can be modified manually.

[0253] 2.3 Select the file to be encrypted and click Encrypt to start encryption.

[0254] 2.4 After encryption is completed, the password file encryptedPassword.dat will be generated in drive D.

[0255] Figure 6 A page diagram of a vocabulary encryption tool according to an embodiment of the present disclosure is shown.

[0256] After the sensitive words and banned words (search terms) in the vocabulary are encrypted by the RSA encryption algorithm in the encryption tool, their contents become a string of characters. Figure 7 A schematic diagram of a sensitive word ciphertext word list according to an embodiment of the present disclosure is shown. Figure 7 As shown, the characters in the search formula column are the ciphertext of sensitive words.

[0257] The encrypted data may be the plaintext data in the above method embodiment, and the public key used for encryption may be the first public key in the above method embodiment. The search formula may be a form of sensitive words. This step may be to encrypt the plaintext data based on the first public key in the above method embodiment to obtain a data encryption result.

[0258] 3. RSA private key confidential storage: KeyStore.

[0259] The RSA private key may specifically be the first private key in the above method embodiment. KeyStore may be the preset key store in the above method embodiment. This step may be storing the first private key in the preset key store and encrypting the preset key store in the above method embodiment.

[0260] Since the RSA encryption algorithm is an asymmetric encryption, it can be decrypted and cracked with a private key. Therefore, the RSA private key needs to be stored confidentially. This embodiment uses KeyStore to store the RSA private key. The key of KeyStore is written in the program. Specifically, Java KeyStore, that is, Java key store, can be used. Java KeyStore is a Java security tool that can be used to store certificates and private keys. It is the standard certificate storage format in the Java platform. Java KeyStore contains signed certificates and private keys, which can be used to authenticate APIs and encrypt data.

[0261] KeyStore is described as follows:

[0262] 3.1、Definition and function of KeyStore.

[0263] KeyStore is a password-protected file used to store keys and certificates. These keys and certificates can be used for security operations such as encryption and decryption of data, digital signatures, and authentication. KeyStore files are usually located in the user's home directory, but other locations can also be specified through parameters. In KeyStore, each entry has a unique alias for retrieval and management.

[0264] 3.2. KeyStore type and format.

[0265] 1) Type: Before Java 8, the default KeyStore type was JKS (Java KeyStore). Starting from Java 9, PKCS12 has become the default KeyStore type. PKCS12 is an international standard KeyStore format with good compatibility and cross-platform performance.

[0266] 2) Format: KeyStore files are stored in binary format and contain keys, certificates, and related metadata information. This information is encrypted to prevent unauthorized access.

[0267] 3.3. The main purpose of KeyStore.

[0268] 1) Storing and protecting encryption keys: KeyStore can store various encryption keys, including symmetric keys and asymmetric keys. These keys are used to encrypt and decrypt data to ensure secure transmission and storage of data.

[0269] 2) Store and protect digital certificates: KeyStore can also store digital certificates, including public key certificates and private key certificates. Digital certificates are used for identity authentication and encrypted communication to ensure the identity and data security of both parties.

[0270] 3) Manage keys and certificates: KeyStore provides convenient key and certificate management functions, allowing users to create, delete, import and export keys and certificates. This helps ensure the secure management of keys and certificates to prevent loss or leakage.

[0271] 4. Encrypt and protect the key of KeyStore in the program.

[0272] The security protection of the key and program source code of the KeyStore in this embodiment is to use a tool to perform code obfuscation. The code obfuscation here can be the code obfuscation performed on the target program in the above method embodiment. This step can be the code obfuscation performed on the target program for decrypting the encrypted preset key store in the above method embodiment to obtain the program obfuscation result.

[0273] Obfuscated code, also known as junk instructions, is a technology that converts the code of a computer program into a form that is functionally equivalent but difficult to read and understand. The main purpose of code obfuscation is to protect the program from being cracked or tampered with by reverse engineering, by modifying the structure and logic of the code to make it difficult to read and understand by human eyes or reverse engineering tools. Although the function of the code does not change, its readability and traceability are greatly reduced, which makes it difficult for malicious users to analyze and tamper with the program.

[0274] An example of a code obfuscation tool: Dotfuscator. The following is an introduction to Dotfuscator:

[0275] I. An obfuscation tool designed specifically for .NET applications.

[0276] II. Make .NET programs difficult to reverse engineer through obfuscation, thereby protecting trade secrets and intellectual property.

[0277] When Jenkins builds a project, it obfuscates the Dynamic Link Library (DLL) file. A DLL is a file that contains code and data that can be shared by multiple applications. By dynamically linking to the program, the DLL file provides specific functions and services. The DLL file can include a program and interface for decrypting the above KeyStore, so that the code can be obfuscated for the DLL file. Figure 8 A schematic diagram of a code obfuscated page according to an embodiment of the present disclosure is shown.

[0278] Decompilation tools are an important tool in the field of computer science, mainly used to convert compiled code back to the original source code. After obfuscation, use the decompilation tool to view the source code KeyStore key location. Fig. 9 A schematic diagram of a decompiled page according to an embodiment of the present disclosure is shown. Fig. 9 It can be learned that after the code is obfuscated, the KeyStore key seen after decompiling the code using a decompilation tool has become a string of characters and cannot be cracked.

[0279] 5. Encrypt sensitive and banned word list files.

[0280] The sensitive and banned word list files are in Excel format. Although the Excel content has been encrypted, the total number of entries, categories, etc. can still be seen after opening the Excel file. Therefore, the Excel file is encrypted. You can use the document encryption function that comes with Excel. Fig.10 A page schematic diagram of document encryption according to an embodiment of the present disclosure is shown.

[0281] The key for encrypting the document may specifically be the second encryption key in the above method embodiment.

[0282] This step may specifically be to encrypt the file to which the data encryption result belongs based on the second encryption key in the above method embodiment to obtain the file encryption result.

[0283] Accordingly, the decryption key (second decryption key) for document decryption may be further encrypted based on the RSA public key (first public key). Specifically, in the above method embodiment, the second decryption key may be encrypted based on the first public key to obtain a key encryption result.

[0284] Through the above 5 points, after the word list content and files are encrypted, the word list is almost impossible to crack.

[0285] 6. Decryption of ciphertext sensitive word list documents.

[0286] This embodiment can automatically decrypt the ciphertext word list. The encrypted sensitive and forbidden word list files cannot be opened manually. Even if the word list is opened, the word list content is ciphertext and cannot be cracked. How do applications and sites use this ciphertext word list? You can analyze it by following the steps below:

[0287] 6.1. Files required for decryption: ciphertext word list generated by word list encryption tool, password file encryptedPassword.dat and KeyStore, and DLL file after code obfuscation.

[0288] 6.2. The decryption process is as follows: Get the key of KeyStore from the obfuscated dll -> Open KeyStore with the key of KeyStore -> Get the private key of RSA -> Read the text content in the password file encryptedPassword.dat -> Decrypt based on the private key of RSA -> Get the key of the word list document -> Open the word list document with the key -> Read the content of the word list document line by line -> Decrypt the ciphertext sensitive word entry with the RSA algorithm -> Get the plaintext sensitive word entry -> Parsing is completed. The decryption process can be specifically referred to the decryption step in the above method embodiment.

[0289] 7. Storage of historical versions of sensitive and banned word lists.

[0290] This embodiment can retain versions of historically sensitive and banned words for easy reference, comparison, and backtracking. After editing the word list, click Generate New Version. Fig.11 A schematic diagram of a page for editing a vocabulary library version according to an embodiment of the present disclosure is shown.

[0291] After generating the latest version of the vocabulary document, the file name can include the time when the version was generated. Fig.12A schematic diagram of a page showing different versions of a vocabulary library according to an embodiment of the present disclosure.

[0292] On the technical level, the word list encryption tool of this embodiment uses a close combination of multiple encryption technologies to encrypt and decrypt sensitive words, banned words and content. It achieves the effect that it is almost impossible to crack with human intervention. It ensures the security of important word lists. The function of storing and backing up the word list historical version realizes the query, comparison and backtracking of the word list.

[0293] At the application level, this embodiment relies on the advantages of massive data resources and vocabulary, and the detection directions cover sensitivity, technological sensitivity, copyright rights, standardized expressions, bad orientation, proofreading and correction, etc., which can basically meet the main review needs in the market.

[0294] also, Fig.13 A flowchart of vocabulary management and user review according to an embodiment of the present disclosure is shown.

[0295] In terms of vocabulary management, the administrator can log in, enter the vocabulary management function and access the vocabulary. The user can further enter the secondary password to verify the administrator's vocabulary update authority. After verification, the vocabulary list page can be displayed. The administrator can add a vocabulary and enter the search formula. The system can use the RSA asymmetric encryption algorithm to encrypt the search formula. After that, the search formula in ciphertext form can be saved to the database vocabulary table. After successful saving, on the one hand, the RSA private key can be stored in the KeyStore, and the content can be read, that is, the RSA private key is read out and stored in the cache, the search formula ciphertext is decrypted, and the search formula plaintext is displayed on the vocabulary list page, which is convenient for administrators to view and manage. After successful saving, on the other hand, a new version can be generated, the vocabulary document password can be entered, the vocabulary document can be encrypted, and a sensitive vocabulary excel table can be generated. The sensitive words are all in ciphertext form.

[0296] In terms of user review, after logging in as an ordinary user, you can enter the intelligent review function, click on a single article, upload the text, and select the review type. After starting the review, you can decrypt the lexicon excel document. The specific process can be found in the above embodiment, and the latest lexicon excel table can be read. After that, it can be determined whether there is an RSA private key in the cache. If there is no RSA private key in the cache, the content in the KeyStore can be read and the RSA private key can be stored in the cache. If there is an RSA private key in the cache, the ciphertext search formula can be decrypted based on the RSA private key to obtain a plaintext search formula. Specifically, it can be decrypted in memory to reduce the situation where users directly view the plaintext search formula. After that, based on user operations, a plaintext solr search formula can be constructed for detection. Accordingly, solr can be configured to output only error logs, and the solr search formula in the log can be in ciphertext form to reduce the situation where users view the plaintext search formula. Finally, the detection results can be displayed.

[0297] It should be noted that, although a data encryption method is introduced as above by taking the above application embodiment as an example, those skilled in the art can understand that the present disclosure should not be limited thereto.

[0298] The embodiments of the present disclosure also provide corresponding device embodiments.

[0299] A data encryption device comprises the following units:

[0300] The determination unit 701 is used to determine a first public-private key pair and a second encryption-decryption key pair; the first public-private key pair includes a first public key and a first private key; the second encryption-decryption key pair includes a second encryption key and a second decryption key.

[0301] A plaintext encryption unit 702, configured to encrypt plaintext data based on a first public key to obtain a data encryption result;

[0302] The key library unit 703 is used to store the first private key in a preset key library and encrypt the preset key library;

[0303] The obfuscation unit 704 is used to perform code obfuscation on the target program used to decrypt the encrypted preset key library to obtain a program obfuscation result;

[0304] The file unit 705 is used to encrypt the file to which the data encryption result belongs based on the second encryption key to obtain a file encryption result;

[0305] The key unit 706 is used to encrypt the second decryption key based on the first public key to obtain a key encryption result.

[0306] The explanation of the embodiment of the present device can refer to the above method embodiment.

[0307] The disclosed embodiment also provides an embodiment of a data decryption device.

[0308] The device may include the following units:

[0309] The preparation unit 801 is used to determine the file encryption result, the key encryption result, the program obfuscation result and the encrypted preset key library.

[0310] Among them, the file encryption result is obtained by encrypting the file to which the data encryption result belongs based on the second encryption key in advance; the data encryption result is obtained by encrypting the plaintext data based on the first public key in advance; the key encryption result is obtained by encrypting the second decryption key based on the first public key in advance; the first private key is stored in the encrypted preset key library; the program obfuscation result is obtained by obfuscating the code of the target program used to decrypt the encrypted preset key library in advance. The explanation of the specific encryption process can be found in the above embodiment.

[0311] The calling unit 802 is used to call the program obfuscation result, decrypt the encrypted preset key library, and determine the first private key in the decrypted preset key library.

[0312] The key decryption unit 803 is used to decrypt the key encryption result based on the determined first private key to obtain a second decryption key.

[0313] The file decryption unit 804 is used to decrypt the file encryption result based on the obtained second decryption key, obtain the file to which the data encryption result belongs, and determine the data encryption result from the obtained file.

[0314] The plaintext decryption unit 805 is used to decrypt the determined data encryption result based on the determined first private key to obtain plaintext data.

[0315] The specific explanation of the embodiment of the present device can be found in the above method embodiment.

[0316] The device embodiments corresponding to other method embodiments can refer to the above two device embodiments, which will not be described in detail here.

[0317] In some embodiments, the functions or modules included in the device provided by the embodiments of the present disclosure can be used to execute the method described in the above method embodiments. The specific implementation can refer to the description of the above method embodiments, and for the sake of brevity, it will not be repeated here.

[0318] The present disclosure also provides a computer-readable storage medium on which computer program instructions are stored, and when the computer program instructions are executed by a processor, any of the above method embodiments is implemented. The computer-readable storage medium may be a volatile or non-volatile computer-readable storage medium.

[0319] An embodiment of the present disclosure further proposes an electronic device, comprising: a processor; and a memory for storing instructions executable by the processor; wherein the processor is configured to implement any of the above method embodiments when executing the instructions stored in the memory.

[0320] The embodiments of the present disclosure also provide a computer program product, including a computer-readable code, or a non-volatile computer-readable storage medium carrying the computer-readable code. When the computer-readable code runs in a processor of an electronic device, the processor in the electronic device executes any of the above method embodiments.

[0321] Fig.14 1 is a block diagram of an apparatus 1900 for implementing a method according to an exemplary embodiment of the present disclosure. For example, the apparatus 1900 may be provided as a server or a terminal device. Fig.14 , the apparatus 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932 for storing instructions, such as an application, that can be executed by the processing component 1922. The application stored in the memory 1932 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute instructions to perform any of the above-mentioned method embodiments.

[0322] The device 1900 may also include a power supply component 1926 configured to perform power management of the device 1900, a wired or wireless network interface 1950 configured to connect the device 1900 to a network, and an input / output interface 1958 (I / O interface). The device 1900 may operate based on an operating system stored in the memory 1932, such as Windows Server 2000. TM , MacOS X TM , Unix TM ,Linux TM , FreeBSD TM or similar.

[0323] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions, which can be executed by the processing component 1922 of the device 1900 to perform the above method.

[0324] The present disclosure may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0325] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (a non-exhaustive list) include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not to be interpreted as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0326] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0327] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0328] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0329] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0330] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0331] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of the module, program segment or instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of special hardware and computer instructions.

[0332] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or technical improvements in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A data encryption method, characterized in that: include: Determine a first public-private key pair and a second encryption-decryption key pair; the first public-private key pair includes a first public key and a first private key; The second encryption / decryption key pair includes a second encryption key and a second decryption key; Encrypt the plaintext data based on the first public key to obtain a data encryption result; Storing the first private key in a preset key library and encrypting the preset key library; Perform code obfuscation on the target program used to decrypt the encrypted preset key library to obtain a program obfuscation result; Based on the second encryption key, encrypt the file to which the data encryption result belongs to, to obtain a file encryption result; Based on the first public key, the second decryption key is encrypted to obtain a key encryption result.

2. The method according to claim 1, characterized in that: Also includes at least one of the following: In a first preset case, a decryption step is performed based on the encrypted preset key library, the key encryption result, the program obfuscation result and the file encryption result; In a second preset situation, the encrypted preset key library, the key encryption result, the program obfuscation result and the file encryption result are sent to the receiving end, so that the receiving end performs a decryption step based on the encrypted preset key library, the key encryption result, the program obfuscation result and the file encryption result.

3. The method according to claim 2, characterized in that: The decryption step comprises: Calling the program to obfuscate the result, decrypting the encrypted preset key library, and determining the first private key in the decrypted preset key library; Decrypting the key encryption result based on the determined first private key to obtain a second decryption key; Decrypting the file encryption result based on the obtained second decryption key to obtain the file to which the data encryption result belongs, and determining the data encryption result from the obtained file; Based on the determined first private key, the determined data encryption result is decrypted to obtain the plaintext data.

4. The method according to claim 1, characterized in that: The plaintext data includes: at least one sensitive word plaintext; The method of encrypting the plaintext data based on the first public key to obtain a data encryption result includes: Based on the first public key, different sensitive word plaintexts are encrypted respectively to obtain a data encryption result containing several sensitive word ciphertexts.

5. The method according to claim 1, characterized in that: Also includes: Determining an update result of the plaintext data; Based on the first public key, encrypt the determined update result to obtain a new data encryption result; Based on the second encryption key, the file to which the new data encryption result belongs is encrypted to obtain a new file encryption result.

6. The method according to claim 1 or 5, characterized in that: Also includes at least one of the following: When the data encryption result is obtained, the current data encryption result and the corresponding data identification information are stored; When the file encryption result is obtained, the current file encryption result and the corresponding file identification information are stored.

7. The method according to claim 1, characterized in that: The code obfuscation is performed on the target program for decrypting the preset key library to obtain the program obfuscation result, including: Code obfuscation is performed on the content related to the preset key library in the target program to obtain a program obfuscation result.

8. A computer program product for data decryption, characterized in that The program product includes: file encryption results, key encryption results, program obfuscation results and encrypted preset key library; The file encryption result is obtained by encrypting the file to which the data encryption result belongs based on the second encryption key in advance; the data encryption result is obtained by encrypting the plaintext data based on the first public key in advance; The key encryption result is obtained by encrypting the second decryption key based on the first public key in advance; The encrypted preset key library stores a first private key; The program obfuscation result is obtained by pre-obfuscating the target program in the program product for decrypting the encrypted preset key library; The program product performs the following steps when running: Calling the program to obfuscate the result, decrypting the encrypted preset key library, and determining the first private key in the decrypted preset key library; Decrypting the key encryption result based on the determined first private key to obtain a second decryption key; Decrypting the file encryption result based on the obtained second decryption key to obtain the file to which the data encryption result belongs, and determining the data encryption result from the obtained file; Based on the determined first private key, the determined data encryption result is decrypted to obtain the plaintext data.

9. A sensitive word review method, characterized in that: include: Determine the file encryption result, key encryption result, program obfuscation result and the encrypted preset key library; The file encryption result is obtained by encrypting the file to which the data encryption result belongs based on the second encryption key in advance; the data encryption result is obtained by encrypting at least one sensitive word plaintext based on the first public key in advance; the key encryption result is obtained by encrypting the second decryption key based on the first public key in advance; the first private key is stored in the encrypted preset key library; the program obfuscation result is obtained by code obfuscation in advance for the target program used to decrypt the encrypted preset key library; Calling the program to obfuscate the result, decrypting the encrypted preset key library, and determining the first private key in the decrypted preset key library; Decrypting the key encryption result based on the determined first private key to obtain a second decryption key; Decrypting the file encryption result based on the obtained second decryption key to obtain the file to which the data encryption result belongs, and determining the data encryption result from the obtained file; Decrypting the determined data encryption result based on the determined first private key to obtain the at least one sensitive word plaintext; The at least one sensitive word plain text is reviewed.

10. A computer program product for sensitive word review, characterized in that: The program product includes: file encryption results, key encryption results, program obfuscation results and encrypted preset key library; The file encryption result is obtained by encrypting the file to which the data encryption result belongs based on the second encryption key in advance; the data encryption result is obtained by encrypting at least one sensitive word plaintext based on the first public key in advance; The key encryption result is obtained by encrypting the second decryption key based on the first public key in advance; The encrypted preset key library stores a first private key; The program obfuscation result is obtained by pre-obfuscating the target program in the program product for decrypting the encrypted preset key library; The program product performs the following steps when running: Calling the program to obfuscate the result, decrypting the encrypted preset key library, and determining the first private key in the decrypted preset key library; Decrypting the key encryption result based on the determined first private key to obtain a second decryption key; Decrypting the file encryption result based on the obtained second decryption key to obtain the file to which the data encryption result belongs, and determining the data encryption result from the obtained file; Decrypting the determined data encryption result based on the determined first private key to obtain the at least one sensitive word plaintext; The at least one sensitive word plain text is reviewed.

Images