Data encryption method and device, storage medium and electronic equipment

Abstract

The invention discloses a data encryption method and device, a storage medium and electronic equipment. Relates to the technical field of data processing, the field of information security and other related technical fields. Determining a target key according to the key number; and under the condition that the verification results corresponding to the multiple pieces of to-be-encrypted data in the database represent that verification is passed, encrypting the multiple pieces of to-be-encrypted data according to the target key to obtain an encryption result corresponding to each piece of to-be-encrypted data. Through the data encryption method and device, the problem that the security of the sensitive data is relatively poor due to the fact that the secret key used for data encryption is managed in a software mode and the sensitive data in the database is encrypted through the secret key in the related technology is solved.

Description

Technical Field

[0001] The present application relates to the fields of data processing technology, information security and other related technical fields, and more specifically, to a data encryption method and device, a storage medium and an electronic device. Background Art

[0002] In business systems, many sensitive data need to be encrypted and protected. Once these data are stolen or leaked, they will cause multiple risks to personal privacy and the company. Common database security protection is mainly achieved through software encryption, which involves the linkage of database encryption management devices, front-end plug-ins and back-end plug-ins to achieve encrypted storage and decryption of sensitive data. However, this method has security shortcomings because the keys managed by the software are vulnerable to attacks. In addition, both the application server and the database server need to install additional plug-ins, which increases the complexity and transformation workload of the system, and does not support the coexistence and selective deletion of plaintext and ciphertext, as well as data integrity verification and desensitization display. This limits data security and system usability, especially in environments with high concurrency and strict performance requirements. The performance loss that may be caused by software encryption solutions has become a major challenge.

[0003] Currently, no effective solution has been proposed to the problem that the key used for data encryption is managed by software in the related art, and the sensitive data in the database is encrypted by the key, resulting in poor security of the sensitive data. Summary of the invention

[0004] The main purpose of the present application is to provide a data encryption method and device, a storage medium and an electronic device to solve the problem in the related art that the key used for data encryption is managed by software, and the sensitive data in the database is encrypted by the key, resulting in poor security of the sensitive data.

[0005] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a data encryption method is provided. The method includes: obtaining a key number through a key manager; determining a target key according to the key number; and encrypting the multiple data to be encrypted according to the target key when the verification results corresponding to the multiple data to be encrypted in the database indicate that the verification has passed, and obtaining an encryption result corresponding to each data to be encrypted.

[0006] Furthermore, determining the target key based on the key number includes: determining whether an initial key corresponding to the key number exists in the key manager to obtain a first judgment result; if the first judgment result indicates that the initial key corresponding to the key number exists in the key manager, determining the initial key as the target key; if the first judgment result indicates that the initial key corresponding to the key number does not exist in the key manager, generating the target key based on the key number.

[0007] Furthermore, the multiple data to be encrypted are encrypted according to the target key to obtain an encryption result corresponding to each data to be encrypted, including: performing data segmentation on the multiple data to be encrypted to obtain first processed data; performing an S-box operation on the first processed data to obtain second processed data; and encrypting the second processed data according to the target key to obtain the encryption result.

[0008] Furthermore, the method also includes: determining a target desensitization rule through the key manager, wherein the target desensitization rule includes at least: a target data type of the first data to be desensitized and a target desensitization step corresponding to the target data type; desensitizing multiple second data to be desensitized in the database according to the target desensitization rule to obtain a desensitization result corresponding to each second data to be desensitized.

[0009] Furthermore, desensitizing the multiple second data to be desensitized in the database according to the target desensitization rule to obtain the desensitization result corresponding to each second data to be desensitized includes: identifying the multiple second data to be desensitized to obtain the data type corresponding to the multiple second data to be desensitized; judging whether the data type belongs to the target data type in the target desensitization rule to obtain a second judgment result; if the second judgment result indicates that the data type belongs to the target data type in the target desensitization rule, desensitizing the multiple second data to be desensitized according to the target desensitization step in the target desensitization rule to obtain the desensitization result.

[0010] Furthermore, before encrypting the multiple data to be encrypted according to the target key, the method also includes: preprocessing the multiple data to be encrypted to obtain third processed data; concatenating the target key and the third processed data to obtain fourth processed data; and verifying the fourth processed data to obtain the verification result.

[0011] Furthermore, before encrypting the multiple data to be encrypted according to the target key to obtain the encryption result corresponding to each data to be encrypted, the method also includes: creating an initial ciphertext derivative column corresponding to the multiple data to be encrypted in the database; initializing the initial ciphertext derivative column according to a preset value to obtain a target ciphertext derivative column, wherein the target ciphertext derivative column is used to store the encryption result.

[0012] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a data encryption device is provided. The device includes: an acquisition unit, used to acquire a key number through a key manager; a first determination unit, used to determine a target key according to the key number; an encryption unit, used to encrypt the multiple data to be encrypted according to the target key when the verification results corresponding to the multiple data to be encrypted in the database indicate that the verification has passed, and obtain an encryption result corresponding to each data to be encrypted.

[0013] Further, the first determination unit includes: a first judgment module, used to judge whether there is an initial key corresponding to the key number in the key manager, and obtain a first judgment result; a determination module, used to determine the initial key as the target key if the first judgment result indicates that the initial key corresponding to the key number exists in the key manager; and a generation module, used to generate the target key based on the key number if the first judgment result indicates that the initial key corresponding to the key number does not exist in the key manager.

[0014] Furthermore, the encryption unit includes: a first processing module, used to perform data segmentation on the multiple data to be encrypted to obtain first processed data; a second processing module, used to perform S-box operation on the first processed data to obtain second processed data; an encryption module, used to encrypt the second processed data according to the target key to obtain the encryption result.

[0015] Furthermore, the device also includes: a second determination unit, used to determine a target desensitization rule through the key manager, wherein the target desensitization rule includes at least: a target data type of the first data to be desensitized and a target desensitization step corresponding to the target data type; a desensitization unit, used to desensitize multiple second data to be desensitized in the database according to the target desensitization rule to obtain a desensitization result corresponding to each second data to be desensitized.

[0016] Furthermore, the desensitizing unit includes: an identification module, used to identify the multiple second data to be desensitized and obtain data types corresponding to the multiple second data to be desensitized; a second judgment module, used to judge whether the data type belongs to the target data type in the target desensitization rule to obtain a second judgment result; a desensitizing module, used to desensitize the multiple second data to be desensitized according to the target desensitization step in the target desensitization rule to obtain the desensitization result if the second judgment result indicates that the data type belongs to the target data type in the target desensitization rule.

[0017] Furthermore, the device also includes: a preprocessing unit, used to preprocess the multiple data to be encrypted before encrypting the multiple data to be encrypted according to the target key to obtain third processed data; a splicing unit, used to splice the target key and the third processed data to obtain fourth processed data; and a verification unit, used to verify the fourth processed data to obtain the verification result.

[0018] Furthermore, the device also includes: a creation unit, used to create an initial ciphertext derivative column corresponding to the multiple data to be encrypted in the database before encrypting the multiple data to be encrypted according to the target key and obtaining the encryption result corresponding to each data to be encrypted; an initialization unit, used to initialize the initial ciphertext derivative column according to a preset value to obtain a target ciphertext derivative column, wherein the target ciphertext derivative column is used to store the encryption result.

[0019] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a computer-readable storage medium is provided, wherein the storage medium stores a program, wherein when the program is running, the device where the storage medium is located is controlled to execute any one of the data encryption methods described above.

[0020] In order to achieve the above-mentioned purpose, according to another aspect of the present application, an electronic device is further provided, the electronic device includes one or more processors and a memory, and the memory is used to store the data encryption method described in any one of the above-mentioned data encryption methods implemented by one or more processors.

[0021] Through the present application, the following steps are adopted: obtaining a key number through a key manager; determining a target key based on the key number; and encrypting multiple data to be encrypted according to the target key when the verification results corresponding to multiple data to be encrypted in the database indicate that the verification has passed, to obtain an encryption result corresponding to each data to be encrypted. Through the present application, the problem of managing the key for data encryption by software in the related art, and encrypting sensitive data in the database by the key, resulting in poor security of sensitive data, is solved.

[0022] In this solution, first, a key number is selected and obtained through a key manager. Then, according to the obtained key number, the corresponding target key is automatically loaded or generated. Before encrypting multiple data to be encrypted in the database, the multiple data to be encrypted are calculated and verified to obtain a verification result, which is used as a basis for subsequent data integrity verification. Finally, after the multiple data to be encrypted in the database pass the integrity verification, they are encrypted using the target key to generate an encryption result.

[0023] The key manager can effectively ensure the secure storage and efficient access of keys. At the same time, it also realizes the dynamic management and use of keys. By verifying the data, it ensures that the integrity of the data can be effectively protected while the data is encrypted, avoiding malicious modification of the data during transmission or storage. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0025] Figure 1 is a flow chart of a data encryption method provided according to an embodiment of the present application;

[0026] Figure 2 is a schematic diagram of data encryption provided according to an embodiment of the present application;

[0027] Figure 3 It is a schematic diagram of data desensitization provided according to an embodiment of the present application;

[0028] Figure 4 is a schematic diagram of data verification provided according to an embodiment of the present application;

[0029] Figure 5 is a schematic diagram of a ciphertext derivative column provided according to an embodiment of the present application;

[0030] Figure 6 is a schematic diagram of a data encryption method provided according to an embodiment of the present application;

[0031] Figure 7 is a schematic diagram of a data encryption device provided according to an embodiment of the present application;

[0032] Figure 8 is a schematic diagram of an electronic device provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0033] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0034] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0035] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0036] It should be noted that the relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, data for analysis, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties. For example, an interface is set between this system and the relevant user or organization. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or organization.

[0037] The present invention is described below in conjunction with preferred implementation steps. Figure 1 is a flow chart of a data encryption method provided according to an embodiment of the present application, such as Figure 1 As shown, the method comprises the following steps:

[0038] Step S101, obtaining a key number through a key manager.

[0039] Optionally, when data encryption requires the use of a key, the system initiates a key request to the key manager. The request may contain: the type of data to be encrypted, the encryption level, or other identification information to determine the correct key number. The key manager looks up the corresponding key policy based on the information in the request and determines the key number to be used. The key number is a unique identifier for the key, which can be numbers, letters, or a specific combination.

[0040] It should be noted that the key manager ensures the safe use of key numbers and keys through hardware to prevent them from being intercepted or abused during the data encryption process.

[0041] Step S102, determining the target key according to the key number.

[0042] Optionally, after the key number is determined, the key manager will retrieve the key corresponding to the key number from its key storage to obtain the target key.

[0043] It should be noted that after the target key is used, in order to improve security, the key manager will also implement key rotation or destroy old keys. In the process of obtaining the target key, it may also include identity authentication of the requester to ensure that only authorized systems or components can access specific key numbers and keys, thereby further improving data security.

[0044] Step S103, when the verification results corresponding to the multiple data to be encrypted in the database indicate that the verification has passed, the multiple data to be encrypted are encrypted according to the target key to obtain an encryption result corresponding to each data to be encrypted.

[0045] Optionally, when the integrity check of multiple data to be encrypted passes, the multiple data to be encrypted are encrypted based on the target key by using an encryption algorithm to obtain an encryption result corresponding to each data to be encrypted.

[0046] It should be noted that the key management algorithm (ie, encryption algorithm) includes: built-in symmetric algorithms and asymmetric algorithms. Symmetric algorithms include but are not limited to: SM4 algorithm, AES algorithm, DES algorithm and 3DES, etc., and asymmetric algorithms include but are not limited to: SM2 algorithm and RSA algorithm, etc.

[0047] In summary, first, the key number is selected and obtained through the key manager. Then, according to the obtained key number, the corresponding target key is automatically loaded or generated. Before encrypting multiple data to be encrypted in the database, the multiple data to be encrypted are calculated and verified to obtain a verification result, which is used as the basis for subsequent data integrity verification. Finally, when the multiple data to be encrypted in the database pass the integrity verification, they are encrypted using the target key to generate an encryption result.

[0048] The key manager can effectively ensure the secure storage and efficient access of keys. At the same time, it also realizes the dynamic management and use of keys. By verifying the data, it ensures that the integrity of the data can be effectively protected while the data is encrypted, avoiding malicious modification of the data during transmission or storage.

[0049] Optionally, in the data encryption method provided in the embodiment of the present application, determining the target key based on the key number includes: determining whether there is an initial key corresponding to the key number in the key manager, and obtaining a first judgment result; if the first judgment result indicates that there is an initial key corresponding to the key number in the key manager, determining the initial key as the target key; if the first judgment result indicates that there is no initial key corresponding to the key number in the key manager, generating the target key based on the key number.

[0050] In an optional embodiment, a key number is sent to a key manager through a hardware interface to request a key associated with the key number. After receiving the key number, the key manager queries its internal key storage area to check whether there is an initial key corresponding to the key number. If the key manager confirms that there is an initial key corresponding to the key number, the initial key is directly used as the target key for subsequent encryption or decryption operations. If the key manager determines that there is no initial key corresponding to the key number, a new target key is generated based on the key number and a preset key generation strategy or algorithm. Key generation may be based on a random number generator or some algorithm mapping based on the key number.

[0051] Through the above steps, the key manager can dynamically determine or generate the target key according to the key number to ensure the security and flexibility of data encryption.

[0052] Optionally, in the data encryption method provided in the embodiment of the present application, multiple data to be encrypted are encrypted according to the target key to obtain the encryption result corresponding to each data to be encrypted, including: performing data segmentation on the multiple data to be encrypted to obtain first processed data; performing an S-box operation on the first processed data to obtain second processed data; and encrypting the second processed data according to the target key to obtain an encryption result.

[0053] In an alternative embodiment, Figure 2 is a schematic diagram of data encryption according to an embodiment of the present application, and Table 1 is a plurality of original data in the database. Figure 2As shown in Table 1, based on the requirements of data size, format or encryption strategy, the ID card number data in Table 1 (i.e., multiple data to be encrypted) are segmented and processed, and the large block of data is segmented into smaller first processed data to facilitate the efficient execution of subsequent encryption operations. The S-box (SubstitutionBox) operation is applied to the segmented first processed data, which is a nonlinear transformation used to increase data complexity in many encryption algorithms. The S-box replaces each input binary block with another set of binary blocks to increase the degree of encryption confusion and obtain second processed data. Table 2 is the encryption result after encrypting multiple data to be encrypted. As shown in Table 2, the second processed data is encrypted based on the target key obtained from the key manager through the key management algorithm, and the second processed data is converted into an encryption result to obtain an encryption value (i.e., encryption result) corresponding to each piece of data to be encrypted.

[0054] Table 1. Raw data

[0055] ID Name telephone number ID number 1 liubei 18236483000 220600000009308170 2 Guanyu 15680009114 360200000006088804 3 zhangfei 14520000225 411600000001098107 4 Zhugeliang 18140000353 540200000004231247 5 zhouyu 15520000333 360920000001103360 6 sunquan 13260000000 360924190000036086 7 caocao 13921000003 500108194000007214 8 zhaoyun 15993300004 451322000000005441 9 daqiao 18044200004 411329190000005772 10 xiaoqiao 13983600009 470204190000002092

[0056] Table 2 Encryption results

[0057]

[0058]

[0059] It should be noted that no matter whether the target key is already existing or newly generated, the key manager will ensure its secure storage to prevent unauthorized access. At the same time, the key manager is also responsible for the rotation and destruction of keys to cope with changes in security requirements or the management of key lifecycles.

[0060] The S-box operation enhances the security of encryption, while also ensuring the transparency of business operations and the normal operation of application systems, and can effectively prevent data leakage and unauthorized access.

[0061] Optionally, in the data encryption method provided in the embodiment of the present application, the method also includes: determining a target desensitization rule through a key manager, wherein the target desensitization rule includes at least: a target data type of the first data to be desensitized and a target desensitization step corresponding to the target data type; desensitizing multiple second data to be desensitized in the database according to the target desensitization rule to obtain a desensitization result corresponding to each second data to be desensitized.

[0062] In an alternative embodiment, Figure 3 Schematic diagram of data desensitization provided according to the embodiment of the present application. Figure 3As shown, according to application requirements or policy configuration, the relevant desensitization strategy (i.e., target desensitization rule) is queried from the key manager built into the device. The key manager not only manages keys, but also stores desensitization strategies (i.e., target desensitization steps) for various data types (i.e., target data types), such as specific desensitization steps for sensitive information such as mobile phone numbers and ID card numbers. After obtaining the target desensitization rule, the desensitization algorithm module is used to perform real-time conversion and desensitization on multiple second data to be desensitized in the database to obtain the desensitization result.

[0063] The key manager can intelligently determine and apply target desensitization rules to effectively protect sensitive data in the database while maintaining transparency to the application system, avoiding the complexity and performance loss of application transformation.

[0064] Optionally, in the data encryption method provided in the embodiment of the present application, multiple second data to be desensitized in the database are desensitized according to the target desensitization rule, and the desensitization result corresponding to each second data to be desensitized is obtained, including: identifying multiple second data to be desensitized to obtain the data types corresponding to the multiple second data to be desensitized; judging whether the data type belongs to the target data type in the target desensitization rule, and obtaining a second judgment result; if the second judgment result indicates that the data type belongs to the target data type in the target desensitization rule, then desensitizing the multiple second data to be desensitized according to the target desensitization step in the target desensitization rule to obtain a desensitization result.

[0065] In an optional embodiment, Table 3 is the desensitization result after desensitizing multiple second data to be desensitized (i.e., ID card number). As shown in Table 3, the key manager is used to identify the types of multiple second data to be desensitized in the database to determine whether each piece of data belongs to sensitive information and what specific type it is, such as: mobile phone number, ID card number, bank account number, etc. The identified data type is compared with the target data type in the target desensitization rule. If the data type corresponding to the multiple second data to be desensitized belongs to the target data type in the target desensitization rule, the data is processed according to the specific desensitization steps in the target desensitization rule. For example: for multiple second data to be desensitized whose data type is mobile phone number, the target desensitization step includes: masking some numbers or replacing them with asterisks (*); for multiple second data to be desensitized whose data type is ID card number, the target desensitization step is to hide the middle segment of numbers, etc., to obtain the desensitization result.

[0066] Table 3 Desensitization results

[0067]

[0068]

[0069] Through the above steps, the target desensitization rules can be intelligently identified and applied to effectively desensitize the sensitive data in the database, which not only protects data privacy but also ensures the convenience of business operations and the compatibility of application systems.

[0070] Optionally, in the data encryption method provided in the embodiment of the present application, before encrypting multiple data to be encrypted according to the target key, the method also includes: preprocessing the multiple data to be encrypted to obtain third processed data; concatenating the target key and the third processed data to obtain fourth processed data; and verifying the fourth processed data to obtain a verification result.

[0071] In an alternative embodiment, Figure 4 Table 4 is a schematic diagram of data verification according to an embodiment of the present application, and Table 5 is a verification result after integrity verification of multiple encrypted data (i.e., ID card numbers). Figure 4 As shown in Table 4, multiple data to be encrypted are preprocessed. Preprocessing includes but is not limited to: data cleaning, format standardization, data type conversion, removal of special characters and other operations to obtain third processed data. The target key and the third processed data are spliced ​​in a specific order, or the target key is inserted into a specific position of the third processed data to form a new data structure, i.e., the fourth processed data. After the data splicing is completed, the fourth processed data is integrity checked, and the integrity check algorithm is selected through the key manager, including but not limited to: CRC algorithm, SM3-HMAC algorithm, MD5 algorithm, hash algorithm, etc. The summary value (i.e., the check result) is calculated for the fourth processed data according to the selected integrity check algorithm and written into the summary derivative column.

[0072] Table 4 Verification results

[0073]

[0074]

[0075] It should be noted that before calculating the summary value for a single column or multiple columns of sensitive data (i.e., the fourth processed data) through the key manager, a sensitive column summary value derivative column is added to the original table of the database, and the summary derivative column is initialized to NULL to store the summary value corresponding to the fourth processed data.

[0076] It should be noted that the embodiment of the present application provides a trigger operation for integrity verification, which manually triggers the integrity verification of sensitive data (i.e., the fourth processed data) that has been configured with integrity verification. This process will automatically calculate the summary value, and a tampering prompt will be given for data whose summary value has changed.

[0077] By preprocessing, splicing and checking the integrity of data, the security and efficiency of data encryption can be further improved, ensuring the integrity and confidentiality of sensitive information during storage and transmission.

[0078] Optionally, in the data encryption method provided in the embodiment of the present application, before encrypting multiple data to be encrypted according to the target key to obtain the encryption result corresponding to each data to be encrypted, the method also includes: creating multiple initial ciphertext derivative columns corresponding to the data to be encrypted in the database; initializing the initial ciphertext derivative column according to a preset value to obtain a target ciphertext derivative column, wherein the target ciphertext derivative column is used to store the encryption result.

[0079] In an optional embodiment, Figure 5 is a schematic diagram of a ciphertext derivative column provided according to an embodiment of the present application, such as Figure 5 As shown, in the database table, a corresponding ciphertext derivative column (i.e., initial ciphertext derivative column) is created for each data column to be encrypted. For example: if there is a field that is a phone number, then a new derivative column is created next to the field to store the encrypted phone number ciphertext. After the initial ciphertext derivative column is created, it needs to be initialized (i.e., washed) to ensure that its content meets the input requirements of the encryption algorithm before encryption. During initialization, each record value of the ciphertext derivative column is set to NULL or a preset placeholder (preset value) to ensure that the content of the ciphertext derivative column is empty or a preset initial value before encryption of all data to be encrypted, so as to obtain the target ciphertext derivative column.

[0080] It should be noted that in the actual encryption phase, the target key is used in combination with the encryption algorithm to encrypt each data to be encrypted, and the encrypted result is written into the corresponding target ciphertext derivative column. Multiple original plaintext columns and target ciphertext derivative columns of data to be encrypted exist at the same time, and the business operation is provided by the original plaintext column. If the service is manually switched to the target ciphertext derivative column, the original plaintext columns and target ciphertext derivative columns of multiple data to be encrypted still exist at the same time, but the business operation is provided by the target ciphertext derivative column.

[0081] It should be noted that in order to verify the correctness of the target ciphertext derived column, after running the business for a period of time, the newly added data to be encrypted will be stored in the database, and the original plaintext column and its corresponding target ciphertext derived column will be written at the same time. When querying sensitive data, the plaintext will be calculated from the ciphertext derived column through the key manager. If the original plaintext column of the data to be encrypted in the table is deleted, the data to be encrypted will only be stored on the disk in the form of ciphertext.

[0082] By creating and initializing ciphertext derivative columns, necessary preparations are provided for subsequent data encryption operations, ensuring the integrity and consistency of data encryption, while also facilitating data management and query.

[0083] It should be noted that Figure 6 Schematic diagram of a data encryption method provided according to an embodiment of the present application. Figure 6 As shown, the encryption management system server is connected to the database server, and uses the built-in hardware key manager to configure encryption strategy, integrity verification strategy and desensitization strategy for the data to be processed. The strategy is stored in the encryption management system server, and the data to be encrypted is stored in the database server in the form of ciphertext. The application server connects to the database server to perform business data operations. When it involves encryption operations on encrypted data, it will read the configuration strategy from the encryption management system server. The encryption management system server performs transparent encryption, decryption and desensitization display according to the configured strategy.

[0084] The data encryption method provided in the embodiment of the present application obtains a key number through a key manager; determines a target key based on the key number; and when verification results corresponding to multiple data to be encrypted in a database indicate that the verification has passed, encrypts the multiple data to be encrypted based on the target key to obtain an encryption result corresponding to each data to be encrypted, thereby solving the problem in the related art of managing the key for data encryption by software, and encrypting sensitive data in the database by the key, resulting in poor security of sensitive data.

[0085] In summary, in this solution, first, a key number is selected and obtained through a key manager. Then, according to the obtained key number, the corresponding target key is automatically loaded or generated. Before encrypting multiple data to be encrypted in the database, the multiple data to be encrypted are calculated and verified to obtain a verification result, which is used as a basis for subsequent data integrity verification. Finally, after the multiple data to be encrypted in the database pass the integrity verification, they are encrypted using the target key to generate an encryption result.

[0086] The key manager can effectively ensure the secure storage and efficient access of keys. At the same time, it also realizes the dynamic management and use of keys. By verifying the data, it ensures that the integrity of the data can be effectively protected while the data is encrypted, avoiding malicious modification of the data during transmission or storage.

[0087] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0088] The embodiment of the present application also provides a data encryption device. It should be noted that the data encryption device of the embodiment of the present application can be used to execute the data encryption method provided by the embodiment of the present application. The data encryption device provided by the embodiment of the present application is introduced below.

[0089] Figure 7 Schematic diagram of a data encryption device according to an embodiment of the present application. Figure 7 As shown, the device includes: an acquisition unit 701, a first determination unit 702, and an encryption unit 703.

[0090] The acquisition unit 701 is used to acquire a key number through a key manager;

[0091] A first determining unit 702, configured to determine a target key according to the key number;

[0092] The encryption unit 703 is used to encrypt the multiple data to be encrypted according to the target key to obtain the encryption result corresponding to each data to be encrypted when the verification results corresponding to the multiple data to be encrypted in the database indicate that the verification is passed.

[0093] In the data encryption device provided in the embodiment of the present application, the acquisition unit 701 acquires the key number through the key manager; the first determination unit 702 determines the target key based on the key number; the encryption unit 703 encrypts the multiple data to be encrypted according to the target key when the verification results corresponding to the multiple data to be encrypted in the database indicate that the verification has passed, and obtains the encryption result corresponding to each data to be encrypted, which solves the problem in the related art that the key for data encryption is managed by software, and the sensitive data in the database is encrypted by the key, resulting in poor security of the sensitive data.

[0094] In this solution, first, a key number is selected and obtained through a key manager. Then, according to the obtained key number, the corresponding target key is automatically loaded or generated. Before encrypting multiple data to be encrypted in the database, the multiple data to be encrypted are calculated and verified to obtain a verification result, which is used as a basis for subsequent data integrity verification. Finally, after the multiple data to be encrypted in the database pass the integrity verification, they are encrypted using the target key to generate an encryption result.

[0095] The key manager can effectively ensure the secure storage and efficient access of keys. At the same time, it also realizes the dynamic management and use of keys. By verifying the data, it ensures that the integrity of the data can be effectively protected while the data is encrypted, avoiding malicious modification of the data during transmission or storage.

[0096] Optionally, in the data encryption device provided in the embodiment of the present application, the first determination unit includes: a first judgment module, used to determine whether there is an initial key corresponding to the key number in the key manager, and obtain a first judgment result; a determination module, used to determine the initial key as the target key if the first judgment result indicates that there is an initial key corresponding to the key number in the key manager; and a generation module, used to generate the target key based on the key number if the first judgment result indicates that there is no initial key corresponding to the key number in the key manager.

[0097] Optionally, in the data encryption device provided in the embodiment of the present application, the encryption unit includes: a first processing module, used to perform data segmentation on multiple data to be encrypted to obtain first processed data; a second processing module, used to perform S-box operation on the first processed data to obtain second processed data; an encryption module, used to encrypt the second processed data according to the target key to obtain an encryption result.

[0098] Optionally, in the data encryption device provided in the embodiment of the present application, the device also includes: a second determination unit, used to determine a target desensitization rule through a key manager, wherein the target desensitization rule includes at least: a target data type of the first data to be desensitized and a target desensitization step corresponding to the target data type; a desensitization unit, used to desensitize multiple second data to be desensitized in the database according to the target desensitization rule, and obtain a desensitization result corresponding to each second data to be desensitized.

[0099] Optionally, in the data encryption device provided in the embodiment of the present application, the desensitizing unit includes: an identification module, used to identify multiple second data to be desensitized, and obtain data types corresponding to the multiple second data to be desensitized; a second judgment module, used to judge whether the data type belongs to the target data type in the target desensitization rule, and obtain a second judgment result; a desensitizing module, used to desensitize the multiple second data to be desensitized according to the target desensitization step in the target desensitization rule if the second judgment result indicates that the data type belongs to the target data type in the target desensitization rule, and obtain a desensitization result.

[0100] Optionally, in the data encryption device provided in the embodiment of the present application, the device also includes: a preprocessing unit, used to preprocess multiple data to be encrypted before encrypting the multiple data to be encrypted according to the target key to obtain third processed data; a splicing unit, used to splice the target key and the third processed data to obtain fourth processed data; and a verification unit, used to verify the fourth processed data to obtain a verification result.

[0101] Optionally, in the data encryption device provided in the embodiment of the present application, the device also includes: a creation unit, used to create multiple initial ciphertext derivative columns corresponding to the data to be encrypted in the database before encrypting the multiple data to be encrypted according to the target key and obtaining the encryption result corresponding to each data to be encrypted; an initialization unit, used to initialize the initial ciphertext derivative column according to a preset value to obtain a target ciphertext derivative column, wherein the target ciphertext derivative column is used to store the encryption result.

[0102] The data encryption device includes a processor and a memory. The above-mentioned acquisition unit 701, first determination unit 702, encryption unit 703, etc. are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize secure encryption of data.

[0103] The processor includes a kernel, which calls the corresponding program unit from the memory. One or more kernels can be set, and the secure encryption of data can be achieved by adjusting the kernel parameters.

[0104] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0105] An embodiment of the present invention provides a computer-readable storage medium on which a program is stored. When the program is executed by a processor, a data encryption method is implemented.

[0106] An embodiment of the present invention provides a processor, which is used to run a program, wherein a data encryption method is executed when the program is running.

[0107] like Figure 8 As shown, an embodiment of the present invention provides an electronic device, the device includes a processor, a memory, and a program stored in the memory and executable on the processor, and the processor implements the following steps when executing the program: obtaining a key number through a key manager; determining a target key based on the key number; and encrypting the multiple data to be encrypted based on the target key when verification results corresponding to multiple data to be encrypted in a database indicate that the verification has passed, to obtain an encryption result corresponding to each data to be encrypted.

[0108] Furthermore, determining the target key based on the key number includes: determining whether there is an initial key corresponding to the key number in the key manager to obtain a first judgment result; if the first judgment result indicates that there is an initial key corresponding to the key number in the key manager, determining the initial key as the target key; if the first judgment result indicates that there is no initial key corresponding to the key number in the key manager, generating the target key based on the key number.

[0109] Furthermore, multiple data to be encrypted are encrypted according to the target key to obtain an encryption result corresponding to each data to be encrypted, including: data segmentation of the multiple data to be encrypted to obtain first processed data; S-box operation of the first processed data to obtain second processed data; encrypting the second processed data according to the target key to obtain an encryption result.

[0110] Furthermore, the method also includes: determining a target desensitization rule through a key manager, wherein the target desensitization rule includes at least: a target data type of the first data to be desensitized and a target desensitization step corresponding to the target data type; desensitizing multiple second data to be desensitized in the database according to the target desensitization rule to obtain a desensitization result corresponding to each second data to be desensitized.

[0111] Furthermore, multiple second data to be desensitized in the database are desensitized according to the target desensitization rule to obtain desensitization results corresponding to each second data to be desensitized, including: identifying multiple second data to be desensitized to obtain data types corresponding to multiple second data to be desensitized; judging whether the data type belongs to the target data type in the target desensitization rule to obtain a second judgment result; if the second judgment result indicates that the data type belongs to the target data type in the target desensitization rule, desensitizing the multiple second data to be desensitized according to the target desensitization step in the target desensitization rule to obtain a desensitization result.

[0112] Furthermore, before encrypting multiple data to be encrypted according to the target key, the method also includes: preprocessing the multiple data to be encrypted to obtain third processed data; concatenating the target key and the third processed data to obtain fourth processed data; and verifying the fourth processed data to obtain a verification result.

[0113] Furthermore, before encrypting multiple data to be encrypted according to the target key and obtaining the encryption result corresponding to each data to be encrypted, the method also includes: creating multiple initial ciphertext derivative columns corresponding to the data to be encrypted in the database; initializing the initial ciphertext derivative column according to a preset value to obtain a target ciphertext derivative column, wherein the target ciphertext derivative column is used to store the encryption result.

[0114] The devices in this article can be servers, PCs, PADs, mobile phones, etc.

[0115] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing an initialization program having the following method steps: obtaining a key number through a key manager; determining a target key based on the key number; and encrypting multiple data to be encrypted based on the target key when verification results corresponding to multiple data to be encrypted in a database indicate that the verification has passed, to obtain an encryption result corresponding to each data to be encrypted.

[0116] Furthermore, determining the target key based on the key number includes: determining whether there is an initial key corresponding to the key number in the key manager to obtain a first judgment result; if the first judgment result indicates that there is an initial key corresponding to the key number in the key manager, determining the initial key as the target key; if the first judgment result indicates that there is no initial key corresponding to the key number in the key manager, generating the target key based on the key number.

[0117] Furthermore, multiple data to be encrypted are encrypted according to the target key to obtain an encryption result corresponding to each data to be encrypted, including: data segmentation of the multiple data to be encrypted to obtain first processed data; S-box operation of the first processed data to obtain second processed data; encrypting the second processed data according to the target key to obtain an encryption result.

[0118] Furthermore, the method also includes: determining a target desensitization rule through a key manager, wherein the target desensitization rule includes at least: a target data type of the first data to be desensitized and a target desensitization step corresponding to the target data type; desensitizing multiple second data to be desensitized in the database according to the target desensitization rule to obtain a desensitization result corresponding to each second data to be desensitized.

[0119] Furthermore, multiple second data to be desensitized in the database are desensitized according to the target desensitization rule to obtain desensitization results corresponding to each second data to be desensitized, including: identifying multiple second data to be desensitized to obtain data types corresponding to multiple second data to be desensitized; judging whether the data type belongs to the target data type in the target desensitization rule to obtain a second judgment result; if the second judgment result indicates that the data type belongs to the target data type in the target desensitization rule, desensitizing the multiple second data to be desensitized according to the target desensitization step in the target desensitization rule to obtain a desensitization result.

[0120] Furthermore, before encrypting multiple data to be encrypted according to the target key, the method also includes: preprocessing the multiple data to be encrypted to obtain third processed data; concatenating the target key and the third processed data to obtain fourth processed data; and verifying the fourth processed data to obtain a verification result.

[0121] Furthermore, before encrypting multiple data to be encrypted according to the target key and obtaining the encryption result corresponding to each data to be encrypted, the method also includes: creating multiple initial ciphertext derivative columns corresponding to the data to be encrypted in the database; initializing the initial ciphertext derivative column according to a preset value to obtain a target ciphertext derivative column, wherein the target ciphertext derivative column is used to store the encryption result.

[0122] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0123] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0124] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0125] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0126] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0127] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0128] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0129] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0130] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0131] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A data encryption method, characterized in that: include: Obtain the key number through the key manager; Determining a target key according to the key number; When the verification results corresponding to the plurality of data to be encrypted in the database indicate that the verification has passed, the plurality of data to be encrypted are encrypted according to the target key to obtain an encryption result corresponding to each data to be encrypted.

2. The method according to claim 1, characterized in that Determining the target key according to the key number includes: Determine whether there is an initial key corresponding to the key number in the key manager, and obtain a first determination result; If the first judgment result indicates that the initial key corresponding to the key number exists in the key manager, determining the initial key as the target key; If the first judgment result indicates that the initial key corresponding to the key number does not exist in the key manager, the target key is generated according to the key number.

3. The method according to claim 1, characterized in that The plurality of data to be encrypted are encrypted according to the target key, and the encryption result corresponding to each data to be encrypted is obtained, including: Performing data segmentation on the plurality of data to be encrypted to obtain first processed data; Performing an S-box operation on the first processed data to obtain second processed data; The second processed data is encrypted according to the target key to obtain the encryption result.

4. The method according to claim 1, characterized in that: The method further comprises: Determine a target desensitization rule through the key manager, wherein the target desensitization rule includes at least: a target data type of the first data to be desensitized and a target desensitization step corresponding to the target data type; Desensitize the plurality of second data to be desensitized in the database according to the target desensitization rule to obtain a desensitization result corresponding to each second data to be desensitized.

5. The method according to claim 4, characterized in that Desensitizing the plurality of second data to be desensitized in the database according to the target desensitization rule, and obtaining desensitization results corresponding to each second data to be desensitized includes: Identify the plurality of second data to be desensitized, and obtain data types corresponding to the plurality of second data to be desensitized; Determine whether the data type belongs to the target data type in the target desensitization rule, and obtain a second determination result; If the second judgment result indicates that the data type belongs to the target data type in the target desensitization rule, the multiple second data to be desensitized are desensitized according to the target desensitization step in the target desensitization rule to obtain the desensitization result.

6. The method according to claim 1, characterized in that Before encrypting the plurality of data to be encrypted according to the target key, the method further includes: Preprocessing the plurality of data to be encrypted to obtain third processed data; Concatenate the target key and the third processed data to obtain fourth processed data; The fourth processed data is verified to obtain the verification result.

7. The method according to claim 1, characterized in that Before encrypting the plurality of data to be encrypted according to the target key to obtain an encryption result corresponding to each data to be encrypted, the method further includes: Creating, in the database, initial ciphertext derivative columns corresponding to the plurality of data to be encrypted; The initial ciphertext derivative column is initialized according to a preset value to obtain a target ciphertext derivative column, wherein the target ciphertext derivative column is used to store the encryption result.

8. A data encryption device, characterized in that: include: An acquisition unit, used for acquiring a key number through a key manager; A first determining unit, configured to determine a target key according to the key number; The encryption unit is used to encrypt the multiple data to be encrypted according to the target key to obtain the encryption result corresponding to each data to be encrypted when the verification results corresponding to the multiple data to be encrypted in the database indicate that the verification has passed.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored program, wherein when the program is executed, the storage medium is controlled to execute the data encryption method according to any one of claims 1 to 7 on a device.

10. An electronic device, characterized in that: It includes one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the data encryption method described in any one of claims 1 to 7.

Images