Data encryption method and device, equipment, storage medium and product

Abstract

The invention discloses a data encryption method and device, equipment, a storage medium and a product, and relates to the technical field of data security, and the method comprises the steps: obtaining an equipment fingerprint generated by a front-end tool in a computing node, and generating a front-end private key and a front-end public key; generating a preposed confusion key, and encrypting the preposed private key based on the preposed confusion key to obtain a preposed private key ciphertext; encrypting the preposed confusion key based on the device fingerprint to obtain a preposed confusion key ciphertext; confusing the preposed private key ciphertext and the preposed confusion key ciphertext to generate a preposed cryptographic module; and importing the preposed cryptographic module into the corresponding computing node, so that the computing node calls the preposed cryptographic module to encrypt the target data. The overall data encryption processing efficiency is improved by increasing the deployment nodes of the front password module and transversely expanding the deployment number of the encryption calculation nodes, the high-performance requirement of mass data is met, and the technical problem that the efficiency is low when the mass data is encrypted is solved.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to data encryption methods, devices, equipment, storage media and products. Background Art

[0002] With the development of cryptographic technology, we can use the complementary features of symmetric and asymmetric cryptographic algorithms, that is, use hybrid cryptographic algorithms to securely encrypt massive data. For example, based on the fast encryption speed of symmetric cryptographic algorithms, we use symmetric cryptographic algorithms to encrypt massive data. Based on the characteristics of asymmetric cryptographic algorithms, which are simple and secure in key management and transmission and high in data encryption security, we use asymmetric cryptographic algorithms to manage the keys of the previous symmetric cryptographic algorithms to ensure the security of key transmission and management of symmetric cryptographic algorithms. However, the design of encryption algorithms for massive data is usually based on a black box model, assuming that the operating environment of the cryptographic algorithm is secure, and attackers can only access the input and output of the algorithm. Encryption calculations cannot be run in a general computing environment, and the encryption performance of massive data cannot get rid of the bottleneck of hardware cryptographic resources.

[0003] The above contents are only used to assist in understanding the technical solution of the present invention and do not constitute an admission that the above contents are prior art. Summary of the invention

[0004] The main purpose of this application is to provide a data encryption method, device, equipment, storage medium and product, aiming to solve the technical problem of low efficiency in encrypting massive data in the prior art.

[0005] To achieve the above purpose, the present application provides a data encryption method, the method comprising:

[0006] Obtain the device fingerprint generated by the pre-tool in the computing node, and generate the pre-private key and pre-public key;

[0007] Generate a pre-obfuscation key, and encrypt the pre-private key based on the pre-obfuscation key to obtain a pre-private key ciphertext;

[0008] Encrypting the pre-obfuscation key based on the device fingerprint to obtain a pre-obfuscation key ciphertext;

[0009] Obfuscating the pre-private key ciphertext and the pre-obfuscating key ciphertext to generate a pre-cipher module;

[0010] The pre-cipher module is imported into a corresponding computing node, so that the computing node calls the pre-cipher module to encrypt the target data.

[0011] In one embodiment, the step of generating a pre-private key and a pre-public key includes:

[0012] Randomly generate a pre-secret value;

[0013] Determine the pre-public key based on the pre-secret value and the generator;

[0014] Determine a pre-identification based on the pre-public key and the device fingerprint;

[0015] Determine a partial private key based on the preceding identifier and the system master key;

[0016] Based on the partial private key, the pre-private key is determined.

[0017] In one embodiment, the step of generating a pre-obfuscation key includes:

[0018] Randomly generate system master key;

[0019] A key is derived based on the system master key and the device fingerprint to obtain the pre-obfuscation key.

[0020] In one embodiment, the step of importing the pre-cryptographic module into a corresponding computing node so that the computing node calls the pre-cryptographic module to encrypt the target data includes:

[0021] Importing the pre-cryptographic module into the corresponding computing node;

[0022] When the computing node initiates an encryption request for target data to the pre-cryptographic module, a random number is generated and sent to the pre-cryptographic module, so that the pre-cryptographic module signs the random number based on the pre-private key to obtain a partial signature;

[0023] Based on the partial signature, generate a multi-signature, and verify the multi-signature;

[0024] After the multi-signature verification is passed, deriving the data key;

[0025] Encrypting the data key based on the pre-public key to obtain a data key ciphertext;

[0026] The data key ciphertext is sent to the pre-cipher module, so that the pre-cipher module decrypts the data key ciphertext based on the pre-private key to obtain the data key, and encrypts the target data based on the data key to obtain the encrypted target data.

[0027] In one embodiment, the method further comprises:

[0028] When the pre-password module obtains the pre-obfuscation key corresponding to the pre-obfuscation key ciphertext based on the device fingerprint decryption, it is determined that the pre-password module is successfully imported, and when the computing node initiates an encryption request for target data to the pre-password module, a random number is generated and sent to the pre-password module;

[0029] When the pre-cryptographic module fails to decrypt and obtain the pre-obfuscation key corresponding to the pre-obfuscation key ciphertext based on the device fingerprint, it is determined that the pre-cryptographic module fails to be imported, and the encryption process is stopped.

[0030] In one embodiment, the step of generating a multi-signature based on the partial signature and verifying the multi-signature includes:

[0031] Obtaining the partial signature, and verifying the partial signature;

[0032] After the partial signature is verified, a multi-signature is calculated based on the partial signature and the random number;

[0033] Based on the pre-public key, generate an aggregate public key;

[0034] The multiple signatures are verified based on the aggregated public key, the original signature value, the preceding identifier, and the signature random value.

[0035] In addition, to achieve the above-mentioned purpose, the present application also proposes a data encryption device, which includes a pre-cryptographic module and a cryptographic service platform;

[0036] The cryptographic service platform is used to obtain the device fingerprint generated by the front-end tool in the computing node, generate a front private key and a front public key, generate a front obfuscation key, encrypt the front private key based on the front obfuscation key to obtain a front private key ciphertext, encrypt the front obfuscation key based on the device fingerprint to obtain a front obfuscation key ciphertext, obfuscate the front private key ciphertext and the front obfuscation key ciphertext, generate a front cryptographic module, and import the front cryptographic module into the corresponding computing node;

[0037] The pre-cipher module is used to encrypt the target data upon receiving an encryption request for the target data initiated by the computing node, obtain the encrypted target data, and send the encrypted target data to the computing node.

[0038] In addition, to achieve the above-mentioned purpose, the present application also proposes a data encryption device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the data encryption method described above.

[0039] In addition, to achieve the above objectives, the present invention also proposes a storage medium, which is a computer-readable storage medium, and stores a computer program on the storage medium. When the computer program is executed by a processor, the steps of the data encryption method described above are implemented.

[0040] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, wherein the computer program product includes a computer program, and when the computer program is executed by a processor, the steps of the data encryption method described above are implemented.

[0041] The present application provides a data encryption method, which includes obtaining a device fingerprint generated by a front-end tool in a computing node, and generating a front private key and a front public key; generating a front obfuscation key, encrypting the front private key based on the front obfuscation key, and obtaining a front private key ciphertext; encrypting the front obfuscation key based on the device fingerprint, and obtaining a front obfuscation key ciphertext; obfuscating the front private key ciphertext and the front obfuscation key ciphertext, and generating a front cryptographic module; and importing the front cryptographic module into a corresponding computing node, so that the computing node calls the front cryptographic module to encrypt target data. The present application generates a pre-private key according to the device fingerprint of the computing node, confuses the encryption service, the encrypted pre-obfuscated key and the encrypted pre-private key, and generates a pre-cryptographic module. The module can be safely run in a general computing environment and imported into the corresponding pre-computing node. The pre-cryptographic module and the computing node can be bound to ensure the security of cryptographic calculations in a general computing environment. In the encryption process, the secure distribution of encryption keys can be achieved to ensure the security of the overall encryption process and reduce the risk of key leakage. Moreover, without increasing hardware cryptographic resources, by increasing the deployment nodes of the pre-cryptographic module, the number of deployed encryption computing nodes can be horizontally expanded to improve the overall data encryption processing capability, meet the high-performance encryption requirements of massive data, get rid of the performance constraints of hardware cryptographic resources, improve encryption efficiency, and solve the technical problem of low efficiency when encrypting massive data. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0043] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0044] Figure 1 This is a flow chart of the first embodiment of the data encryption method of the present application;

[0045] Figure 2 This is a flow chart of the second embodiment of the data encryption method of the present application;

[0046] Figure 3 A brief flowchart of the data encryption method provided in Example 2 of the present application;

[0047] Figure 4 A schematic diagram of the encryption process of the data encryption method provided in Example 2 of the present application;

[0048] Figure 5 This is a schematic diagram of the module structure of the data encryption device according to an embodiment of the present application;

[0049] Figure 6 This is a schematic diagram of the device structure of the hardware operating environment involved in the data encryption method in the embodiment of the present application.

[0050] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0051] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0052] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0053] The main solution of the embodiment of the present application is: obtain the device fingerprint generated by the front-end tool in the computing node, and generate a front private key and a front public key; generate a front obfuscation key, encrypt the front private key based on the front obfuscation key, and obtain the front private key ciphertext; encrypt the front obfuscation key based on the device fingerprint to obtain the front obfuscation key ciphertext; obfuscate the front private key ciphertext and the front obfuscation key ciphertext to generate a front cryptographic module; import the front cryptographic module into the corresponding computing node, so that the computing node calls the front cryptographic module to encrypt the target data.

[0054] The present application provides a solution, which generates a pre-private key according to the device fingerprint of the computing node, obfuscates the encryption service, the encrypted pre-obfuscated key and the encrypted pre-private key, and generates a pre-cryptographic module. The module can be safely run in a general computing environment and imported into the corresponding pre-computing node, so as to realize the binding of the pre-cryptographic module and the computing node, ensure the operational security of cryptographic calculations in the general computing environment, realize the secure distribution of encryption keys in the encryption process, ensure the security of the overall encryption process, reduce the risk of key leakage, and can horizontally expand the number of deployed encryption computing nodes by increasing the deployment nodes of the pre-cryptographic module without increasing hardware cryptographic resources, thereby improving the overall data encryption processing capability, meeting the high-performance encryption requirements of massive data, getting rid of the performance constraints of hardware cryptographic resources, improving encryption efficiency, and solving the technical problem of low efficiency when encrypting massive data.

[0055] The present application embodiment provides a data encryption method, referring to Figure 1 , Figure 1 This is a flow chart of the first embodiment of the data encryption method of the present application.

[0056] In this embodiment, the data encryption method includes steps S10 to S40:

[0057] Step S10, obtaining the device fingerprint generated by the front-end tool in the computing node, and generating a front-end private key and a front-end public key;

[0058] It should be noted that the executor of this application is the cryptographic service platform.

[0059] In addition, it should be noted that before executing step S10, it is necessary to prepare a computing node on the user side. The computing node may be a general computing server, which is not specifically limited in this embodiment. Assume that there are n computing nodes N in total. i {i=1,2,...,n}, each computing node is deployed with pre-configuration tools.

[0060] It is understandable that the device fingerprint is generated by the front-end tool based on the computing environment characteristics, which are the environmental characteristic values ​​of the computing node where the front-end tool is located. In the specific implementation, the server ROOT permission is used to run the front-end tool, which automatically captures the hardware, software, network and other multi-dimensional information of the computing node, such as: deployment path, computer name, IP (Internet Protocol), MAC (Media Access Control Address), motherboard number, CPU (Central Processing Unit) information, etc., to generate the unique identification device fingerprint DF of the computing node. i{i=1,2,...,n}.

[0061] It should be understood that an HTTPS (Hypertext Transfer Protocol Secure) secure transmission channel needs to be established between the front-end tool and the password service platform in order to upload the device fingerprint. In the specific implementation, the front-end tool communicates with the password service platform, verifies the SSL (Secure Socket Layer) certificate of the password service platform, and then establishes a national HTTPS communication channel according to the national SSL protocol. The front-end tool uses the SSL channel to upload the device fingerprint DF i {i=1,2,...,n} is uploaded to the password service platform.

[0062] It should be noted that the password service platform obtains the device fingerprint DF i , call the cryptographic device to generate the pre-key (PK i , S.K. i ){i=1,2,...,n}, the pre-key includes the pre-private key SK i And the previous public key PK i .

[0063] In a feasible implementation, the steps of generating a pre-private key and a pre-public key include: randomly generating a pre-secret value; determining the pre-public key based on the pre-secret value and a generator; determining the pre-identifier based on the pre-public key and the device fingerprint; determining a partial private key based on the pre-identifier and a system master key; and determining the pre-private key based on the partial private key.

[0064] It should be noted that the cryptographic service platform is initialized first, and the cryptographic service platform runs the corresponding algorithm and inputs the custom security parameter k. To ensure security, the true random number generated by the cryptographic device is used as k to generate and output the system master key MK=KeyGen(k) and system parameter params. Let g be a large prime number, G 1 With G 2 They are groups of order g and generator P, and bilinear maps e:G 1 ×G 2 →G 2 , select the one-way hash function H 1 , H 3 :{0,1} * →G 1 , Password service platform randomly selected For the system master key MK, calculate the system public key P 0 =sP, the system parameters are params=(g,G 1 ,G2 ,P,e,H 1 ,H 2 ,H 3 ,P 0 ).

[0065] It is understandable that the algorithm KeyGen (DF i ,params),DF i {i=1,2,...,n} is the device fingerprint of the computing node uploaded by the front-end tool to the password service platform, and the password service platform generates it randomly As the pre-secret value z i , calculate PK i =z i P is used as the pre-public key to calculate the pre-identifier Calculate partial private key Set up the private key

[0066] Step S20, generating a pre-obfuscation key, and encrypting the pre-private key based on the pre-obfuscation key to obtain a pre-private key ciphertext;

[0067] It should be noted that the cryptographic service platform derives the pre-obfuscation key CK i , using CK i Encrypted pre-private key SK i The encrypted front private key is the front private key ciphertext Enc_SM4(SK i ,CK i ).

[0068] In a feasible implementation manner, the step of generating a pre-obfuscation key includes: randomly generating a system master key; and performing key derivation based on the system master key and the device fingerprint to obtain the pre-obfuscation key.

[0069] It is understandable that the cryptographic service platform uses the system master key MK and the device fingerprint to derive KDF (MK||DF i ), generate the pre-obfuscation key CK i .

[0070] Step S30, encrypting the pre-obfuscation key based on the device fingerprint to obtain a pre-obfuscation key ciphertext;

[0071] It should be noted that the password service platform uses device fingerprint DF i Encryption pre-obfuscation key CK i , get the encrypted pre-obfuscation key, that is, the pre-obfuscation key ciphertext Enc_SM4(CK i ,DK i ).

[0072] Step S40, obfuscating the pre-private key ciphertext and the pre-obfuscating key ciphertext to generate a pre-cipher module;

[0073] It is understandable that the obfuscation key library is called to pass the pre-obfuscation key ciphertext Enc_SM4 (CK i ,DK i ) is confused with the encryption algorithm and then with the pre-private key ciphertext Enc_SM4(SK i ,CK i ) together to generate the pre-password module S i {i=1,2,...,n}.

[0074] Step S50: import the pre-cryptographic module into the corresponding computing node, so that the computing node calls the pre-cryptographic module to encrypt the target data.

[0075] It should be noted that the target data is the relevant data to be encrypted. In this embodiment, the obfuscated pre-cryptographic module is imported into the corresponding computing node, so that the computing node can call the pre-cryptographic module to encrypt the target data.

[0076] For example, in the electronic bidding scenario, there are many types of bidding documents, and the bids are often several GB in size. Large enterprises usually adopt a centralized bidding method, that is, dozens or even hundreds of projects are opened at the same time, and each project has bids from several different manufacturers. In this case, it is necessary to complete the encryption and decryption of several TB of bidding documents in a short period of time. The existing encryption method of using cryptographic devices to allocate cryptographic resources requires the purchase of a large amount of cryptographic device hardware. By adopting the solution of this embodiment, it is possible to reduce costs while ensuring security, and use a general computing environment (i.e., non-cryptographic equipment) to complete the encryption of massive data.

[0077] The present embodiment provides a data encryption method, which obtains a device fingerprint generated by a front-end tool in a computing node, and generates a front private key and a front public key; generates a front obfuscation key, encrypts the front private key based on the front obfuscation key, and obtains a front private key ciphertext; encrypts the front obfuscation key based on the device fingerprint to obtain a front obfuscation key ciphertext; obfuscates the front private key ciphertext and the front obfuscation key ciphertext to generate a front cryptographic module; imports the front cryptographic module into a corresponding computing node, so that the computing node calls the front cryptographic module to encrypt target data. This application generates a pre-private key according to the device fingerprint of the computing node, obfuscates the encryption service, the encrypted pre-obfuscated key and the encrypted pre-private key, and generates a pre-cryptographic module. The module can be safely run in a general computing environment and imported into the corresponding pre-computing node. The pre-cryptographic module and the computing node can be bound to ensure the security of cryptographic calculations in a general computing environment. In the encryption process, the secure distribution of encryption keys can be achieved to ensure the security of the overall encryption process and reduce the risk of key leakage. In addition, the number of deployed encryption computing nodes can be horizontally expanded by increasing the deployment nodes of the pre-cryptographic module without increasing hardware cryptographic resources, thereby improving the overall data encryption processing capability, meeting the high-performance encryption requirements of massive data, getting rid of the performance constraints of hardware cryptographic resources, and improving encryption efficiency.

[0078] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the above-mentioned embodiment 1 can refer to the above introduction, and will not be repeated later. Figure 2 , the step S50 may include steps S601 to S606:

[0079] Step S601, importing the pre-cryptographic module into the corresponding computing node;

[0080] In a feasible implementation, after step S601, it may include: when the pre-password module obtains the pre-obfuscation key corresponding to the pre-obfuscation key ciphertext by decrypting based on the device fingerprint, determining that the pre-password module is imported successfully, and executing the step of generating a random number and sending it to the pre-password module when the computing node initiates an encryption request for target data to the pre-password module; when the pre-password module fails to decrypt based on the device fingerprint to obtain the pre-obfuscation key corresponding to the pre-obfuscation key ciphertext, determining that the pre-password module import fails, and stopping the encryption process.

[0081] It should be noted that the pre-password module calls the pre-tool to obtain the device fingerprint DF i , using DF i Decrypt the pre-obfuscated key ciphertext Enc_SM4(CK i ,DK i), if the pre-obfuscated key CK can be successfully decrypted i , it means that the pre-password module is successfully bound to the computing node, that is, the import is successful, and the next step can be performed. Otherwise, it means that the pre-password module fails to bind to the computing node, that is, the import fails, and the process needs to be terminated.

[0082] Step S602, when the computing node initiates an encryption request for the target data plaintext to the pre-cryptographic module, a random number is generated and sent to the pre-cryptographic module, so that the pre-cryptographic module signs the random number based on the pre-private key to obtain a partial signature;

[0083] It should be noted that the computing node calls the pre-encryption module to initiate a target data encryption request, and the cryptographic service platform generates a random number and sends it to each pre-encryption module. The cryptographic service platform obtains the partial signatures S of all pre-encryption modules. i {i=1,2,...,n}.

[0084] It is understandable that the pre-password module calls the password service platform to obtain the random number Ran and randomly selects Calculate R i =r i P, let h = H 2 (Ran||R i ), U=H 3 P 0 , calculate partial signature Calculate the random number signature V i =Sig(Ran,SK i ), sign the random number V i and the partial signature S i Sent to the password service platform.

[0085] Step S603, generating a multi-signature based on the partial signature, and verifying the multi-signature;

[0086] In a feasible implementation, step S603 may include: obtaining the partial signature and verifying the partial signature; after the partial signature is verified, calculating the multi-signature based on the partial signature; generating an aggregate public key based on the pre-public key; and verifying the multi-signature based on the aggregate public key, the original signature value, the pre-identifier, and the signature random value. S ).

[0087] It should be noted that the cryptographic service platform verifies the partial signatures S one by one. iAfter the verification signature is passed, the next step can be performed. Otherwise, the signature process is terminated. The secret service platform obtains all the previous partial signatures and calculates the multi-signature V = Multi_Sig (Ran, SK i ).

[0088] It is understandable that the cryptographic service platform calculates the aggregate public key Using the aggregated public key PK, the original signature value Ran, the set of signature random values ​​r, and the set of pre-identifiers Q S , verify the multi-signature, where The secret service platform calculates e(P,σ)=e(PK,U r )e(P 0 h,Q S ), if the equation passes, the verification is successful, otherwise the encryption process is terminated.

[0089] Step S604, after the multi-signature verification is passed, derive the data key;

[0090] It should be noted that after the multi-signature verification is passed, the cryptographic service platform derives the data key DEK based on the hash value of the bidding document and the system master key MK, DEK = KDF (Hash_SM3 (plaintext)).

[0091] Step S605, encrypting the data key based on the pre-public key to obtain a data key ciphertext;

[0092] It is understandable that the cryptographic service platform uses the pre-public key SK i Encrypted data key DEK, the encrypted data key DEK is the data key ciphertext C i (DEK)=Enc(DEK,PK i ){i=1,2,...,n}.

[0093] Step S606, sending the data key ciphertext to the pre-cipher module, so that the pre-cipher module decrypts the data key ciphertext based on the pre-private key to obtain the data key, and encrypts the target data based on the data key to obtain the encrypted target data.

[0094] It should be noted that the cryptographic service platform distributes the data key ciphertext to the pre-encryption module. The pre-encryption module uses the pre-private key to decrypt the data key ciphertext and obtain the data key DEK, DEK = Dec (C i (DEK),SK i ), and then use the data key to encrypt the target data to obtain the encrypted target data, that is, the encrypted target data ciphertext = Enc_SM4 (plaintext, DEK).

[0095] It should be understood that in this embodiment, the device fingerprint is used as a key factor to participate in the verification of multiple signatures. The front-end tool captures the device fingerprint and transmits it to the cryptographic service platform as a partial factor of the multi-signature key. The cryptographic service platform calls the cryptographic device to generate a front-end public key, splices it with the device fingerprint to perform hash calculation to generate an identifier, and then calculates the identifier with the platform master key to generate a front-end private key for multiple signatures. When calling the front-end cryptographic module to generate multiple signatures, it is necessary to calculate the device fingerprint and calculate the identifier with the front-end public key. After the cryptographic service platform obtains the identifier and signature value, it verifies the multiple signatures, thereby ensuring that the front-end cryptographic module can only run on the corresponding computing node.

[0096] This embodiment provides a data encryption method, which imports a pre-password module into a corresponding computing node; when the computing node initiates an encryption request for target data to the pre-password module, a random number is generated and sent to the pre-password module, so that the pre-password module signs the random number based on the pre-private key to obtain a partial signature; based on the partial signature, multiple signatures are generated, and the multiple signatures are verified; after the multiple signatures are verified, a data key is derived; the data key is encrypted based on the pre-public key to obtain a data key ciphertext; the data key ciphertext is sent to the pre-password module, so that the pre-password module decrypts the data key ciphertext based on the pre-private key to obtain the data key, and the target data is encrypted based on the data key to obtain the encrypted target data. By binding the device fingerprint with the multi-signature private key, the operating environment of the pre-password module is verified when verifying the signature, and the binding of the computing environment and the pre-password module is realized. For the encryption of massive data, the encryption capability can be expanded by increasing the number of pre-password computing nodes, thereby breaking through the limitation of the encryption performance of the cryptographic device.

[0097] For example, to help understand the implementation process of the data encryption method obtained by combining this embodiment with the above-mentioned embodiment 2, please refer to Figure 3 , Figure 3 A brief flowchart of a data encryption method is provided, specifically:

[0098] The overall architecture includes a cryptographic service platform and a pre-cryptographic module. Cryptographic service platform: It is composed of an authentication and authorization center and a key management center. The authentication and authorization center provides authentication information for the pre-cryptographic module, and the key management center generates and distributes key information for the pre-cryptographic module. Pre-cryptographic module: It contains pre-tools for extracting environmental feature values ​​of computing nodes, which can be imported into the obfuscated cryptographic module. The obfuscated cryptographic module can provide data encryption functions for users and is deployed in the general computing environment of the user's computing node.

[0099] Run the pre-installation tool to generate device fingerprint DF i; The front-end tool establishes an HTTPS secure transmission channel with the password service platform and uploads the device fingerprint DF i ; The password service platform obtains the device fingerprint DF i , call the cryptographic device to generate the pre-private key SK i And the previous public key PK i ; The cryptographic service platform derives the pre-obfuscated key CK i , using CK i Encrypted pre-private key SK i ; Password service platform uses device fingerprint DF i Encryption pre-obfuscation key CK i , after confusing the pre-confusion key ciphertext with the encryption algorithm, it is packaged together with the pre-private key ciphertext to generate the pre-cipher module S i ; The password service platform generates the pre-password module S i , imported into the corresponding computing node i offline; import the pre-cryptographic module S in the pre-tool i , using the device fingerprint DF calculated i , decrypt the pre-obfuscated key ciphertext. If the decryption is successful, the import is successful, otherwise the import fails.

[0100] For further reference, Figure 4 When encrypting, the computing node calls the pre-encryption module, initiates data encryption, and transmits the data in plaintext; the cryptographic service platform generates a random number R and sends it to each pre-encryption module; the pre-encryption module uses the pre-private key SK i Sign the random number R and obtain the partial signature S i ; The cryptographic service platform obtains partial signatures of all pre-cryptographic modules and verifies them. After verification, a multi-signature V is generated; after multi-signature verification, the data key DEK is derived; using the pre-private key SK i Encrypt DEK and distribute the data key ciphertext to the front-end module; the front-end cryptographic module uses the private key to decrypt the data key ciphertext and uses the data key to encrypt the target data; the front-end cryptographic module returns the data ciphertext ciphertext.

[0101] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the data encryption method of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0102] This application also provides a data encryption device, please refer to Figure 5 , the data encryption device includes a pre-cryptographic module 10 and a cryptographic service platform 20;

[0103] The cryptographic service platform 10 is used to obtain the device fingerprint generated by the front-end tool in the computing node, generate a front private key and a front public key, generate a front obfuscation key, encrypt the front private key based on the front obfuscation key to obtain a front private key ciphertext, encrypt the front obfuscation key based on the device fingerprint to obtain a front obfuscation key ciphertext, obfuscate the front private key ciphertext and the front obfuscation key ciphertext, generate a front cryptographic module, and import the front cryptographic module into the corresponding computing node;

[0104] The pre-cipher module 20 is used to encrypt the target data upon receiving an encryption request for the target data initiated by the computing node, obtain the encrypted target data, and send the encrypted target data to the computing node.

[0105] In a feasible implementation manner, the cryptographic service platform 10 is also used to randomly generate a pre-secret value;

[0106] Determine the pre-public key based on the pre-secret value and the generator;

[0107] Determine a pre-identification based on the pre-public key and the device fingerprint;

[0108] Determine a partial private key based on the preceding identifier and the system master key;

[0109] Based on the partial private key, the pre-private key is determined.

[0110] In a feasible implementation manner, the cryptographic service platform 10 is also used to randomly generate a system master key;

[0111] A key is derived based on the system master key and the device fingerprint to obtain the pre-obfuscation key.

[0112] In a feasible implementation manner, the cryptographic service platform 10 is further used to import the pre-cryptographic module into the corresponding computing node;

[0113] When the computing node initiates an encryption request for target data to the pre-cryptographic module, a random number is generated and sent to the pre-cryptographic module, so that the pre-cryptographic module signs the random number based on the pre-private key to obtain a partial signature;

[0114] Based on the partial signature, generate a multi-signature, and verify the multi-signature;

[0115] After the multi-signature verification is passed, deriving the data key;

[0116] Encrypting the data key based on the pre-public key to obtain a data key ciphertext;

[0117] The data key ciphertext is sent to the pre-cipher module, so that the pre-cipher module decrypts the data key ciphertext based on the pre-private key to obtain the data key, and encrypts the target data based on the data key to obtain the encrypted target data.

[0118] In a feasible implementation manner, the cryptographic service platform 10 is further used to obtain the partial signature and verify the partial signature;

[0119] After the partial signature is verified, a multi-signature is calculated based on the partial signature and the random number;

[0120] Based on the pre-public key, generate an aggregate public key;

[0121] The multiple signatures are verified based on the aggregated public key, the original signature value, the preceding identifier, and the signature random value.

[0122] The data encryption device provided by the present application adopts the data encryption method in the above embodiment, which can solve the technical problem of low efficiency when encrypting massive data. Compared with the prior art, the beneficial effects of the data encryption device provided by the present application are the same as the beneficial effects of the data encryption method provided by the above embodiment, and the other technical features in the data encryption device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0123] The present application provides a data encryption device, which includes: at least one processor; and a memory that is communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the data encryption method in the above-mentioned embodiment one.

[0124] Reference below Figure 6 , which shows a schematic diagram of the structure of a data encryption device suitable for implementing an embodiment of the present application. The data encryption device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 6 The data encryption device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0125] like Figure 6 As shown, the data encryption device may include a processing device 1001 (e.g., a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the data encryption device are also stored. The processing device 1001, ROM1002, and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the data encryption device to communicate with other devices wirelessly or by wire to exchange data. Although the data encryption device with various systems is shown in the figure, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or have alternatively.

[0126] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0127] The data encryption device provided by the present application adopts the data encryption method in the above embodiment, which can solve the technical problem of low efficiency when encrypting massive data. Compared with the prior art, the beneficial effects of the data encryption device provided by the present application are the same as the beneficial effects of the data encryption method provided by the above embodiment, and the other technical features in the data encryption device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0128] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0129] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0130] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, wherein the computer-readable program instructions are used to execute the data encryption method in the above-mentioned embodiment.

[0131] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0132] The computer-readable storage medium may be included in the data encryption device; or may exist independently without being assembled into the data encryption device.

[0133] The computer-readable storage medium carries one or more programs. When the one or more programs are executed by the data encryption device, the data encryption device: obtains the device fingerprint generated by the front-end tool in the computing node, and generates a front private key and a front public key; generates a front obfuscation key, encrypts the front private key based on the front obfuscation key, and obtains a front private key ciphertext; encrypts the front obfuscation key based on the device fingerprint to obtain a front obfuscation key ciphertext; obfuscates the front private key ciphertext and the front obfuscation key ciphertext to generate a front cryptographic module; imports the front cryptographic module into the corresponding computing node, so that the computing node calls the front cryptographic module to encrypt the target data.

[0134] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0135] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0136] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0137] The readable storage medium provided by the present application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned data encryption method, and can solve the technical problem of low efficiency when encrypting massive amounts of data. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the present application are the same as the beneficial effects of the data encryption method provided by the above-mentioned embodiment, and will not be described in detail here.

[0138] The present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned data encryption method when executed by a processor.

[0139] The computer program product provided by the present application can solve the technical problem of low efficiency when encrypting massive amounts of data. Compared with the prior art, the beneficial effects of the computer program product provided by the present application are the same as the beneficial effects of the data encryption method provided by the above embodiment, which will not be repeated here.

[0140] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A data encryption method, characterized in that: The method comprises: Obtain the device fingerprint generated by the pre-tool in the computing node, and generate the pre-private key and pre-public key; Generate a pre-obfuscation key, and encrypt the pre-private key based on the pre-obfuscation key to obtain a pre-private key ciphertext; Encrypting the pre-obfuscation key based on the device fingerprint to obtain a pre-obfuscation key ciphertext; Obfuscating the pre-private key ciphertext and the pre-obfuscating key ciphertext to generate a pre-cipher module; The pre-cipher module is imported into a corresponding computing node, so that the computing node calls the pre-cipher module to encrypt the target data.

2. The method according to claim 1, characterized in that The steps of generating a pre-private key and a pre-public key include: Randomly generate a pre-secret value; Determine the pre-public key based on the pre-secret value and the generator; Determine a pre-identification based on the pre-public key and the device fingerprint; Determine a partial private key based on the preceding identifier and the system master key; Based on the partial private key, the pre-private key is determined.

3. The method according to claim 1, characterized in that The step of generating a pre-obfuscation key comprises: Randomly generate system master key; A key is derived based on the system master key and the device fingerprint to obtain the pre-obfuscation key.

4. The method according to claim 1, characterized in that The step of importing the pre-cipher module into a corresponding computing node so that the computing node calls the pre-cipher module to encrypt the target data includes: Importing the pre-cryptographic module into the corresponding computing node; When the computing node initiates an encryption request for target data to the pre-cryptographic module, a random number is generated and sent to the pre-cryptographic module, so that the pre-cryptographic module signs the random number based on the pre-private key to obtain a partial signature; Based on the partial signature, generate a multi-signature, and verify the multi-signature; After the multi-signature verification is passed, deriving the data key; Encrypting the data key based on the pre-public key to obtain a data key ciphertext; The data key ciphertext is sent to the pre-cipher module, so that the pre-cipher module decrypts the data key ciphertext based on the pre-private key to obtain the data key, and encrypts the target data based on the data key to obtain the encrypted target data.

5. The method according to claim 4, characterized in that The method further comprises: When the pre-password module obtains the pre-obfuscation key corresponding to the pre-obfuscation key ciphertext based on the device fingerprint decryption, it is determined that the pre-password module is successfully imported, and when the computing node initiates an encryption request for target data to the pre-password module, a random number is generated and sent to the pre-password module; When the pre-cryptographic module fails to decrypt and obtain the pre-obfuscation key corresponding to the pre-obfuscation key ciphertext based on the device fingerprint, it is determined that the pre-cryptographic module fails to be imported, and the encryption process is stopped.

6. The method according to claim 4, characterized in that The step of generating a multi-signature based on the partial signature and verifying the multi-signature comprises: Obtaining the partial signature, and verifying the partial signature; After the partial signature is verified, a multi-signature is calculated based on the partial signature and the random number; Based on the pre-public key, generate an aggregate public key; The multiple signatures are verified based on the aggregated public key, the original signature value, the preceding identifier, and the signature random value.

7. A data encryption device, characterized in that: The device includes a pre-password module and a password service platform; The cryptographic service platform is used to obtain the device fingerprint generated by the front-end tool in the computing node, generate a front private key and a front public key, generate a front obfuscation key, encrypt the front private key based on the front obfuscation key to obtain a front private key ciphertext, encrypt the front obfuscation key based on the device fingerprint to obtain a front obfuscation key ciphertext, obfuscate the front private key ciphertext and the front obfuscation key ciphertext, generate a front cryptographic module, and import the front cryptographic module into the corresponding computing node; The pre-cipher module is used to encrypt the target data upon receiving an encryption request for the target data initiated by the computing node, obtain the encrypted target data, and send the encrypted target data to the computing node.

8. A data encryption device, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the data encryption method according to any one of claims 1 to 6.

9. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the data encryption method according to any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the data encryption method according to any one of claims 1 to 6 are implemented.

Images