Data encryption method and system

Abstract

The invention provides a data encryption method and system, and the method comprises the steps: dividing to-be-transmitted data into a plurality of data blocks, and carrying out the feature extraction of each data block, and obtaining a corresponding feature vector; encrypting the feature vector of each data block, encrypting the current data block based on the feature vector encryption result of the previous data block to obtain a first ciphertext of the current data block, and encrypting the current data block based on the feature vector encryption result of the next data block to obtain a second ciphertext of the current data block; and finally, combining the first ciphertext and the second ciphertext, and associating a ciphertext combination result with the current data block as an encryption result of the current data block. According to the invention, the to-be-transmitted data is encrypted and then transmitted, so that the confidentiality of the to-be-transmitted data can be effectively protected, and the risk of data leakage is reduced; meanwhile, by associating the encryption results, the integrity of the to-be-transmitted data can be effectively protected, and whether the to-be-transmitted data is tampered or not can be identified.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a data encryption method and system. Background Art

[0002] With the rapid development of information technology and the popularization of the Internet, more and more companies will store the electronic data generated by their operations on local servers. At the same time, most companies will remotely and wirelessly transmit the electronic data in local servers to other off-site servers for backup, so that when a data disaster occurs on the local server, data recovery or data migration can be carried out through the off-site server to ensure the normal operation of the company.

[0003] However, since electronic data stored on local servers often involves business operations, tampering or leakage of this data during backup, recovery, or migration can severely damage the company's economic benefits and privacy. Therefore, protecting data during backup, recovery, or migration is a pressing issue. Summary of the Invention

[0004] In view of the above-mentioned shortcomings of the prior art, the object of the present invention is to provide a data encryption method and system for solving the technical problem of data tampering or leakage during data backup, data recovery or data migration.

[0005] To achieve the above and other related purposes, the present invention provides a data encryption method, comprising the following steps:

[0006] Acquire data to be transmitted, and split the data to be transmitted into multiple data blocks;

[0007] Perform feature extraction on each data block to obtain the corresponding feature vector;

[0008] Encrypting the characteristic vector of each data block, and encrypting the current data block based on the encrypted result of the characteristic vector of the previous data block to obtain a first ciphertext of the current data block, and encrypting the current data block based on the encrypted result of the characteristic vector of the next data block to obtain a second ciphertext of the current data block;

[0009] The first ciphertext and the second ciphertext are combined, and the ciphertext combination result is associated with the current data block as the encryption result of the current data block.

[0010] Optionally, the process of splitting the data to be transmitted into multiple data blocks includes:

[0011] Splitting the data to be transmitted according to a preset rule to obtain a plurality of data fields; wherein the preset rule includes at least one of a data type, a data capacity, and a data purpose;

[0012] Sort all data fields and number all data fields based on the sorting results;

[0013] Encode according to the data length and number of each data field, and use the encoding result as the index of the corresponding data field;

[0014] Each data field is treated as valid data and merged with the corresponding index to form multiple data blocks.

[0015] Optionally, the process of encrypting the feature vector of each data block includes:

[0016] Encrypting the feature vector using a symmetric encryption algorithm to obtain a symmetric encryption result of the feature vector;

[0017] The symmetric encryption result of the feature vector is encrypted twice using an asymmetric encryption algorithm to obtain the encrypted result of the feature vector.

[0018] Optionally, the method further includes:

[0019] Store each encrypted data block in a local server;

[0020] Transmitting all encrypted data blocks from the local server to the remote server according to a pre-established communication link between the local server and the remote server; and

[0021] The transmission bit error rate of the communication link is calculated according to the number of bits with errors during the transmission process and the total number of bits of the communication link.

[0022] Optionally, the method further comprises: converting the encrypted data block into a data packet according to a transmission protocol of the communication link, and calculating a packet loss rate according to the number of data packets lost during data packet transmission and the total number of data packets; and

[0023] When the packet loss rate is greater than a preset value, a buffer zone for storing the data packets is established, and the data packets in the data buffer zone are transmitted in parallel through multiple threads.

[0024] Optionally, the symmetric encryption algorithm includes: at least one of an AES algorithm, an SM4 algorithm, and a Blowfish algorithm;

[0025] The asymmetric encryption algorithm includes at least one of an RSA algorithm, an ECC algorithm, and an ElGamal algorithm.

[0026] The present invention also provides a data encryption system, comprising:

[0027] A data acquisition module is used to obtain data to be transmitted and split the data to be transmitted into multiple data blocks;

[0028] Feature extraction module, used to extract features from each data block and obtain the corresponding feature vector;

[0029] A feature vector encryption module is used to encrypt the feature vector of each data block;

[0030] A data block encryption module is configured to encrypt a current data block based on a feature vector encryption result of a previous data block to obtain a first ciphertext of the current data block, and to encrypt the current data block based on a feature vector encryption result of a next data block to obtain a second ciphertext of the current data block; and to combine the first ciphertext and the second ciphertext, and associate the ciphertext combination result with the current data block as the encryption result of the current data block.

[0031] Optionally, the process of the data acquisition module splitting the data to be transmitted into multiple data blocks includes:

[0032] Splitting the data to be transmitted according to a preset rule to obtain a plurality of data fields; wherein the preset rule includes at least one of a data type, a data capacity, and a data purpose;

[0033] Sort all data fields and number all data fields based on the sorting results;

[0034] Encode according to the data length and number of each data field, and use the encoding result as the index of the corresponding data field;

[0035] Each data field is treated as valid data and merged with the corresponding index to form multiple data blocks.

[0036] Optionally, the process of encrypting the feature vector of each data block by the feature vector encryption module includes:

[0037] Encrypting the feature vector using a symmetric encryption algorithm to obtain a symmetric encryption result of the feature vector; wherein the symmetric encryption algorithm includes at least one of an AES algorithm, an SM4 algorithm, and a Blowfish algorithm;

[0038] The symmetric encryption result of the feature vector is secondary encrypted using an asymmetric encryption algorithm to obtain the encrypted result of the feature vector; wherein the asymmetric encryption algorithm includes at least one of an RSA algorithm, an ECC algorithm, and an ElGamal algorithm.

[0039] Optionally, the system further comprises:

[0040] Store each encrypted data block in a local server;

[0041] Transmitting all encrypted data blocks from the local server to the remote server according to a communication link pre-established between the local server and the remote server; and calculating a transmission bit error rate (BER) of the communication link based on the number of bits with errors during transmission and the total number of bits in the communication link;

[0042] And / or, converting the encrypted data blocks into data packets according to the transmission protocol of the communication link, and calculating the packet loss rate based on the number of data packets lost during data packet transmission and the total number of data packets; and when the packet loss rate is greater than a preset value, establishing a buffer for storing the data packets, and performing multi-threaded parallel transmission on the data packets in the data buffer.

[0043] As described above, the present invention provides a data encryption method and system, which has the following beneficial effects: during data backup, data recovery or data migration, the present invention can split the data to be transmitted into multiple data blocks, then extract features from each data block to obtain a corresponding feature vector; first encrypt the feature vector of each data block, then encrypt the current data block based on the feature vector encryption result of the previous data block to obtain a first ciphertext of the current data block, and then encrypt the current data block based on the feature vector encryption result of the next data block to obtain a second ciphertext of the current data block; finally, combine the first ciphertext and the second ciphertext, and associate the ciphertext combination result with the current data block as the encryption result of the current data block. It can be seen that the present invention, by splitting the data to be transmitted into data blocks and then transmitting them, can save data loss or transmission failure during the transmission process, only the lost data blocks or the remaining data blocks need to be retransmitted, without having to retransmit the successfully transmitted data packets, thereby saving the communication traffic used in the data backup, data recovery or data migration process, reducing the economic cost of enterprises in data backup, data recovery or data migration, and also speeding up data transmission efficiency and shortening data transmission time. At the same time, the present invention encrypts the characteristic vector of the data block and then encrypts the current data block based on the encrypted result of the characteristic vector of the adjacent data block. Even if the current data block is hijacked or stolen during the data backup, data recovery or data migration process, the corresponding organization or personnel cannot directly obtain the original data. Moreover, since the data to be transmitted is split into multiple data blocks, the amount of data that is hijacked or stolen is greatly reduced. In addition, by encrypting the current data block based on the encrypted result of the characteristic vector of the adjacent data block, the encrypted result of the characteristic vector of the adjacent data block can be used to verify the tampering of the current data block, quickly identify whether the current data block has been individually tampered with during the data backup, data recovery or data migration process, and protect the integrity of the data to be transmitted. Then, by combining the first ciphertext and the second ciphertext and associating them with the current data block as the encryption result of the current data block, an adjacent verification mechanism can be formed. Therefore, during the process of data backup, data recovery or data migration, the present invention can effectively protect the confidentiality of the data to be transmitted and reduce the risk of data leakage by encrypting the data to be transmitted. At the same time, when the data to be transmitted is encrypted, there is a dynamic association between the encryption results of the data blocks. By dynamically associating the encryption results, the integrity of the data to be transmitted can be effectively protected and it can be identified whether the data to be transmitted has been tampered with. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 A schematic diagram of a data encryption method according to an embodiment of the present invention;

[0045] Figure 2This is a schematic diagram of the hardware structure of a data encryption system provided in one embodiment of the present invention. DETAILED DESCRIPTION

[0046] The following describes the embodiments of the present invention through specific examples. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments. The details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the following embodiments and features in the embodiments can be combined with each other unless they conflict.

[0047] It should be noted that the illustrations provided in this embodiment are only used to schematically illustrate the basic concept of the present invention. Therefore, the illustrations only show components related to the present invention and are not drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component can be changed at will, and the component layout type may also be more complicated.

[0048] See also Figure 1 As shown, this embodiment provides a data encryption method, including the following steps:

[0049] S110, obtaining data to be transmitted and splitting the data to be transmitted into multiple data blocks;

[0050] S120, extracting features from each data block to obtain a corresponding feature vector;

[0051] S130, encrypting the feature vector of each data block, and encrypting the current data block based on the encrypted result of the feature vector of the previous data block to obtain a first ciphertext of the current data block, and encrypting the current data block based on the encrypted result of the feature vector of the next data block to obtain a second ciphertext of the current data block;

[0052] S140: Combine the first ciphertext and the second ciphertext, and associate the ciphertext combination result with the current data block as the encryption result of the current data block.

[0053] In an exemplary embodiment of the present invention, the process of splitting data to be transmitted into multiple data blocks includes: splitting the data to be transmitted according to preset rules to obtain multiple data fields; wherein the preset rules include at least one of data type, data capacity, and data usage; sorting all data fields and numbering all data fields based on the sorting results; encoding each data field according to the data length and number, and using the encoded result as the index of the corresponding data field; merging each data field as valid data with the corresponding index to form multiple data blocks. The sorting can be performed according to the logical order of the split data fields in the original data, and by numbering the sorted results, each data field can be uniquely identified. The numbering method can be implemented using ascending digital sequence numbers or hash value mapping to determine the order of the data fields in the original data. The specific sorting and numbering process is not detailed here, and reference is made to the relevant art. When encoding the data length and encoding, Base64 encoding or hexadecimal conversion can be used. The specific encoding process is not detailed here, and reference is made to the relevant art. As an example, for raw data containing financial records and customer information, the data can be split into financial data fields and customer data fields based on data type. Sequential numbers are assigned to all financial data fields and customer data fields, so that even if the order of the financial data fields and customer data fields is disrupted during transmission, the original arrangement can be restored using the numbers. Furthermore, the numbers and byte lengths can be combined using Base64 encoding to generate corresponding indexes. For example, a financial data field with a data field length of 1024 bytes and numbered 5 is encoded as an index identifier of NS0xMDI0. The financial data field with a data field length of 1024 bytes and numbered 5 is then combined with the index NS0xMDI0 to form the fifth data block. Therefore, by splitting the data to be transmitted into multiple data blocks, this method allows for the retransmission of only the lost or remaining data blocks in the event of data loss or transmission failure during transmission, eliminating the need to retransmit successfully transmitted data packets. This reduces the communication traffic used during data backup, data recovery, or data migration, lowering the economic costs for enterprises in data backup, data recovery, or data migration, while also increasing data transmission efficiency and shortening data transmission time. Furthermore, in the event of a data block being hijacked, cut, or tampered with, the scope of affected data is greatly reduced. Furthermore, by splitting the data to be transmitted into multiple data blocks, each data block contains both the original valid data and the order of the original data. This not only makes it easier for the receiver to quickly search for data blocks through indexes, verifying whether a data block is missing, and ensuring the integrity of the data after transmission, but also allows the data receiver to directly decrypt and recover the original data using the index information.

[0054] In an exemplary embodiment of the present invention, the process of encrypting the feature vector of each data block includes: encrypting the feature vector using a symmetric encryption algorithm to obtain a symmetric encryption result of the feature vector; and re-encrypting the symmetric encryption result of the feature vector using an asymmetric encryption algorithm to obtain an encrypted feature vector result. Specifically, when encrypting the feature vector of each data block, a symmetric encryption algorithm can be first used to perform an encryption operation on the feature vector to generate intermediate encrypted data. Symmetric algorithms have the advantage of fast processing speed, which can improve data transmission efficiency while ensuring basic security. The symmetric encryption result is then used as input data and re-encrypted using an asymmetric encryption algorithm to produce the final encrypted feature vector result. This phased encryption method requires an attacker to simultaneously crack both encryption algorithms to obtain the original data. The symmetric encryption key itself is protected by the asymmetric algorithm, effectively preventing the possibility of a single encryption method being breached, thereby rendering the entire protection system ineffective. Symmetric encryption algorithms include, but are not limited to, AES, SM4, and Blowfish; asymmetric encryption algorithms include, but are not limited to, RSA, ECC, and ElGamal. As an example, in a financial data transmission scenario, the SM4 algorithm can be used for national secret compliance encryption, and then the ECC algorithm can be used for secondary encryption to reduce key storage space. As another example, in an IoT data transmission scenario, the Blowfish algorithm can be selected for dynamic key encryption, and then combined with the ElGamal algorithm to implement discrete logarithm encryption to enhance security. Therefore, this method effectively prevents data leakage caused by cracking of a single encryption method through double encryption protection of the feature vector; and the combination of symmetric encryption and asymmetric encryption not only ensures data processing efficiency, but also improves data security through the key separation mechanism. In addition, the hierarchical application of the two encryption algorithms requires attackers to break through both encryption systems at the same time to obtain valid information, significantly increasing the difficulty of data cracking.

[0055] In an exemplary embodiment of the present invention, the data encryption method may further include: storing each encrypted data block in a local server; transmitting all encrypted data blocks from the local server to the remote server according to a pre-established communication link between the local server and the remote server; and calculating the transmission bit error rate (BER) of the communication link based on the number of bits with errors during transmission and the total number of bits in the communication link. The pre-established communication link may be a communication link established using the TCP / IP protocol, and the local server and the remote server are located in different geographical locations, for example, the distance between the local server and the remote server is 30 kilometers, 50 kilometers, 70 kilometers, 200 kilometers, 500 kilometers, etc. Therefore, by calculating the transmission bit error rate of the communication link, the method can effectively solve the problem of data corruption caused by unstable communication links when transmitting encrypted data blocks remotely, thereby achieving a quantitative assessment of transmission quality while ensuring the security of the transmission path, and providing a decision-making basis for data error correction, link switching, and link optimization.

[0056] In an exemplary embodiment of the present invention, the data encryption method may further include: converting encrypted data blocks into data packets according to the transmission protocol of the communication link, and calculating a packet loss rate based on the number of data packets lost and the total number of data packets during data packet transmission; and, when the packet loss rate exceeds a preset value, establishing a buffer for storing data packets and performing multi-threaded parallel transmission of the data packets in the data buffer. Specifically, during the transmission process, the packet loss rate of the current communication link is dynamically calculated by counting the ratio of the number of lost data packets to the total number of data packets sent in real time. When the packet loss rate exceeds a preset threshold, indicating that the network status of the communication link is unstable at the current moment, the data packets to be transmitted can be temporarily stored in the buffer to avoid the increased risk of data loss due to continuous transmission. Simultaneously, the data packets stored in the buffer can be sent to the receiving end by creating multiple parallel transmission threads, thereby utilizing a multi-path transmission mechanism to distribute network congestion pressure and maintain overall transmission efficiency when link quality fluctuates. The number of data packets lost refers to the number of data packets that were not successfully received by the receiving end during the transmission process, and can be counted based on confirmation information fed back by the receiving end server. A buffer refers to a memory area that temporarily stores data packets. It can be formed based on a circular queue or a linked list structure and is used to temporarily store data packets when the network is unstable to avoid data packet loss. Multi-threaded parallel transmission refers to starting multiple independent data transmission channels at the same time, such as through thread pool technology or asynchronous IO mechanism to achieve multi-threaded parallel transmission, thereby improving data transmission efficiency and reducing the impact of single channel failure on overall transmission. Therefore, this method can automatically switch to buffer temporary mode when the network transmission quality deteriorates, preventing data packets from being continuously lost in unreliable links, and at the same time improve link utilization through multi-threaded concurrent transmission, significantly improving the data transmission success rate while ensuring data integrity.

[0057] According to the above description, after receiving the encrypted data block sent by the sending server, the receiving server can decrypt it in the reverse order of the above method. The specific decryption process is not detailed here. When performing data backup, the receiving server can be a remote server and the sending server can be a local server. When performing data recovery or data migration, the receiving server can be a local server and the sending server can be a remote server.

[0058] In summary, the present invention provides a data encryption method. During data backup, data recovery, or data migration, the method can split the data to be transmitted into multiple data blocks, then extract features from each data block to obtain a corresponding feature vector; first encrypt the feature vector of each data block, then encrypt the current data block based on the feature vector encryption result of the previous data block to obtain a first ciphertext of the current data block, and then encrypt the current data block based on the feature vector encryption result of the next data block to obtain a second ciphertext of the current data block; finally, the first ciphertext and the second ciphertext are combined, and the ciphertext combination result is associated with the current data block as the encryption result of the current data block. It can be seen that the method, by splitting the data to be transmitted into data blocks and then transmitting them, can save data loss or transmission failure during the transmission process. Only the lost data blocks or the remaining data blocks need to be retransmitted, and there is no need to retransmit the successfully transmitted data packets, thereby saving the communication traffic used in the data backup, data recovery, or data migration process, reducing the economic cost of enterprises in data backup, data recovery, or data migration, and also speeding up data transmission efficiency and shortening data transmission time. At the same time, this method encrypts the characteristic vector of the data block and then encrypts the current data block based on the encrypted result of the characteristic vector of the adjacent data block. Even if the current data block is hijacked or stolen during the data backup, data recovery or data migration process, the corresponding organization or personnel cannot directly obtain the original data. Moreover, since the data to be transmitted is split into multiple data blocks, the amount of data that is hijacked or stolen is greatly reduced. In addition, by encrypting the current data block based on the encrypted result of the characteristic vector of the adjacent data block, the encrypted result of the characteristic vector of the adjacent data block can be used to verify the tampering of the current data block, quickly identify whether the current data block has been individually tampered with during the data backup, data recovery or data migration process, and protect the integrity of the data to be transmitted. Then, by combining the first ciphertext and the second ciphertext and associating them with the current data block as the encryption result of the current data block, an adjacent verification mechanism can be formed. Therefore, during the process of data backup, data recovery or data migration, this method can effectively protect the confidentiality of the data to be transmitted and reduce the risk of data leakage by encrypting the data to be transmitted. At the same time, when the data to be transmitted is encrypted, there is a dynamic association between the encryption results of the data blocks. By dynamically associating the encryption results, the integrity of the data to be transmitted can be effectively protected and it can be identified whether the data to be transmitted has been tampered with.

[0059] In another exemplary embodiment of the present invention, Figure 2 As shown, this embodiment provides a data encryption system, including:

[0060] The data acquisition module 210 is used to obtain the data to be transmitted and split the data to be transmitted into multiple data blocks;

[0061] Feature extraction module 220, used to extract features from each data block to obtain a corresponding feature vector;

[0062] A feature vector encryption module 230 is used to encrypt the feature vector of each data block;

[0063] The data block encryption module 240 is used to encrypt the current data block based on the feature vector encryption result of the previous data block to obtain the first ciphertext of the current data block, and to encrypt the current data block based on the feature vector encryption result of the next data block to obtain the second ciphertext of the current data block; and to combine the first ciphertext and the second ciphertext, and associate the ciphertext combination result with the current data block as the encryption result of the current data block.

[0064] In an exemplary embodiment of the present invention, the process by which the data acquisition module 210 splits the data to be transmitted into multiple data blocks includes: splitting the data to be transmitted according to preset rules to obtain multiple data fields; wherein the preset rules include at least one of data type, data capacity, and data usage; sorting all data fields and numbering all data fields based on the sorting results; encoding each data field according to its data length and number, and using the encoded result as an index for the corresponding data field; and merging each data field as valid data with the corresponding index to form multiple data blocks. The sorting can be performed according to the logical order of the split data fields in the original data, and by numbering the sorted results, each data field can be uniquely identified. The numbering method can be implemented using ascending digital sequence numbers or hash value mapping to determine the order of the data fields in the original data. The specific sorting and numbering processes are not described in detail here, and reference is made to the relevant art. When encoding the data length and encoding, Base64 encoding or hexadecimal conversion can be used. The specific encoding process is not described in detail here, and reference is made to the relevant art. As an example, for raw data containing financial records and customer information, the data can be split into financial data fields and customer data fields based on data type. Sequential numbers are assigned to all financial data fields and customer data fields, ensuring that even if the order of the financial data fields and customer data fields becomes disordered during transmission, the original arrangement can be restored using the numbers. Furthermore, the numbers and byte lengths can be combined using Base64 encoding to generate corresponding indexes. For example, a financial data field with a data field length of 1024 bytes and numbered 5 is encoded as the index identifier NS0xMDI0. The financial data field with a data field length of 1024 bytes and numbered 5 is then combined with the index NS0xMDI0 to form the fifth data block. Therefore, by splitting the data to be transmitted into multiple data blocks, the system only needs to retransmit the lost or remaining data blocks in the event of data loss or transmission failure during transmission, eliminating the need to retransmit successfully transmitted data packets. This reduces communication traffic used during data backup, data recovery, or data migration, lowering the economic costs for enterprises in data backup, data recovery, or data migration, while also improving data transmission efficiency and shortening data transmission time. Furthermore, in the event of a data block being hijacked, cut, or tampered with, the scope of affected data is greatly reduced. Furthermore, by splitting the data to be transmitted into multiple data blocks, each data block contains both the original valid data and the order of the original data. This not only makes it easier for the receiver to quickly search for data blocks through indexes, verifying whether a data block is missing, and ensuring the integrity of the data after transmission, but also allows the data receiver to directly decrypt and recover the original data using the index information.

[0065] In an exemplary embodiment of the present invention, the feature vector encryption module 230 encrypts the feature vector of each data block by: encrypting the feature vector using a symmetric encryption algorithm to obtain a symmetric encryption result of the feature vector; and performing a secondary encryption on the symmetric encryption result of the feature vector using an asymmetric encryption algorithm to obtain an encrypted feature vector result. Specifically, when encrypting the feature vector of each data block, a symmetric encryption algorithm can first be used to perform an encryption operation on the feature vector to generate intermediate encrypted data. Symmetric algorithms have the advantage of fast processing speed, which can improve data transmission efficiency while ensuring basic security. The symmetric encryption result is then used as input data and subjected to secondary encryption processing using an asymmetric encryption algorithm to produce the final encrypted feature vector result. This phased encryption method requires an attacker to simultaneously crack both encryption algorithms to obtain the original data. Since the symmetric encryption key itself is protected by the asymmetric algorithm, this effectively prevents the possibility of a single encryption method being breached, thereby rendering the entire protection system ineffective. Symmetric encryption algorithms include, but are not limited to, AES, SM4, and Blowfish; asymmetric encryption algorithms include, but are not limited to, RSA, ECC, and ElGamal. As an example, in a financial data transmission scenario, the SM4 algorithm can be used for national secret compliance encryption, and then the ECC algorithm can be used for secondary encryption to reduce key storage space. As another example, in an IoT data transmission scenario, the Blowfish algorithm can be selected for dynamic key encryption, and then combined with the ElGamal algorithm to implement discrete logarithm encryption to enhance security. Therefore, this system effectively prevents data leakage caused by the cracking of a single encryption method through double encryption protection of feature vectors; and the combination of symmetric encryption and asymmetric encryption not only ensures data processing efficiency, but also improves data security through a key separation mechanism. In addition, the hierarchical application of the two encryption algorithms requires attackers to break through both encryption systems at the same time to obtain valid information, significantly increasing the difficulty of data cracking.

[0066] In an exemplary embodiment of the present invention, the data encryption system may further include: storing each encrypted data block on a local server; transmitting all encrypted data blocks from the local server to the remote server according to a pre-established communication link between the local server and the remote server; and calculating the transmission bit error rate (BER) of the communication link based on the number of bits with errors during transmission and the total number of bits in the communication link. The pre-established communication link may be a communication link established using the TCP / IP protocol, and the local server and the remote server may be located in different geographical locations, for example, the distance between the local server and the remote server may be 30 kilometers, 50 kilometers, 70 kilometers, 200 kilometers, 500 kilometers, etc. Therefore, by calculating the BER of the communication link, the system can effectively address data corruption caused by unstable communication links during remote transmission of encrypted data blocks, thereby achieving a quantitative assessment of transmission quality while ensuring the security of the transmission path, providing a decision-making basis for data error correction, link switching, and link optimization.

[0067] In an exemplary embodiment of the present invention, the data encryption system may further include: converting encrypted data blocks into data packets according to the transmission protocol of the communication link, and calculating a packet loss rate based on the number of data packets lost and the total number of data packets during data packet transmission; and, when the packet loss rate exceeds a preset value, establishing a buffer for storing data packets and performing multi-threaded parallel transmission of the data packets in the data buffer. Specifically, during transmission, the packet loss rate of the current communication link is dynamically calculated by counting the ratio of the number of lost data packets to the total number of data packets sent in real time. When the packet loss rate exceeds a preset threshold, indicating that the network status of the communication link is unstable at the current moment, the data packets to be transmitted can be temporarily stored in the buffer to avoid the increased risk of data loss due to continuous transmission. Furthermore, the data packets stored in the buffer can be sent to the receiving end by creating multiple parallel transmission threads, thereby utilizing a multi-path transmission mechanism to distribute network congestion pressure and maintain overall transmission efficiency when link quality fluctuates. The number of lost data packets refers to the number of data packets that were not successfully received by the receiving end during transmission, and can be counted based on confirmation information fed back by the receiving end server. A buffer refers to a memory area that temporarily stores data packets. It can be formed based on a circular queue or linked list structure and is used to temporarily store data packets when the network is unstable to avoid data packet loss. Multi-threaded parallel transmission refers to the simultaneous startup of multiple independent data transmission channels. For example, multi-threaded parallel transmission is achieved through thread pool technology or asynchronous IO mechanism, thereby improving data transmission efficiency and reducing the impact of single-channel failures on overall transmission. Therefore, this system can automatically switch to buffering temporary mode when the network transmission quality deteriorates, preventing the continuous loss of data packets in unreliable links. At the same time, it can improve link utilization through multi-threaded concurrent transmission, significantly improving the data transmission success rate while ensuring data integrity.

[0068] According to the above description, after receiving the encrypted data block sent by the sending server, the receiving server can decrypt it in the reverse order of the above method. The specific decryption process is not detailed here. When performing data backup, the receiving server can be a remote server and the sending server can be a local server. When performing data recovery or data migration, the receiving server can be a local server and the sending server can be a remote server.

[0069] In summary, the present invention provides a data encryption system. During data backup, data recovery, or data migration, the system can split the data to be transmitted into multiple data blocks, then extract features from each data block to obtain a corresponding feature vector; first encrypt the feature vector of each data block, then encrypt the current data block based on the feature vector encryption result of the previous data block to obtain a first ciphertext of the current data block, and then encrypt the current data block based on the feature vector encryption result of the next data block to obtain a second ciphertext of the current data block; finally, the first ciphertext and the second ciphertext are combined, and the ciphertext combination result is associated with the current data block as the encryption result of the current data block. It can be seen that by splitting the data to be transmitted into data blocks and then transmitting them, when data loss or transmission failure occurs during the transmission process, only the lost data blocks or the remaining data blocks need to be retransmitted, and there is no need to retransmit the successfully transmitted data packets, thereby saving the communication traffic used in the data backup, data recovery, or data migration process, reducing the economic cost of enterprises in data backup, data recovery, or data migration, and also speeding up data transmission efficiency and shortening data transmission time. At the same time, this system encrypts the characteristic vector of a data block and then encrypts the current data block based on the encrypted characteristic vectors of adjacent data blocks. Even if the current data block is hijacked or stolen during data backup, data recovery, or data migration, the corresponding organization or individual cannot directly access the original data. Furthermore, since the data to be transmitted is split into multiple data blocks, the amount of data that can be hijacked or stolen is greatly reduced. Furthermore, by encrypting the current data block based on the encrypted characteristic vectors of adjacent data blocks, the encrypted characteristic vectors of adjacent data blocks can be used to verify tampering of the current data block, quickly identifying whether the current data block has been individually tampered with during data backup, data recovery, or data migration, thereby protecting the integrity of the data to be transmitted. By combining the first and second ciphertexts and associating them with the current data block as the encryption result of the current data block, a neighbor verification mechanism can be formed. Therefore, during the process of data backup, data recovery or data migration, this system can effectively protect the confidentiality of the data to be transmitted and reduce the risk of data leakage by encrypting the data to be transmitted before transmission; at the same time, when the data to be transmitted is encrypted, there is a dynamic association between the encryption results between the data blocks. By dynamically associating the encryption results, the integrity of the data to be transmitted can be effectively protected and it can be identified whether the data to be transmitted has been tampered with.

[0070] It should be noted that the data encryption system provided in the above embodiment and the data encryption method provided in the above embodiment are based on the same concept. The specific manner in which the various modules and units perform their operations has been described in detail in the method embodiments and will not be repeated here. In actual applications, the data encryption system provided in the above embodiment can, as needed, distribute the aforementioned functions among different functional modules, i.e., divide the system's internal structure into different functional modules to perform all or part of the functions described above, without limitation. Therefore, the present invention effectively overcomes the various shortcomings of the prior art and has high industrial application value.

[0071] The above embodiments are merely illustrative of the principles and effects of the present invention and are not intended to limit the present invention. Anyone skilled in the art may modify or alter the above embodiments without departing from the spirit and scope of the present invention. Therefore, all equivalent modifications or alterations made by one of ordinary skill in the art without departing from the spirit and technical principles disclosed herein are intended to be covered by the claims of the present invention.

[0072] It should be understood that although the terms "first," "second," and so on may be used to describe ciphertexts in embodiments of the present invention, these ciphertexts should not be limited to these terms. These terms are merely used to distinguish one ciphertext from another. For example, a first ciphertext may also be referred to as a second ciphertext, and similarly, a second ciphertext may also be referred to as a first ciphertext without departing from the scope of embodiments of the present invention.

Claims

1. A data encryption method, characterized in that: The method comprises the following steps: Acquire data to be transmitted, and split the data to be transmitted into multiple data blocks; Perform feature extraction on each data block to obtain the corresponding feature vector; Encrypting the characteristic vector of each data block, and encrypting the current data block based on the encrypted result of the characteristic vector of the previous data block to obtain a first ciphertext of the current data block, and encrypting the current data block based on the encrypted result of the characteristic vector of the next data block to obtain a second ciphertext of the current data block; The first ciphertext and the second ciphertext are combined, and the ciphertext combination result is associated with the current data block as the encryption result of the current data block.

2. The data encryption method according to claim 1, wherein: The process of splitting the data to be transmitted into multiple data blocks includes: Splitting the data to be transmitted according to a preset rule to obtain a plurality of data fields; wherein the preset rule includes at least one of a data type, a data capacity, and a data purpose; Sort all data fields and number all data fields based on the sorting results; Encode according to the data length and number of each data field, and use the encoding result as the index of the corresponding data field; Each data field is treated as valid data and merged with the corresponding index to form multiple data blocks.

3. The data encryption method according to claim 1, wherein: The process of encrypting the feature vector of each data block includes: Encrypting the feature vector using a symmetric encryption algorithm to obtain a symmetric encryption result of the feature vector; The symmetric encryption result of the feature vector is encrypted twice using an asymmetric encryption algorithm to obtain the encrypted result of the feature vector.

4. The data encryption method according to any one of claims 1 to 3, characterized in that: The method further comprises: Store each encrypted data block in a local server; Transmitting all encrypted data blocks from the local server to the remote server according to a pre-established communication link between the local server and the remote server; and The transmission bit error rate of the communication link is calculated according to the number of bits with errors during the transmission process and the total number of bits of the communication link.

5. The data encryption method according to claim 4, characterized in that: The method further includes: converting the encrypted data blocks into data packets according to the transmission protocol of the communication link, and calculating a packet loss rate based on the number of data packets lost during data packet transmission and the total number of data packets; and When the packet loss rate is greater than a preset value, a buffer for storing the data packets is established, and the data packets in the data buffer are transmitted in parallel through multiple threads.

6. The data encryption method according to claim 3, wherein: The symmetric encryption algorithm includes: at least one of the AES algorithm, the SM4 algorithm and the Blowfish algorithm; The asymmetric encryption algorithm includes at least one of an RSA algorithm, an ECC algorithm, and an ElGamal algorithm.

7. A data encryption system, characterized in that: The system includes: A data acquisition module is used to obtain data to be transmitted and split the data to be transmitted into multiple data blocks; Feature extraction module, used to extract features from each data block and obtain the corresponding feature vector; A feature vector encryption module is used to encrypt the feature vector of each data block; a data block encryption module, configured to encrypt a current data block based on a feature vector encryption result of a previous data block to obtain a first ciphertext of the current data block, and to encrypt the current data block based on a feature vector encryption result of a next data block to obtain a second ciphertext of the current data block; Furthermore, the first ciphertext and the second ciphertext are combined, and the ciphertext combination result is associated with the current data block as the encryption result of the current data block.

8. The data encryption system according to claim 7, wherein: The process of the data acquisition module splitting the data to be transmitted into multiple data blocks includes: Splitting the data to be transmitted according to a preset rule to obtain a plurality of data fields; wherein the preset rule includes at least one of a data type, a data capacity, and a data purpose; Sort all data fields and number all data fields based on the sorting results; Encode according to the data length and number of each data field, and use the encoding result as the index of the corresponding data field; Each data field is treated as valid data and merged with the corresponding index to form multiple data blocks.

9. The data encryption system according to claim 7, wherein: The process of encrypting the feature vector of each data block by the feature vector encryption module includes: Encrypting the feature vector using a symmetric encryption algorithm to obtain a symmetric encryption result of the feature vector; wherein the symmetric encryption algorithm includes at least one of an AES algorithm, an SM4 algorithm, and a Blowfish algorithm; The symmetric encryption result of the feature vector is secondary encrypted using an asymmetric encryption algorithm to obtain the encrypted result of the feature vector; wherein the asymmetric encryption algorithm includes at least one of an RSA algorithm, an ECC algorithm, and an ElGamal algorithm.

10. The data encryption system according to any one of claims 7 to 9, characterized in that: The system further comprises: Store each encrypted data block in a local server; Transmitting all encrypted data blocks from the local server to the remote server according to a communication link pre-established between the local server and the remote server; and calculating a transmission bit error rate (BER) of the communication link based on the number of bits with errors during transmission and the total number of bits in the communication link; And / or, converting the encrypted data blocks into data packets according to the transmission protocol of the communication link, and calculating the packet loss rate based on the number of data packets lost during data packet transmission and the total number of data packets; and when the packet loss rate is greater than a preset value, establishing a buffer for storing the data packets, and performing multi-threaded parallel transmission on the data packets in the data buffer.

Images