An encryption method, apparatus, device, storage medium, and computer program product

Abstract

The application discloses a kind of encryption method, device, equipment, storage medium and computer program product, applied to data encryption technical field, comprising: based on the data amount when encryption equipment encrypts, security requirement and encryption sequence determine application scene;Based on the decryption of decryption equipment determines compatibility performance;Wherein, compatibility performance is the decryption type supported by the decryption equipment;Based on application scene and compatibility performance, construct password algorithm combination set, and the password algorithm combination set is as input, the target performance of the preset encryption equipment is as target, to determine optimal password algorithm combination in password algorithm combination set, to encrypt the data to be encrypted based on optimal password algorithm combination.Compared with the current direct encryption based on any password algorithm, the performance target of the encryption equipment will be taken as the target based on application scene and compatibility performance, to determine optimal password algorithm combination, so as to improve the calculation performance and security of password algorithm.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data encryption, in particular to an encryption method, device, equipment, storage medium and computer program product. BACKGROUND

[0002] In the encryption and decryption system, the controller is connected to the data flow control module, and the to-be-operated data is transmitted to the data flow control module; the data flow control module sends the to-be-operated data to the algorithm engine core module in groups, the algorithm engine core module internally integrates the AES cipher algorithm engine and the SM4 cipher algorithm engine which can independently complete their own algorithm operation, the algorithm engine core module performs encryption and decryption operation by using the to-be-operated data provided by the data flow control module and the key and initial vector required for encryption and decryption operation configured in the register heap module, and feeds back the operation result to the data flow control module; the data flow control module outputs the operation result data through the controller, and realizes the encryption and decryption processing based on the AES algorithm and the SM4 algorithm, but when the AES algorithm and the SM4 algorithm are used for encryption and decryption, the performance of the encryption and decryption cannot be ensured to reach the preset target.

[0003] It can be seen that although the encryption can be realized at present, the encryption performance is low, and how to improve the encryption performance is a technical problem urgently to be solved by the person skilled in the art. SUMMARY

[0004] Therefore, the purpose of the present application is to provide an encryption method, device, equipment, storage medium and computer program product, which solves the technical problem of low encryption performance in the prior art.

[0005] To solve the above technical problems, the present application provides an encryption method, comprising:

[0006] determining an application scenario based on the data amount, the security requirement and the encryption order when the encryption device encrypts;

[0007] determining a compatible performance based on the decryption of the decryption device; wherein the compatible performance is a decryption type supported by the decryption device;

[0008] constructing a cipher algorithm combination set based on the application scenario and the compatible performance, taking the cipher algorithm combination set as input, taking a target performance of a preset encryption device as target, determining an optimal cipher algorithm combination in the cipher algorithm combination set, and encrypting to-be-encrypted data based on the optimal cipher algorithm combination.

[0009] On the one hand, the application scenario is determined based on the data amount, the security requirement and the encryption order when the encryption device encrypts, comprising:

[0010] determining the type of the cipher algorithm based on the data amount and the security requirement;

[0011] determining a sequence limit between the cryptographic algorithms based on the encryption sequence;

[0012] determining the application scenario based on the category of the cryptographic algorithms and the sequence limit.

[0013] In an aspect, the category of the cryptographic algorithms and / or the execution sequence of the cryptographic algorithms of different cryptographic algorithm combinations in the cryptographic algorithm combination set are different; the execution sequence of the cryptographic algorithms includes parallel execution and serial execution according to the priority of each cryptographic algorithm.

[0014] In an aspect, based on the application scenario and the compatibility performance, a cryptographic algorithm combination set is constructed, and the cryptographic algorithm combination set is taken as input, and the target performance of a preset encryption device is taken as target, and an optimal cryptographic algorithm combination is determined in the cryptographic algorithm combination set, including:

[0015] encoding the cryptographic algorithm combinations in the cryptographic algorithm combination set into individuals to form an initial population containing the same number of individuals as the number of the cryptographic algorithm combinations; wherein each individual represents a cryptographic algorithm combination;

[0016] determining an individual fitness value of each cryptographic algorithm combination; wherein the individual fitness value represents the degree to which the cryptographic algorithm combination meets the target performance of the preset encryption device;

[0017] based on the individual fitness values, using a selection operator to select, from the current initial population, an individual whose individual fitness value is higher than a set individual fitness value as a parent individual;

[0018] after performing a crossover operator operation on the parent individual according to a preset crossover probability, performing a mutation operator operation to obtain a child individual set;

[0019] based on the child individual set, replacing an individual with a low individual fitness value in the current initial population to form a new generation population; wherein the low individual fitness value is a value lower than the set individual fitness value;

[0020] repeating the steps of calculating the individual fitness value until a new generation population is formed, and decoding an individual with the highest individual fitness value in the final population to obtain an optimal cryptographic algorithm combination that meets the target performance of the preset encryption device.

[0021] In an aspect, determining an individual fitness value of each cryptographic algorithm combination includes:

[0022] decoding each individual in the current initial population into a corresponding decoded cryptographic algorithm combination;

[0023] Running the decoding password algorithm combination on the encryption device to obtain running result data;

[0024] Calculating the individual fitness value of the current decoding password algorithm based on the running result data and the target performance of the preset encryption device.

[0025] On the one hand, after constructing the password algorithm combination set based on the application scenario and the compatible performance, and taking the target performance of the preset encryption device as the target, and determining the optimal password algorithm combination in the password algorithm combination set, the method further comprises:

[0026] Encrypting the to-be-encrypted data based on the optimal password algorithm combination to obtain the master key corresponding to each password algorithm in the optimal password algorithm combination, and generating a backup key corresponding to each master key;

[0027] Storing the master key and the backup key in a disordered manner.

[0028] On the one hand, storing the master key and the backup key in a disordered manner comprises:

[0029] Storing the master key and the backup key in a disordered manner, and assigning an identity to each of the master key and the backup key, so that the decryption device obtains the key based on the identity for calculation.

[0030] On the one hand, constructing the password algorithm combination set based on the application scenario and the compatible performance comprises:

[0031] Obtaining an actual security posture result through real-time security posture dynamic perception;

[0032] Constructing the password algorithm combination set based on the application scenario, the compatible performance, and the actual security posture result.

[0033] On the one hand, constructing the password algorithm combination set based on the application scenario, the compatible performance, and the actual security posture result comprises:

[0034] When the security requirement in the application scenario is consistent with the actual security posture result, or the security requirement is higher than the actual security posture result, directly constructing the password algorithm combination set based on the application scenario and the compatible performance;

[0035] When the security requirement in the application scenario is lower than the actual security posture result, constructing the password algorithm combination set based on the encryption order in the application scenario, the compatible performance, and the actual security posture result.

[0036] In an aspect, the application is applied to a baseboard management controller.

[0037] In an aspect, the combination of cryptographic algorithms includes one or more of a symmetric cryptographic algorithm, an asymmetric cryptographic algorithm, a hash cryptographic algorithm, and a post-quantum cryptographic algorithm.

[0038] The embodiment of the application further provides an encryption device, comprising:

[0039] An application scenario determination module is configured to determine an application scenario based on a data volume, security requirements, and an encryption sequence when the encryption device is encrypting.

[0040] A compatibility performance determination module is configured to determine a compatibility performance based on a decryption condition of a decryption device, wherein the compatibility performance is a decryption type supported by the decryption device.

[0041] An encryption algorithm determination module is configured to construct a combination set of cryptographic algorithms based on the application scenario and the compatibility performance, take the combination set of cryptographic algorithms as input, take a target performance of a preset encryption device as a target, determine an optimal combination of cryptographic algorithms in the combination set of cryptographic algorithms, and encrypt to-be-encrypted data based on the optimal combination of cryptographic algorithms.

[0042] The embodiment of the application further provides an encryption device, comprising:

[0043] A memory is configured to store a computer program.

[0044] A processor is configured to execute the computer program to implement steps of the encryption method.

[0045] The embodiment of the application further provides a storage medium (i.e., a computer readable storage medium), which stores a computer program, and the computer program is executed by a processor to implement steps of the encryption method.

[0046] The embodiment of the application further provides a computer program product, which comprises a computer program / instruction, and the computer program / instruction is executed by a processor to implement steps of the encryption method.

[0047] To solve the above technical problem, the embodiment of the application provides an encryption method, which can comprise: determining an application scenario based on a data volume, security requirements, and an encryption sequence when an encryption device is encrypting; determining a compatibility performance based on a decryption condition of a decryption device, wherein the compatibility performance is a decryption type supported by the decryption device; constructing a combination set of cryptographic algorithms based on the application scenario and the compatibility performance, taking the combination set of cryptographic algorithms as input, taking a target performance of a preset encryption device as a target, determining an optimal combination of cryptographic algorithms in the combination set of cryptographic algorithms, and encrypting to-be-encrypted data based on the optimal combination of cryptographic algorithms.

[0048] From the above technical solutions, the beneficial effects of the present application are that, compared with directly encrypting based on a random cryptographic algorithm in the current multi-encryption algorithm scene, the present application determines the optimal cryptographic algorithm combination by taking the performance target of the encryption device as the target based on the application scene and compatibility performance when determining the cryptographic algorithm, thereby improving the calculation performance of the cryptographic algorithm, and since the security requirements are considered in the application scene, the security can be ensured. BRIEF DESCRIPTION OF DRAWINGS

[0049] In order to more clearly illustrate the embodiments of the present application, the drawings needed in the embodiments will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0050] Figure 1 A flowchart of an encryption method provided for the embodiments of the present application is shown in the figure.

[0051] Figure 2 A flowchart of an encryption method provided for the embodiments of the present application is shown in the figure.

[0052] Figure 3 A schematic diagram of a cryptographic algorithm accelerator provided for the embodiments of the present application is shown in the figure.

[0053] Figure 4 A calculation flowchart of a cryptographic algorithm accelerator provided for the embodiments of the present application is shown in the figure.

[0054] Figure 5 A schematic diagram of a BMC chip based on the above encryption method provided for the embodiments of the present application is shown in the figure.

[0055] Figure 6 A structural framework schematic diagram of an encryption device provided for the embodiments of the present application is shown in the figure.

[0056] Figure 7 A structural framework schematic diagram of an encryption device provided for the embodiments of the present application is shown in the figure. DETAILED DESCRIPTION

[0057] The technical solutions in the embodiments of the present application will be described clearly and completely in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the protection scope of the present application.

[0058] The terms "include", "includes" and "including", as well as any forms of these terms used in the specification and in the accompanying claims, are intended to be inclusive in a manner similar to the term "comprising" as an open transition term without precluding any additional or omissions "including" an un-specified list of steps or elements, does not exclude additional steps or elements.

[0059] For those skilled in the art to better understand the technical scheme of the present application, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments.

[0060] Next, the flowchart of the encryption method provided by the embodiment of the present application is described in detail. Figure 1 The encryption method provided by the embodiment of the present application comprises:

[0061] S101, determining the application scenario based on the data amount during encryption of the encryption device, the security requirement and the encryption sequence.

[0062] The encryption method in this embodiment can be applied to a baseboard management controller, and can also be applied to other chips such as CPU (central processing unit), GPU (graphics processing unit), NPU (neural processing unit) and the like. The execution subject of this embodiment is an electronic device. The electronic device can be a computer, a mobile phone or the like. The data amount during encryption of the encryption device in this embodiment refers to the amount of data that needs to be encrypted, and the security requirement in this embodiment refers to the requirement of the data that needs to be encrypted for security; the encryption sequence in this embodiment refers to the sequence requirement of the data that needs to be encrypted for each password algorithm. The data amount during encryption and the security requirement. For example, in the field of data storage, the AES symmetric encryption algorithm is widely used, the same key is used for encryption and decryption, and a large amount of data (the data amount is greater than the highest amount) can be efficiently encrypted to protect the security of the data stored in the hard disk and the cloud; in the field of financial transactions, the RSA asymmetric encryption algorithm is used to protect the security of online bank transfers, which uses the public key encryption and the private key decryption method to ensure that the transaction information is not tampered with and stolen during transmission; in the field of digital signature, the SHA-256 secure hash algorithm is used to protect the content from being tampered with during transmission and storage. The encryption sequence refers to, for example, when the current scene needs to perform asymmetric password algorithm calculation first and then hash password algorithm calculation, the hash password module and the asymmetric password module in the password calculation module are controlled to perform calculation in sequence; when the application scene needs to perform symmetric password algorithm and asymmetric password algorithm calculation at the same time, the symmetric password module and the asymmetric password module in the password calculation module are controlled to perform calculation at the same time.

[0063] It needs to be further explained that based on any of the above embodiments, the above determination of the application scenario based on the data amount during encryption of the encryption device, the security requirement and the encryption sequence can include:

[0064] S1011, determine the type of cryptographic algorithm based on the data volume and security requirements;

[0065] S1012, determine the sequence limitation between cryptographic algorithms based on the encryption sequence;

[0066] S1013, determine the application scenario based on the type of cryptographic algorithm and the sequence limitation.

[0067] This embodiment can divide different amounts of data based on the data volume threshold to obtain the quantity priority corresponding to each level of data volume, the cryptographic algorithm type corresponding to different quantity priorities is different, the security is divided into different levels of security priority based on the security requirement, the cryptographic algorithm type corresponding to different security priorities is different, thereby determining different comprehensive priorities based on the data volume and security requirements, determining the cryptographic algorithm corresponding to each comprehensive priority, thereby obtaining all types of cryptographic algorithms that meet the requirements when the data volume and security requirements are obtained. Determining the sequence limitation between cryptographic algorithms based on the encryption sequence means that after determining the type of cryptographic algorithm, there is a certain sequence between some cryptographic algorithms, so it is necessary to determine the sequence limitation, thereby limiting the sequence of part of the cryptographic algorithms in the cryptographic algorithm type. By determining the application scenario, the security and data processing efficiency of the cryptographic algorithm can be balanced.

[0068] S102, determine the compatibility performance based on the decryption condition of the decryption device; wherein the compatibility performance is the decryption type supported by the decryption device.

[0069] The compatibility performance in this embodiment refers to the decryption type supported by the decryption device, which ensures that the decryption device can decrypt after being encrypted by the encryption device. This embodiment takes into account that the cryptographic algorithm compatibility of different decryption devices is different, for example, data is encrypted and decrypted by the decryption device, the decryption device only supports one or several algorithms in symmetric cryptographic algorithm, asymmetric cryptographic algorithm, hash cryptographic algorithm, and post-quantum cryptographic algorithm, therefore the decryption condition of the decryption device needs to be considered when encrypting data.

[0070] It should be further pointed out that constructing the cryptographic algorithm combination set based on the application scenario and the compatibility performance can include:

[0071] S1021, perform real-time security posture dynamic perception to obtain an actual security posture result;

[0072] S1022, construct the cryptographic algorithm combination set based on the application scenario, the compatibility performance, and the actual security posture result.

[0073] The embodiment performs real-time security posture dynamic perception, that is, performing security posture dynamic perception on the encryption device. If the security posture of the encryption device is vulnerable to attacks, a cipher algorithm with security performance reaching the set security requirement needs to be selected. The embodiment can perceive the security posture of the current encryption device in real time, and does not limit the specific content of the perception. As long as the content is related to security, the actual security posture result of the current encryption device can be obtained through the perception. Based on the security requirement in the application scenario and the actual security posture result, a cipher algorithm that meets the security requirement and can defend against the current actual security posture is determined, and a cipher algorithm combination is constructed based on the selected cipher algorithm and the compatibility performance. When the cipher algorithm combination set is constructed, the actual security posture result of the encryption device is considered, so that the security of the optimal cipher algorithm combination determined for subsequent encryption can be improved.

[0074] It needs to be further explained that, based on the above embodiment, the cipher algorithm combination set is constructed based on the application scenario, the compatibility performance and the actual security posture result. The cipher algorithm combination set can be constructed based on the application scenario and the compatibility performance when the security requirement in the application scenario is consistent with the actual security posture result, or the security requirement is higher than the actual security posture result. The cipher algorithm combination set is constructed based on the encryption order in the application scenario, the compatibility performance and the actual security posture result when the security requirement in the application scenario is lower than the actual security posture result. The embodiment can determine the security requirement of the encryption device based on the actual security posture result, calculate the intersection based on the security requirement in the application scenario and the security requirement of the encryption device, and take the party with the highest security requirement as the final security requirement, so as to determine the security requirement that meets the data encryption and the security requirement that the encryption device can defend against attacks. The embodiment gives the specific process of constructing the cipher algorithm combination set based on the application scenario, the compatibility performance and the actual security posture result, and improves the accuracy of the cipher algorithm combination set determination.

[0075] In S103, a cipher algorithm combination set is constructed based on the application scenario and the compatibility performance, the cipher algorithm combination set is taken as input, a target performance of the preset encryption device is taken as a target, an optimal cipher algorithm combination is determined in the cipher algorithm combination set, and the encrypted data is encrypted based on the optimal cipher algorithm combination.

[0076] The embodiment is based on application scenarios and compatible performance to construct a combination set of cryptographic algorithms, which means that when the encryption algorithms that can be used are determined based on application scenarios and compatible performance, the execution order of the encryption algorithms needs to be determined. The execution order can achieve the target performance of the preset encryption device, thereby ensuring the performance of the encryption device during encryption. In the embodiment, the combination set of cryptographic algorithms includes various types of cryptographic algorithm combinations, and the types of encryption algorithms in each cryptographic algorithm combination are different. When the types of encryption algorithms are the same, the execution order of the encryption algorithms is different. The execution order is the priority of each cryptographic algorithm, and the execution is based on the priority. When the priorities are the same, the execution can be performed in parallel. The combination of cryptographic algorithms in the embodiment includes one or more algorithms in symmetric cryptographic algorithms, asymmetric cryptographic algorithms, hash cryptographic algorithms, and post-quantum cryptographic algorithms, for example, the combination of various algorithms in symmetric cryptographic algorithms, or the combination of a cryptographic algorithm in symmetric cryptographic algorithms and a cryptographic algorithm in asymmetric cryptographic algorithms. The embodiment does not limit the specific method of determining the optimal cryptographic algorithm combination in the combination set of cryptographic algorithms as input and the target performance of the preset encryption device as the target. For example, the embodiment can determine the optimal cryptographic algorithm combination from the combination set of cryptographic algorithms based on a genetic algorithm; or the embodiment can determine the optimal cryptographic algorithm combination from the combination set of cryptographic algorithms based on a particle swarm algorithm; or the embodiment can also determine the optimal cryptographic algorithm combination from the combination set of cryptographic algorithms based on a neural network algorithm; or the embodiment can also determine the optimal cryptographic algorithm combination from the combination set of cryptographic algorithms based on a reinforcement learning algorithm. The process of optimization based on the particle swarm algorithm can include: taking the combination set of cryptographic algorithms as input and the target performance of the preset encryption device as the optimization target. Initialize the particle swarm, where each particle represents a cryptographic algorithm combination and has a position and a speed; define a fitness function for evaluating the advantages and disadvantages of the algorithm combination represented by the particle in meeting the target performance of the preset encryption device; in each iteration, update the speed and position of the particle according to the individual extreme value of the particle and the global extreme value of the particle swarm, and then search for a better solution; repeat the position and speed update of the particle and the fitness evaluation until the preset algorithm termination condition is met; finally, decode the global optimal particle solution to obtain the optimal cryptographic algorithm combination that meets the target performance of the encryption device; the process of optimization based on the reinforcement learning algorithm can include: taking the combination set of cryptographic algorithms as the state space and the target performance of the preset encryption device as the optimization target.Each combination of cryptographic algorithms is regarded as a state in the environment, and the reinforcement learning agent selects an action according to the current policy to change the combination of cryptographic algorithms; the environment feeds back a reward value according to the performance of the selected combination, and the reward value measures the degree to which the selected combination of cryptographic algorithms meets the target performance of the encryption device; the agent continuously updates the policy function or the value function according to the reward value, thereby improving the ability to select a high-quality combination of cryptographic algorithms; through multiple rounds of interaction, the agent gradually converges to the optimal policy, and finally selects the combination of cryptographic algorithms with the largest cumulative reward as the optimal solution that meets the preset target performance of the encryption device. The embodiment does not limit the specific preset target performance of the encryption device, for example, the preset target performance of the encryption device is that the target operation speed of the encryption device reaches a set operation speed value; or the preset target performance of the encryption device in the embodiment is that the resource consumption of the encryption device is lower than a set threshold; or the preset target performance of the encryption device in the embodiment includes that the resource consumption reaches a set threshold and the operation speed reaches a set speed value; or the preset target performance of the encryption device in the embodiment can consider three dimensions of security strength, processing efficiency, and resource occupation, the security strength can be attack resistance, the processing efficiency includes throughput and delay, and the resource occupation includes power consumption and memory occupation. The encryption process based on the optimal combination of cryptographic algorithms includes, for example, a set of data to be encrypted X, and the optimal combination of cryptographic algorithms is a hash cryptographic algorithm and an asymmetric cryptographic algorithm, so that the data to be encrypted X is copied and the hash cryptographic algorithm and the asymmetric cryptographic algorithm are calculated; a plurality of sets of data to be encrypted X1, X2, and X3, and the optimal combination of cryptographic algorithms is a symmetric cryptographic algorithm, an asymmetric cryptographic algorithm, and a hash cryptographic algorithm, so that the data X1, X2, and X3 are calculated according to the corresponding cryptographic algorithms.

[0077] It should be further explained that, based on any of the above embodiments, the types of cryptographic algorithms and / or the execution order of the cryptographic algorithms in different combinations of cryptographic algorithms in the combination set of cryptographic algorithms are different; the execution order of the cryptographic algorithms includes parallel execution and serial execution according to the priority of each cryptographic algorithm.

[0078] In this embodiment, the cryptographic algorithms can be processed in parallel, thereby improving the efficiency of encryption. The embodiment determines the combination of cryptographic algorithms to include serial and parallel execution, thereby improving the accuracy of subsequent determination of the optimal combination of cryptographic algorithms due to the improved comprehensiveness of the combination of cryptographic algorithms.

[0079] It should be further explained that, based on any of the above embodiments, the combination set of cryptographic algorithms is constructed based on the application scenario and the compatibility performance, and the combination set of cryptographic algorithms is used as input, and the target performance of the preset encryption device is used as the target, and the optimal combination of cryptographic algorithms is determined in the combination set of cryptographic algorithms, which can include:

[0080] S1031, encode the cipher algorithm combinations in the cipher algorithm combination set into individuals to form an initial population containing as many individuals as the number of cipher algorithm combinations; wherein each individual represents a cipher algorithm combination.

[0081] In this embodiment, all cipher algorithm combinations in the cipher algorithm combination set are encoded into individuals in the genetic algorithm to form an initial population containing a plurality of individuals; wherein each individual represents a cipher algorithm combination, i.e., the number of cipher algorithm combinations is the same as the number of individuals in the initial population. The encoding in this embodiment can map one or more elements in each cipher algorithm combination, including algorithm identification, working mode, key length, and padding mode, into a chromosome sequence composed of discrete gene sites.

[0082] S1032, determine the individual fitness value of each cipher algorithm combination; wherein the individual fitness value represents the degree to which the cipher algorithm combination meets the target performance of the preset encryption device.

[0083] In this embodiment, for each individual in the current population: decode it into the corresponding cipher algorithm combination; run the cipher algorithm combination on the encryption device or in the simulation environment; collect the running result data and calculate its individual fitness value according to the target performance indicator; the individual fitness value represents the degree to which the cipher algorithm combination meets the target performance of the preset encryption device. In this embodiment, the calculation method of the fitness value is: construct an evaluation function according to one or more of the preset target performance of the encryption device in terms of encryption strength, operation speed, resource consumption, and attack resistance; the function output value is the individual fitness value.

[0084] S1033, based on the individual fitness values, use a selection operator to select individuals with individual fitness values higher than a set individual fitness value from the current initial population as parent individuals.

[0085] In this embodiment, based on the calculated fitness values of the individuals, a selection operator is used to select individuals with high individual fitness values from the current population as parent individuals.

[0086] S1034, after performing a crossover operator operation on the parent individuals according to a preset crossover probability, perform a mutation operator operation to obtain a child individual set.

[0087] The embodiment performs a crossover operator operation on the selected parent individuals according to a preset crossover probability, including: a. exchanging part of the gene fragments of the two parent individuals; b. generating a new offspring individual; wherein the gene fragments correspond to specific algorithm elements or configurations in the combination of cryptographic algorithms; performing a mutation operator operation on the offspring individual generated based on the crossover operation according to a preset mutation probability, including: randomly changing one or more gene fragments of the offspring individual; the change operation is performed within the range allowed in the set of combinations of cryptographic algorithms, generating a set of offspring individuals, replacing individuals with low individual fitness values in the current population to form a new generation population.

[0088] In S1035, based on the set of offspring individuals, individuals with low individual fitness values in the current initial population are replaced to form a new generation population; wherein the individual fitness value is lower than the set individual fitness value.

[0089] In S1036, the steps of calculating the individual fitness value are repeatedly performed until the new generation population is formed, and the individual with the highest individual fitness value in the final population is decoded to obtain the optimal combination of cryptographic algorithms that meets the target performance of the preset encryption device.

[0090] The embodiment repeatedly performs steps S1032 to S1035 until the preset algorithm termination condition is met. The embodiment does not limit the specific preset algorithm termination condition, for example, the algorithm termination condition can be that the maximum number of iterations is reached, the optimal fitness value of the population has not been improved for a certain number of generations, or the individual fitness value is higher than a set threshold. Thus, the individual with the highest individual fitness value in the final population is decoded to obtain the optimal combination of cryptographic algorithms that meets the target performance of the preset encryption device. The embodiment gives a method for determining the optimal combination of cryptographic algorithms in the set of combinations of cryptographic algorithms, which improves the accuracy of the algorithm.

[0091] It needs to be further explained that, based on any of the above embodiments, in order to improve the accuracy of the determination of the individual fitness value, the above determination of the individual fitness value of each combination of cryptographic algorithms can include: decoding each individual in the current initial population into a corresponding decoded combination of cryptographic algorithms; running the decoded combination of cryptographic algorithms on the encryption device to obtain running result data; and calculating the individual fitness value of the current decoded combination of cryptographic algorithms based on the running result data and the target performance of the preset encryption device. The embodiment can compare different running result data with the divided performance intervals to obtain the individual fitness value. Alternatively, the embodiment can also perform weighted calculation based on each parameter related to the target performance in the running result data to obtain the individual fitness value. The running result data in the embodiment refers to the running performance corresponding to the current decoded combination of cryptographic algorithms, so as to determine the individual fitness value based on the running performance and the target performance of the preset encryption device. The embodiment gives a specific process for determining the individual fitness value, which improves the accuracy of the determination of the individual fitness value.

[0092] It needs to be further explained that, based on any of the above embodiments, after determining the optimal combination of cryptographic algorithms in the combination set of cryptographic algorithms based on the application scenario and the compatibility performance and taking the target performance of the preset encryption device as the target, the method can further include: encrypting the data to be encrypted based on the optimal combination of cryptographic algorithms, obtaining the master key corresponding to each cryptographic algorithm in the optimal combination of cryptographic algorithms, and generating a backup key corresponding to each master key; and storing the master key and the backup key in a disordered manner. When the master key is leaked or invalid, the backup key is enabled. This embodiment generates a backup password corresponding to each master key, and stores the master keys in a disordered manner, that is, not in the order of encryption, so that the encryption device has higher security when attacked.

[0093] It needs to be further explained that, based on the above embodiment, storing the master key and the backup key in a disordered manner can include: storing the master key and the backup key in a disordered manner, and assigning an identity to each master key and backup key to enable the decryption device to obtain the key for calculation. The decryption process of the decryption device in this embodiment can be: initiating a key request according to the type of encryption algorithm; the encryption device traverses all physical units according to the encryption algorithm used to find the key according to the identity; returning the key value to the decryption device; and the decryption device decrypts based on the received key value.

[0094] The encryption method provided by the embodiment of the application can include: S101, determining an application scenario based on a data amount, a security requirement and an encryption order when an encryption device encrypts; S102, determining a compatibility performance based on a decryption condition of a decryption device; wherein the compatibility performance is a decryption type supported by the decryption device; S103, constructing a combination set of cryptographic algorithms based on the application scenario and the compatibility performance, taking the combination set of cryptographic algorithms as input, taking a target performance of a preset encryption device as a target, and determining an optimal combination of cryptographic algorithms in the combination set of cryptographic algorithms; and encrypting data to be encrypted based on the optimal combination of cryptographic algorithms. Compared with the current direct encryption based on a cryptographic algorithm, the application determines the optimal combination of cryptographic algorithms based on the application scenario and the compatibility performance and taking the performance target of the encryption device as the target, thereby improving the calculation performance and security of the cryptographic algorithm.

[0095] In order to make the application more convenient to understand, please refer to Figure 2 , Figure 2 The flowchart of the encryption method provided by the embodiment of the application can specifically include:

[0096] S201, the encryption device determines an application scenario based on a data amount, a security requirement and an encryption order when the encryption device encrypts.

[0097] S202, the encryption device determines the compatibility performance based on the decryption of the decryption device; wherein the compatibility performance is the decryption type supported by the decryption device.

[0098] S203, the encryption device performs real-time security posture dynamic perception on the encryption device to obtain an actual security posture result.

[0099] S204, the encryption device constructs a password algorithm combination set based on the application scenario, the compatibility performance and the actual security posture result; wherein the types of password algorithms of different password algorithm combinations and / or the execution order of password algorithms are different; the execution order of password algorithms includes parallel execution and serial execution according to the priority of each password algorithm.

[0100] This embodiment can construct the password algorithm combination based on the password algorithm accelerator in the encryption device. The password algorithm accelerator includes an information analysis module, an intelligent control module, a password calculation module and a key module. For details, please refer to Figure 3 , Figure 3 A schematic diagram of a password algorithm accelerator provided by the embodiment of the application. The information analysis module is used to analyze the application scenario and the compatibility performance of the password algorithm accelerator. Different application scenarios require different password algorithms, such as symmetric encryption algorithms widely used in the data storage field, which use the same key for encryption and decryption, can efficiently encrypt a large amount of data, and protect the security of data stored in hard disks and the cloud; in the financial transaction field, asymmetric encryption algorithms are used to protect the security of online bank transfers, which use public key encryption and private key decryption to ensure that transaction information is not tampered with and stolen during transmission; in the field of digital signature, hash algorithms are used to protect the integrity of content during transmission and storage. Different decryption devices have different password algorithm compatibility, such as data encrypted by the password algorithm accelerator and decrypted by the decryption device, which only supports one or several algorithms in symmetric password algorithm, asymmetric password algorithm, hash password algorithm and post-quantum password algorithm, so the password algorithm accelerator needs to consider the decryption of the decryption device when encrypting data.

[0101] The intelligent control module constructs the password algorithm combination set based on the results of the information analysis module and the actual security posture result, determines the password algorithm combination set, and determines the password algorithm combination that optimizes the performance of the encryption device from the password algorithm set. For example, when the application scenario requires asymmetric password algorithm calculation first and hash password algorithm calculation second, control the hash password module and the asymmetric password module in the password calculation module to calculate in sequence; when the application scenario requires simultaneous symmetric password algorithm and asymmetric password algorithm calculation, control the symmetric password module and the asymmetric password module in the password calculation module to calculate simultaneously.

[0102] The cryptographic computation module includes symmetric cryptographic modules, asymmetric cryptographic modules, hash cryptographic modules, post-quantum cryptographic modules, and realizes accelerated computation of various cryptographic algorithms, such as symmetric cryptographic algorithms (3DES (Triple Data Encryption Standard), AES (Advanced Encryption Standard), SM4 (Commercial SM4 block cipher algorithm)), asymmetric cryptographic algorithms (RSA (Public Key Cryptosystem), ECC (Elliptic Curve Cryptosystem), SM2 (Commercial SM2 Elliptic Curve Public Key Cryptography Algorithm)), hash cryptographic algorithms (MD5 (Message Digest Algorithm), SHA-256 (Secure Hash Algorithm-256 bits)), and post-quantum cryptographic algorithms (CRYSTALS-Kyber (Crystal-Kyber Key Encapsulation Mechanism), CRYSTALS-Dilithium (Crystal-Dilithium Digital Signature Algorithm), Falcon (Lightweight Digital Signature Algorithm)). In symmetric cryptographic algorithms, the sender uses a key to encrypt plaintext data to generate ciphertext, and the receiver uses the same key to decrypt the ciphertext to restore the original data. Because the encryption and decryption processes are symmetrical and the keys are the same, it is called symmetric encryption. Symmetric cryptographic algorithms have the advantages of fast encryption speed, small computational overhead, and simple implementation, and are very suitable for protecting the transmission and storage of large amounts of data. Common symmetric encryption algorithms include 3DES, AES, SM4, etc. Asymmetric cryptographic algorithms, also known as public key cryptographic algorithms, use a pair of keys (public key and private key) for encryption and decryption. Unlike symmetric cryptographic algorithms, asymmetric encryption uses different keys for encryption and decryption. The public key can be publicly disclosed and used for encrypting information or verifying signatures, while the private key needs to be strictly kept secret and used for decrypting information or generating signatures. Compared with symmetric cryptographic algorithms, asymmetric cryptographic algorithms facilitate key distribution, support digital signatures and key exchange, but have lower computational efficiency. Common algorithms include RSA, ECC, SM2, etc. Hash cryptographic algorithms are cryptographic algorithms that map arbitrary length input data (plaintext) to fixed length output (hash value) through mathematical functions. The core principle is to "compress" data into a unique value through a hash function. Any slight change in input will cause a significant change in the hash value, so it can be used for data integrity verification and identity authentication. Hash algorithms have one-way properties, i.e., it is impossible to reverse the original data from the hash value. Common hash algorithms include MD5, SHA-256, etc. Post-quantum cryptographic algorithms are cryptographic algorithms that can resist quantum computer attacks. Quantum computers have powerful computing power and can crack current widely used asymmetric cryptographic algorithms such as RSA and ECC in a short time. Therefore, the research goal of post-quantum cryptographic algorithms is to design cryptographic schemes that remain secure even in the face of quantum computing threats. The principle is usually based on mathematical problems that are difficult for quantum computers to crack. Common post-quantum cryptographic algorithms include CRYSTALS-Kyber, CRYSTALS-Dilithium, Falcon, etc.

[0103] The key module includes a plurality of master key storage units (master keys 1-1 and 1-2 in Figure 3 ) and a plurality of backup key storage units (keys 2-1 and 2-2 in Figure 3 ). When the master key is compromised or invalid, the backup key is enabled. The keys of various cryptographic algorithms are stored in a centralized and unordered manner, such as in Figure 3 , the first key 1-1 stores the RSA algorithm key, and the second key 1-2 stores the SM4 algorithm key. Each key is assigned an identity, and the corresponding cryptographic algorithm is calculated by selecting the key according to the identity.

[0104] The calculation process of the cryptographic algorithm accelerator in this embodiment is shown in Figure 4 , Figure 4 The calculation process of the cryptographic algorithm accelerator provided by the embodiment of the application can specifically include: application scenario and compatibility performance analysis, determining a cryptographic algorithm combination set using a cryptographic calculation module based on the application scenario and the compatibility performance analysis, determining an optimal cryptographic algorithm combination, encrypting based on the optimal cryptographic algorithm combination, and obtaining a master key and a backup key.

[0105] In S205, the encryption device determines the optimal cryptographic algorithm combination in the cryptographic algorithm combination set as input, with the target performance of the encryption device as the target.

[0106] In S206, the encryption device encrypts the data to be encrypted based on the optimal cryptographic algorithm combination, obtains a plurality of master keys, sets a backup key corresponding to each master key, stores the master keys and the backup keys in an unordered manner, and sets the identity corresponding to the master keys and the backup keys.

[0107] In S207, the decryption device obtains the corresponding master key and backup key based on the identity, and decrypts the data to be decrypted.

[0108] It should be noted that when the above method is applied to the BMC, the specific structure is shown in Figure 5 , Figure 5A schematic diagram of a BMC chip based on the above encryption method is provided for the embodiments of the present application. BMC (Baseboard Management Controller) is a key component in a server, responsible for hardware monitoring, fault management, remote control, etc. of the server. The BMC chip can monitor various hardware parameters of the server, including voltage, temperature, fan speed, power state, etc.; can detect and record faults occurring in the server; allows administrators to remotely control the server, including booting, shutting down, restarting, etc. The password module of the BMC chip is an important security component. It can protect the communication data (such as server management data, firmware update data) between the BMC and other devices, and protect the sensitive data (such as passwords, certificates) stored by the BMC. The password module of the BMC chip usually supports multiple password algorithms, including symmetric password algorithms, asymmetric password algorithms, hash password algorithms, etc. The BMC chip based on the above encryption method includes a processor, a memory, a password algorithm accelerator and other modules. The processor is the control and calculation core module of the BMC chip. The processor is an x86 processor, an Arm processor (a reduced instruction set processor designed by the British ARM company) or a RISC-V processor (an open source reduced instruction set processor architecture). The memory is used for data storage of the BMC chip, including DDR SDRAM (double data rate synchronous dynamic random access memory), ROM (read only memory), FLASH (flash memory), etc. The password algorithm accelerator is the password algorithm accelerator in Figure 3 , which is used to implement the calculation of multiple encryption and decryption algorithms, such as AES algorithm, ECC algorithm, SHA-256 algorithm, etc. Other functional modules include clock modules, power modules, etc. The processor, memory, password algorithm accelerator and other modules are connected through buses, including AXI bus (advanced extensible interface bus), AHB bus (high-performance system bus), APB bus (advanced peripheral bus). The password algorithm accelerator is the device corresponding to the encryption algorithm. According to different types of servers (such as AI servers, storage servers, edge servers) and different application scenarios (such as high-performance computing, large-capacity data storage) applied by the BMC chip, the encryption and decryption calculation of multiple password algorithms is implemented.

[0109] The present application provides an encryption method that supports the encryption and decryption calculation of multiple password algorithms, such as symmetric password algorithms, asymmetric password algorithms, hash password algorithms and post-quantum password algorithms. According to the application scenario and compatibility performance, the optimal password algorithm combination can be obtained, and the intelligent control of multiple password algorithm calculation is realized. In the multiple password algorithm scenario, the calculation performance and security of the password algorithm are improved.

[0110] The encryption device provided by the embodiments of the present application is described below. The encryption device described below can be referred to in conjunction with the encryption method described above.

[0111] Figure 6 A structural framework schematic diagram of an encryption device provided by an embodiment of the present application can include:

[0112] An application scenario determination module 100 is configured to determine an application scenario based on a data volume, security requirements and an encryption sequence when the encryption device is encrypting;

[0113] A compatibility performance determination module 200 is configured to determine a compatibility performance based on a decryption condition of a decryption device; wherein the compatibility performance is a decryption type supported by the decryption device;

[0114] An encryption algorithm determination module 300 is configured to construct a combination set of cryptographic algorithms based on the application scenario and the compatibility performance, take the combination set of cryptographic algorithms as input, take a target performance of a preset encryption device as a target, determine an optimal combination of cryptographic algorithms in the combination set of cryptographic algorithms, and encrypt to-be-encrypted data based on the optimal combination of cryptographic algorithms.

[0115] Further, based on the above embodiments, the application scenario determination module 100 can include:

[0116] A cryptographic algorithm type determination unit is configured to determine a type of cryptographic algorithm based on the data volume and the security requirements;

[0117] A sequence limitation unit is configured to determine a sequence limitation between cryptographic algorithms based on the encryption sequence;

[0118] An application scenario determination unit is configured to determine the application scenario based on the type of cryptographic algorithm and the sequence limitation.

[0119] Further, based on any of the above embodiments, the types of cryptographic algorithms and / or execution sequences of cryptographic algorithms of different combinations of cryptographic algorithms in the combination set of cryptographic algorithms are different; the execution sequence of cryptographic algorithms includes parallel execution and serial execution according to a priority of each cryptographic algorithm.

[0120] Further, based on any of the above embodiments, the encryption algorithm determination module 300 can include:

[0121] An initial population determination unit is configured to encode combinations of cryptographic algorithms in the combination set of cryptographic algorithms into individuals to form an initial population containing the same number of individuals as the combinations of cryptographic algorithms; wherein each individual represents a combination of cryptographic algorithms;

[0122] An individual fitness value determination unit is configured to determine an individual fitness value of each combination of cryptographic algorithms; wherein the individual fitness value represents a degree to which a combination of cryptographic algorithms meets a target performance of a preset encryption device;

[0123] The parent individual determining unit is configured to select, based on the individual fitness values, individuals with individual fitness values higher than a set individual fitness value from the current initial population as parent individuals by using a selection operator;

[0124] The offspring individual set determining unit is configured to perform a mutation operator operation on the parent individuals to obtain an offspring individual set after performing a crossover operator operation on the parent individuals according to a preset crossover probability;

[0125] The new generation population determining unit is configured to replace individuals with low individual fitness values in the current initial population based on the offspring individual set to form a new generation population, wherein the low individual fitness value is a value lower than the set individual fitness value.

[0126] The optimal cryptographic algorithm combination determining unit is configured to repeatedly perform the steps of calculating an individual fitness value until forming a new generation population until a preset algorithm termination condition is met, decode an individual with the highest individual fitness value in the final population to obtain an optimal cryptographic algorithm combination that meets a preset target performance of the encryption device.

[0127] Further, based on the above embodiments, the individual fitness value determining unit can include:

[0128] The decoding subunit is configured to decode each individual in the current initial population into a corresponding decoded cryptographic algorithm combination.

[0129] The running result data determining subunit is configured to run the decoded cryptographic algorithm combination on the encryption device to obtain running result data.

[0130] The individual fitness value determining subunit is configured to calculate the individual fitness value of the current decoded cryptographic algorithm based on the running result data and the preset target performance of the encryption device.

[0131] Further, based on any of the above embodiments, the encryption device can further include:

[0132] The encryption module is configured to encrypt the data to be encrypted based on the optimal cryptographic algorithm combination to obtain a master key corresponding to each cryptographic algorithm in the optimal cryptographic algorithm combination and generate a backup key corresponding to each master key.

[0133] The storage module is configured to store the master keys and the backup keys in a disordered manner.

[0134] Further, based on the above embodiments, the storage module can include:

[0135] A storage unit is configured to store the master keys and the backup keys in a disordered manner, and assign an identity to each of the master keys and the backup keys, so that the decryption device obtains a key based on the identity.

[0136] Further, based on any of the above embodiments, the encryption algorithm determination module 300 can include:

[0137] A security posture dynamic perception unit is configured to perform real-time security posture dynamic perception to obtain an actual security posture result.

[0138] A password algorithm combination set determination unit is configured to construct the password algorithm combination set based on the application scenario, the compatibility performance, and the actual security posture result.

[0139] Further, based on the above embodiments, the password algorithm combination set determination unit can include:

[0140] A first construction sub-unit is configured to, when the security requirement in the application scenario is consistent with the actual security posture result, or the security requirement is higher than the actual security posture result, directly construct the password algorithm combination set based on the application scenario and the compatibility performance.

[0141] A second construction sub-unit is configured to, when the security requirement in the application scenario is lower than the actual security posture result, construct the password algorithm combination set based on the encryption order in the application scenario, the compatibility performance, and the actual security posture result.

[0142] Further, based on any of the above embodiments, the encryption device is applied to a baseboard management controller.

[0143] Further, based on any of the above embodiments, the password algorithm combination includes one or more of symmetric encryption algorithms, asymmetric encryption algorithms, hash encryption algorithms, and post-quantum encryption algorithms.

[0144] It should be noted that the order of the modules and units in the above encryption device can be changed without affecting the logic.

[0145] Figure 6 The description of the features in the corresponding embodiments can be referred to Figure 6 The related description of the corresponding embodiments will not be repeated here.

[0146] The encryption device provided by the embodiment of the present application can comprise: an application scenario determination module 100, configured to determine an application scenario based on a data volume, a security requirement and an encryption sequence when an encryption device encrypts; a compatibility performance determination module 200, configured to determine a compatibility performance based on a decryption condition of a decryption device; wherein the compatibility performance is a decryption type supported by the decryption device; an encryption algorithm determination module 300, configured to construct a cipher algorithm combination set based on the application scenario and the compatibility performance, take the cipher algorithm combination set as an input, take a target performance of the encryption device as a target, determine an optimal cipher algorithm combination in the cipher algorithm combination set, and encrypt to-be-encrypted data based on the optimal cipher algorithm combination. Compared with the current encryption based on a cipher algorithm directly, the present application takes the performance target of the encryption device as a target when determining the cipher algorithm based on the application scenario and the compatibility performance, and determines the optimal cipher algorithm combination, thereby improving the calculation performance and the security of the cipher algorithm.

[0147] The encryption device provided by the embodiment of the present application is described below, and the encryption device described below can be referred to in correspondence with the encryption method described above.

[0148] Figure 7 The structural framework diagram of the encryption device provided by the embodiment of the present application is shown as follows, Figure 7 The encryption device comprises: a memory 60, configured to store a computer program;

[0149] A processor 61 is configured to implement the steps of the encryption method of the above-described embodiment when executing the computer program.

[0150] The encryption device provided by the embodiment can comprise, but is not limited to, a smart phone, a tablet computer, a notebook computer or a desktop computer, etc.

[0151] The processor 61 can include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 61 can be implemented in at least one of a hardware form of a digital signal processing (DSP), a field-programmable gate array (FPGA), a programmable logic array (PLA), etc. The processor 61 can also include a main processor and a coprocessor. The main processor is a processor for processing data in a wake-up state, also known as a central processing unit (CPU). The coprocessor is a low-power processor for processing data in a standby state. In some embodiments, the processor 61 can be integrated with a graphics processing unit (GPU) that is responsible for rendering and drawing content required to be displayed on the display screen. In some embodiments, the processor 61 can further include an artificial intelligence (AI) processor for processing computing operations related to machine learning.

[0152] The memory 60 can include one or more computer-readable storage media that can be non-transitory. The memory 60 can further include a high-speed random access memory, and a nonvolatile memory such as one or more disk storage devices, flash storage devices. In the present embodiment, the memory 60 is at least used to store the following computer program 601, wherein the computer program is loaded and executed by the processor 61, and can implement the related steps of the encryption method disclosed in any of the preceding embodiments. In addition, the resources stored in the memory 60 can further include an operating system 602 and data 603, etc., and the storage mode can be temporary storage or permanent storage. The operating system 602 can include Windows, Unix, Linux, etc. The data 603 can include but is not limited to data required by the encryption method, etc.

[0153] In some embodiments, the encryption device can further include a display screen 62, an input / output interface 63, a communication interface 64, a power supply 65, and a communication bus 66.

[0154] Those skilled in the art can understand that the structure shown in the above embodiments is not a limitation on the encryption device, and can include more or fewer components than those shown in the drawings. Figure 7 The structure shown in the above embodiments is not a limitation on the encryption device, and can include more or fewer components than those shown in the drawings.

[0155] It can be understood that if the encryption method in the above embodiments is implemented in the form of a software function unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and performs all or part of the steps of the method of each embodiment of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), an electrically erasable programmable ROM, a register, a hard disk, a removable magnetic disk, a CD-ROM, a magnetic disk or an optical disk, and various media that can store program codes.

[0156] Based on this, the embodiment of the present application also provides a computer readable storage medium, and the computer readable storage medium stores a computer program. The computer program is executed by a processor to realize the steps of the encryption method.

[0157] Based on this, the embodiment of the present application also provides a computer program product, which includes computer programs / instructions. The computer programs / instructions are executed by a processor to realize the steps of the encryption method.

[0158] The above provides a detailed description of the encryption method, device, equipment, storage medium and computer program product provided by the present application. The principles and implementation modes of the present application are described by applying specific examples in this paper. The above embodiment is only used to help understand the method and core idea of the present application. It should be pointed out that for ordinary skilled persons in the technical field, without departing from the principles of the present application, some improvements and modifications can be made to the present application. These improvements and modifications also fall within the protection scope of the present application.

[0159] The skilled person can further realize that the units and algorithm steps of each example described in combination with the embodiments disclosed in this paper can be realized by electronic hardware, computer software or a combination of the two. In order to clearly show the interchangeability of hardware and software, the components and steps of each example have been described in the above description. Whether the functions are executed in hardware or software depends on the specific application and design constraints of the technical solutions. The skilled person can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

Claims

1. An encryption method, characterized in that, include: The application scenario is determined based on the amount of data encrypted by the encryption device, the security requirements, and the encryption order. The compatibility performance is determined based on the decryption capabilities of the decryption device; wherein, the compatibility performance refers to the decryption types supported by the decryption device. Based on the application scenario and the compatibility performance, a set of cryptographic algorithm combinations is constructed. The set of cryptographic algorithm combinations is used as input, and the target performance of the preset encryption device is used as the target. The optimal cryptographic algorithm combination is determined in the set of cryptographic algorithm combinations, and the data to be encrypted is encrypted based on the optimal cryptographic algorithm combination. Based on the application scenario and the compatibility performance, a set of cryptographic algorithm combinations is constructed. Using this set as input and the target performance of a preset encryption device as the objective, the optimal cryptographic algorithm combination is determined from the set, including: The cryptographic algorithm combinations in the set of cryptographic algorithm combinations are encoded into individuals to form an initial population containing the same number of individuals as the cryptographic algorithm combinations; wherein each individual represents a cryptographic algorithm combination. Determine the individual fitness value for each cryptographic algorithm combination; wherein the individual fitness value characterizes the degree to which the cryptographic algorithm combination satisfies the target performance of the preset encryption device; Based on the individual fitness values, a selection operator is used to select individuals with fitness values ​​higher than the set individual fitness values ​​from the current initial population as parent individuals; After performing the crossover operator operation on the parent individuals according to the preset crossover probability, the mutation operator operation is performed to obtain the set of offspring individuals; Based on the set of offspring individuals, individuals with low fitness values ​​in the current initial population are replaced to form a new generation population; wherein, low fitness value is defined as a value lower than the set fitness value. Repeat the steps of calculating individual fitness values ​​to form a new generation of population until the preset algorithm termination condition is met. Then, decode the individual with the highest fitness value in the final population to obtain the optimal combination of cryptographic algorithms that meets the preset target performance of the encryption device.

2. The encryption method according to claim 1, characterized in that, Application scenarios are determined based on the amount of data encrypted by the encryption device, security requirements, and encryption order, including: The type of cryptographic algorithm is determined based on the amount of data and the security requirements; The order constraint between cryptographic algorithms is determined based on the encryption order; The application scenario is determined based on the type of cryptographic algorithm and the order constraint.

3. The encryption method according to claim 1, characterized in that, The cryptographic algorithms in the set of cryptographic algorithm combinations are of different types and / or have different execution orders; the execution order of the cryptographic algorithms includes parallel execution and serial execution according to the priority of each cryptographic algorithm.

4. The encryption method according to claim 3, characterized in that, Determine the individual fitness value for each cryptographic algorithm combination, including: For each individual in the current initial population, it is decoded into the corresponding combination of decoding cryptographic algorithms; The decoding cryptographic algorithm combination is run on the encryption device to obtain the running result data; The individual fitness value of the current decoding cryptographic algorithm is calculated based on the running result data and the target performance of the preset encryption device.

5. The encryption method according to claim 1, characterized in that, After constructing a set of cryptographic algorithm combinations based on the application scenario and the compatibility performance, and taking the set of cryptographic algorithm combinations as input and the target performance of the preset encryption device as the objective, and determining the optimal cryptographic algorithm combination from the set of cryptographic algorithm combinations, the process further includes: The data to be encrypted is encrypted based on the optimal combination of cryptographic algorithms to obtain the master key corresponding to each cryptographic algorithm in the optimal combination of cryptographic algorithms, and a backup key corresponding to each master key is generated. The master key and the backup key are stored in an out-of-order manner.

6. The encryption method according to claim 5, characterized in that, The master key and the backup key are stored in an out-of-order manner, including: The master key and the backup key are stored in a random order, and an identity identifier is assigned to each master key and the backup key, so that the decryption device can obtain the key based on the identity identifier and perform calculations.

7. The encryption method according to claim 1, characterized in that, Based on the aforementioned application scenarios and compatibility performance, a set of cryptographic algorithm combinations is constructed, including: To conduct real-time dynamic perception of the security situation and obtain actual security situation results; The cryptographic algorithm combination set is constructed based on the application scenario, the compatibility performance, and the actual security situation results.

8. The encryption method according to claim 7, characterized in that, Based on the application scenario, the compatibility performance, and the actual security situation, the cryptographic algorithm combination set is constructed, including: When the security requirements in the application scenario are consistent with the actual security situation, or when the security requirements are higher than the actual security situation, the set of cryptographic algorithm combinations is directly constructed based on the application scenario and the compatibility performance. When the security requirements in the application scenario are lower than the actual security situation results, the cryptographic algorithm combination set is constructed based on the encryption order in the application scenario, the compatibility performance, and the actual security situation results.

9. The encryption method according to claim 1, characterized in that, It is used in baseboard management controllers.

10. The encryption method according to claim 1, characterized in that, The cryptographic algorithm combination includes one or more of the following: symmetric cryptography, asymmetric cryptography, hash cryptography, and post-quantum cryptography.

11. An encryption device, characterized in that, include: The application scenario determination module is used to determine the application scenario based on the amount of data encrypted by the encryption device, the security requirements, and the encryption order. A compatibility performance determination module is used to determine compatibility performance based on the decryption capabilities of the decryption device; wherein, the compatibility performance refers to the decryption types supported by the decryption device. The encryption algorithm determination module is used to construct a set of cryptographic algorithm combinations based on the application scenario and the compatibility performance, and take the set of cryptographic algorithm combinations as input, take the target performance of the preset encryption device as the target, determine the optimal cryptographic algorithm combination in the set of cryptographic algorithm combinations, and encrypt the data to be encrypted based on the optimal cryptographic algorithm combination; The encryption algorithm determination module includes: An initial population determination unit is used to encode cryptographic algorithm combinations in the set of cryptographic algorithm combinations into individuals, forming an initial population containing the same number of individuals as the cryptographic algorithm combinations; wherein each individual represents a cryptographic algorithm combination; An individual fitness value determination unit is used to determine the individual fitness value of each cryptographic algorithm combination; wherein, the individual fitness value characterizes the degree to which the cryptographic algorithm combination satisfies the preset target performance of the encryption device; The parent individual determination unit is used to select individuals with individual fitness values ​​higher than a set individual fitness value from the current initial population as parent individuals based on the fitness values ​​of each individual and using a selection operator. The offspring individual set determination unit is used to perform a crossover operator operation on the parent individuals according to a preset crossover probability, and then perform a mutation operator operation to obtain the offspring individual set; A new generation population determination unit is used to replace individuals with low fitness values ​​in the current initial population based on the set of offspring individuals to form a new generation population; wherein, the low fitness value is a value lower than the set fitness value. The optimal cryptographic algorithm combination determination unit is used to repeatedly execute the step of calculating individual fitness values ​​to form a new generation of population until the preset algorithm termination condition is met, and decode the individual with the highest individual fitness value in the final population to obtain the optimal cryptographic algorithm combination that meets the preset target performance of the encryption device.

12. An encryption device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the steps of the encryption method as described in any one of claims 1 to 10.

13. A storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, implements the steps of the encryption method as described in any one of claims 1 to 10.

14. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instruction is executed by the processor, it implements the steps of the encryption method according to any one of claims 1 to 10.

Images