A multi-device key binding type data encryption storage system based on a national secret algorithm

Abstract

The application discloses a kind of multi-device key binding type data encryption storage systems based on national secret algorithm, including dynamic management module: based on optimization initial key, through edge node key pool is adapted distribution and national secret algorithm exchange, and through abnormal trigger update mechanism, output dynamic security key;Initial encryption module: the initial data is divided into blocks according to fixed size, and the last block is filled to obtain the data after blocking, the data features are extracted from the data after blocking, the data features include content features and metadata features, a sensitive level evaluation model is constructed based on data features to obtain the best sensitive level, the sensitivity of fuzzy data is converted into a quantifiable index by a regularity model, avoiding the subjectivity and randomness of manual judgment.

Description

Technical Field

[0001] This invention relates to the field of data encryption technology, and in particular to a multi-device key binding data encryption storage system based on Chinese national cryptographic algorithms. Background Technology

[0002] In current multi-device interconnection scenarios, encrypted data storage poses a risk of device identity forgery. Traditional solutions rely on software to generate device identifiers, which are easily tampered with or cloned, leading to unauthorized devices accessing the network and stealing data. At the same time, key management lacks a dynamic update mechanism, and fixed keys are prone to leakage during long-term use, causing large-scale data security risks and failing to adapt to the security requirements of dynamic changes in device status.

[0003] Currently, in existing data encryption storage systems, the national cryptographic algorithms (SM2, SM4, etc.) are not sufficiently adapted to multi-device scenarios. Existing systems typically use a single national cryptographic algorithm for encryption without combining data sensitivity levels to achieve differentiated protection. Highly sensitive data and ordinary data have the same encryption strength, resulting in a waste of security resources or insufficient protection of critical data. Therefore, this paper proposes a multi-device key binding data encryption storage system based on national cryptographic algorithms. Summary of the Invention

[0004] In order to overcome the above-mentioned defects of the prior art and to achieve the above objectives, the present invention proposes the following technical solution:

[0005] A multi-device key-binding encrypted data storage system based on national cryptographic algorithms includes:

[0006] Initialization module: Based on TPM, generate device identifier and obtain device feature vector through TLS registration. Based on device feature vector, generate initial key through key derivation function. After encrypting initial key with SM2, decrypt with private key and output optimized initial key.

[0007] Dynamic management module: Based on the optimized initial key, it performs adaptive allocation and exchange of national cryptographic algorithms through the edge node key pool, and outputs dynamic security keys through an abnormal trigger update mechanism;

[0008] Initial encryption module: Divides the initial data into blocks of fixed size, and fills the last block to obtain the data after block division. Extracts data features from the data after block division, including content features and metadata features. Based on the data features, a sensitivity level assessment model is constructed to obtain the optimal sensitivity level.

[0009] Dynamic hybrid encryption module: Based on data blocks with different optimal sensitivity levels, it calls different types of subkeys in the dynamic security key and attaches encryption data to obtain the best encryption scheme adapted to different data blocks.

[0010] The device identifier is generated by calling TPM interface functions and utilizing the key generation and identifier creation mechanism within TPM. ;

[0011] The device feature vector is used to establish a TLS connection. The device software calls the TLS library to initiate a handshake process and sends its own feature vector to the server. After verifying its legitimacy, the server proceeds via... Generate device feature vectors .

[0012] The process of optimizing the initial key is as follows:

[0013] Based on the acquired device feature vector The initial key is generated through the key derivation function. ;

[0014] The initial key is prepared using the national cryptographic SM2 algorithm. Encryption is performed by integrating the SM2 algorithm library, calling encryption functions to generate an SM2 public-private key pair, and decrypting the initial key using the private key from the public-private key pair. .

[0015] The process of edge node key pool adaptation and allocation is as follows:

[0016] Build a key pool at the edge node This will optimize the initial key. The data is sent to the edge nodes, which then distribute it according to the allocation key adapted from the key pool KP. A hash mapping strategy is adopted to obtain an optimized initial key hash value, and the key corresponding to the device is obtained by taking the modulo of the key pool capacity m based on the optimized initial key hash value.

[0017] The implementation process of the national cryptographic algorithm exchange is as follows:

[0018] Based on the allocated distribution key The system uses the SM4 algorithm for data encryption and the SM2 algorithm for key exchange. The newly generated temporary key is encrypted using the SM2 public key, and then the encrypted temporary key ciphertexts are exchanged. After both parties decrypt the ciphertexts, they obtain the shared new key.

[0019] The abnormal trigger update mechanism is implemented as follows:

[0020] Monitor the operating status of the equipment and trigger a key update when an abnormal event is detected;

[0021] When an update is triggered, the edge node forces a key reallocation from the key pool and triggers the exchange of national cryptographic algorithms between the device and the edge node to generate a new dynamic security key. At the same time, update the device's local key storage.

[0022] The dynamic security key is a composite key structure, represented as follows:

[0023]

[0024] in: The master key is derived from the optimized initial key by the dynamic management module. This is a set of multiple session subkeys, including SM2 subkeys and SM4 subkeys, where i is the index.

[0025] The process of implementing the data after it is divided into blocks is as follows:

[0026] The original data is divided into blocks of a fixed size. When the last data block is less than the fixed size, it is padded with the number of missing bytes using the encrypted message syntax standard.

[0027] The process of constructing the sensitivity level assessment model is as follows:

[0028] feature set Mapping to sensitivity levels 1-3, a weighted scoring method is used to assign weights to each feature and calculate the weighted sum. Sensitivity levels are determined based on the weighted sum of the values:

[0029] ;

[0030] ;

[0031] ;

[0032] in, , , For a pre-set threshold, It is classified as sensitive.

[0033] The process of obtaining the optimal encryption scheme adapted to different data blocks is as follows:

[0034] For data blocks with a sensitivity level of 2 or less, SM4 subkey encryption is used; for data blocks with a sensitivity level greater than 2, SM2 subkey encryption is used; and ciphertext data is appended to the encrypted ciphertext to obtain the best encryption scheme.

[0035] The present invention has the following beneficial effects:

[0036] 1. By generating an unforgeable device identifier through TPM and constructing a device feature vector in conjunction with TLS registration, a deep binding between hardware features and digital identity is achieved. Through the dynamic management module, the key changes in real time with the device status via key pool adaptation, national cryptographic algorithm exchange, and abnormal triggering updates, effectively resisting threats such as key leakage and man-in-the-middle attacks, and strengthening data security throughout the entire lifecycle.

[0037] 2. Based on the sensitivity assessment model, the data sensitivity level is obtained by calling SM2 / SM4 subkeys. The ambiguous data sensitivity level is transformed into a calculable quantitative indicator (Score value) through a rule-based model, avoiding the subjectivity and randomness of human judgment. High-sensitivity data is secured with SM2 asymmetric encryption, while medium- and low-sensitivity data is improved with SM4 symmetric encryption, achieving a dynamic balance between security and efficiency, reducing system resource consumption. Furthermore, from device initialization and dynamic key management to data block encryption, each module works together to form a complete security chain. The ciphertext is appended with metadata to enable accurate decryption traceability, ensuring the controllability of encrypted data storage in a multi-device environment. Attached Figure Description

[0038] Figure 1 This is a system block diagram of a multi-device key binding data encryption and storage system based on national cryptographic algorithms proposed in this invention. Detailed Implementation

[0039] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0040] Example: Figure 1 As shown, the present invention proposes a multi-device key-binding data encryption and storage system based on national cryptographic algorithms, comprising:

[0041] Initialization module: Generates device identifier based on TPM, obtains device feature vector through TLS registration, generates initial key based on device feature vector through derivation method based on SM3 hash function combined with salt value mixing operation, encrypts initial key through SM2 and then decrypts it with private key to output optimized initial key;

[0042] The process of generating device identifiers based on TPM is as follows:

[0043] Based on the TrustedPlatformModule (TPM), call the TPM interface functions and utilize the TPM's internal key generation and identifier creation mechanism to generate a unique device identifier: ,

[0044] The seed is the seed value generated by the internal random number generator of the TPM. Based on the hardware characteristics and encryption algorithm, the TPM transforms the seed into a unique device identifier for device identification.

[0045] Specifically, a unique device identifier (IDdevice) is generated using a TPM (Trusted Platform Module) chip. The TPM generates a seed value based on a hardware random number and uses an encryption algorithm to generate an unforgeable hardware-level identifier used to distinguish device identities.

[0046] The process of obtaining the device feature vector through TLS registration is as follows:

[0047] The device registers with the authentication server using the Transport Layer Security (TLS) protocol. In the software implementation, a TLS connection is first established, and the device software calls the TLS library (such as TLS-related functions in OpenSSL) to initiate the handshake process.

[0048] The device sends its own data to the server. The server verifies the legitimacy of the device's hardware and software environment information (such as CPU model, memory capacity, operating system version, etc.) before proceeding. Generate device feature vectors This process is viewed as a mapping of multi-dimensional device attributes, represented as:

[0049] in Let i be the i-th attribute of the device, and let be the mapping function on the server side in the TLS registration process based on attribute weighting and hashing operations;

[0050] Specifically, the mapping process for multi-dimensional device attributes involves the device reporting its own information to the server, including hardware configuration (CPU model, memory capacity), software environment (operating system version, pre-installed applications), and device identifier generated by TPM. This information describes the device characteristics from different dimensions. The server standardizes the collected multi-dimensional attributes and maps them into a fixed-length (256-bit) feature vector through hash operations. This vector is the output fixed-length feature vector. , used for subsequent key derivation;

[0051] The process of generating the initial key is as follows:

[0052] Based on the acquired device feature vector The initial key is generated through the Key Derivation Function (KDF). In the software implementation, a derivation method based on the SM3 hash function combined with salt value mixing is adopted, and the formula is expressed as:

[0053]

[0054] in, The desired key length (256 bits). This is an XOR operation used to mix salt values ​​and feature vectors;

[0055] KDF internally through... Perform a hash and salt (which can be a device identifier hash) combination operation to generate an initial key that meets the length and security requirements. The salt value S can be calculated as follows:

[0056]

[0057] in, Represents a hash function;

[0058] Specifically, through The initial key is generated using the key derivation function (KDF) of the SM3 hash function, along with the salt value. (256 bits long), salting enhances key randomness;

[0059] The optimized initial key acquisition process is as follows:

[0060] The initial key is prepared using the national cryptographic SM2 algorithm. To perform encryption, the software integrates the SM2 algorithm library and calls the encryption function to first generate an SM2 public-private key pair. ,in, Represents the public key. This represents the private key. The public key is used for encryption, and the private key is used for decryption. The encryption process formula is:

[0061] in, The encrypted initial key ciphertext, This is an encryption operation based on the SM2 algorithm;

[0062] Then through the public-private key pair private key in ,Right now: ;

[0063] Specifically, the initial key is encrypted using the SM2 national cryptographic algorithm to generate an SM2 public-private key pair, which is then encrypted using the public key. Obtain the ciphertext Then decrypt using the private key. Output optimized initial key This process enhances key security through encryption-decryption operations.

[0064] Dynamic management module: Based on the optimized initial key, it performs adaptive allocation and exchange of national cryptographic algorithms through the edge node key pool, and outputs dynamic security keys through an abnormal trigger update mechanism;

[0065] The process of key pool adaptation and allocation through edge nodes is as follows:

[0066] Build a key pool at the edge node Key pool The system internally stores multiple keys that conform to the requirements of the national cryptographic algorithm. In the software implementation, after the edge node starts up, it calls the key generation function to populate the key pool. ), where m is the key pool. The number of keys in the database;

[0067] The device will optimize the initial key. The data is sent to the edge nodes, which then distribute it according to the allocation key adapted from the key pool KP. A hash mapping strategy is used to calculate and optimize the initial key hash value. Then, based on the optimized initial key hash value, modulo the key pool capacity m to obtain the key corresponding to the device: ;

[0068] Specifically, through calculation The hash value of the optimized initial key is mapped to the range of 0 to m-1, which corresponds exactly to the index range of the key pool KP.

[0069] Selected after taking the mold As the base key assigned to the device, i.e. This ensures that the same device or devices with related characteristics can obtain a relatively stable basic key within a certain period and complete the adaptation and allocation.

[0070] The implementation process of the national cryptographic algorithm for data exchange is as follows:

[0071] Based on the allocated distribution key The SM4 algorithm is used for encrypted data transmission, and the SM2 algorithm is used for key exchange. The newly generated temporary key is encrypted using the SM2 public key. Then they exchange encrypted temporary key ciphertexts. After both parties decrypt the ciphertexts, they obtain a new shared key Knew, which is used for subsequent data encryption.

[0072] The implementation process of the exception-triggered update mechanism is as follows:

[0073] Real-time monitoring of device operating status (such as abnormal network traffic, abnormal login frequency, abnormal device physical environment, etc.), and triggering key update when an abnormal event is detected;

[0074] Let the anomaly detection function be... E represents an abnormal event, when If the output is true (i.e., it is determined to be abnormal), the key update process is initiated;

[0075] Specifically, abnormal events E include: abnormal network traffic (such as traffic exceeding normal thresholds) and unauthorized physical contact with equipment (physical intrusion signals monitored via TPM).

[0076] When an update is triggered, the edge node forces a key reallocation from the key pool and triggers the exchange of national cryptographic algorithms between the device and the edge node to generate a new dynamic security key. At the same time, update the device's local key storage to ensure that subsequent data encryption uses the latest security key, expressed as: when D(E)=True ( (output is true) ;

[0077] in For the reassigned key pool key, For the new temporary exchange key, A new key derivation function ensures that the key is updated promptly in case of abnormal situations;

[0078] Combining the above adaptation and allocation, algorithm exchange, and anomaly update processes, the final output is a dynamic security key. ;

[0079] Specifically, dynamic security keys The software updates in real time, and is linked to the device's operating status and network environment. The generation process is as follows:

[0080] , where g is a composite function for matching and allocation, algorithm exchange, and exception handling operations, and dynamically outputs a secure and reliable key through calls and collaboration between software modules;

[0081] Specifically, the output dynamic security key is a composite key structure, represented as follows:

[0082]

[0083] in: The master key, derived from the optimized initial key by the dynamic management module, is used for the generation and management of subkeys and is stored in the edge node security area (TPM extended storage area). This is a set of multiple session subkeys, with i as the index, covering different types of national cryptographic keys, including:

[0084] SM2 subkeys: exist in the form of public-private key pairs, are used in asymmetric encryption scenarios, are suitable for highly sensitive data blocks, and take advantage of SM2's resistance to quantum attacks and high security features;

[0085] SM4 subkey: A symmetric encryption key, suitable for low-to-medium sensitivity data blocks, relying on the high-efficiency computing advantage of SM4 to ensure encryption efficiency.

[0086] Initial encryption module: Divide the initial data into blocks of fixed size, and fill the last block to obtain the data after block division. Extract data features from the block data through feature evaluation, and build a sensitivity level evaluation model based on the data features to obtain the optimal sensitivity level.

[0087] Let the original data be According to a fixed size Divide the data into blocks based on data type settings (e.g., for text data, set...). The size of the chunk (in bytes; for multimedia data, this can be adjusted to 8192 bytes for image data, 32768 bytes for video data, etc.) determines the chunk size.

[0088] Iterate through the original data and use software string or byte array truncation functions to achieve block division;

[0089] For the last data block, in length less than When padding is performed, the encryption message syntax standard (PKCS#7) is used for padding. The padding value is the number of missing bytes P, represented as: ,in, This represents the last data block, where n is the total number of blocks (data structures such as arrays and lists are indexed starting from 0 by default, so in n data blocks, the index of the last data block is 0). ), This is the actual length of the last data block;

[0090] Extract features for each data block, including content features (such as keywords, data type identifiers, etc.) and metadata features (such as creation time, owner, etc.).

[0091] Specifically, the software uses regular expression matching to extract features, for example, to detect whether a data block contains sensitive keywords (such as "password" or "ID number").

[0092] Define feature extraction function , Represents data blocks, outputs feature sets ,in For the nth feature;

[0093] Constructing a sensitivity assessment model:

[0094] Construct a sensitivity level assessment model (rule-based assessment model) and combine the feature set Mapping to Sensitivity Level (For example, divided into 1-3 levels, with level 1 being the least sensitive and level 3 being the most sensitive), a weighted scoring method is used for each feature. Assign weights (Based on the pre-set sensitivity of features, such as giving higher weight to features containing "ID number" than to features in ordinary text), then calculate the weighted sum: ,in, Indicates the j-th element. Features The sensitivity level is determined by the score (1 for the presence of sensitive keywords, 0 otherwise).

[0095] like (Low);

[0096] like (middle);

[0097] like (high);

[0098] , , The threshold is determined through security testing and data analysis. The software uses conditional statements to classify the levels, providing a basis for subsequent optimization of encryption strategies.

[0099] Specifically, by constructing a rule-based evaluation model, the sensitivity to fuzziness is transformed into a computable numerical value (Score) and a grade. This provides an objective basis for data protection strategies and offers accurate control guidelines for subsequent dynamic hybrid encryption modules.

[0100] Dynamic hybrid encryption module: Based on data blocks with different optimal sensitivity levels, it calls different types of subkeys in the dynamic security key and attaches encryption data to obtain the best encryption scheme that adapts to different data blocks;

[0101] Based on dynamic security keys For the k-th data block Let the sensitivity level of the k-th data block be... The subkey invocation and encryption execution involve the following steps:

[0102] For data blocks with a sensitivity level of 2 or less, use SM4 subkey encryption:

[0103] Traversal subkey set Filter the number of SM4 subkeys that best match the strategy length for the k-th data block. If the data block length is less than the SM4 block length (128 bits), it is automatically padded with PKCS#7 and the ciphertext is output. ;

[0104] Specifically, for low / medium sensitivity data (level ≤ 2), SM4 symmetric encryption is used, and subkeys in the dynamic key pool are used for fast processing. This design is based on two criteria:

[0105] Symmetric encryption algorithms (such as SM4) are more than 100 times faster than symmetric algorithms in encryption and decryption, making them suitable for processing large amounts of non-core data. The dynamic key mechanism ensures that even if a key is leaked in a single session, it will not affect the security of other data blocks. When a data block is less than 128 bits, PKCS#7 padding is used to ensure that the encryption algorithm can be executed normally. The padding rules clearly indicate the number of missing bytes, making it easy to accurately remove padding during decryption.

[0106] For data blocks with a sensitivity level greater than 2, use SM2 subkey encryption:

[0107] To avoid master key Exposure, using Using a seed and a device random number r, a temporary public-private key pair is derived using the SM2 key generation algorithm. ;

[0108] Use temporary public key For data blocks Perform SM2 encryption and output ciphertext: ,in, To encrypt data, This is the SM3 hash verification value;

[0109] Specifically, highly sensitive data (Level 3) uses SM2 asymmetric encryption, achieving a higher level of protection through temporary key pairs. Its logical rigor is reflected in the fact that each encryption generates a new public-private key pair, so even if an attacker obtains historical data, they cannot deduce future keys. Furthermore, the master key participates in key generation as a seed, ensuring that the temporary key forms a trust chain with the device security module (such as TPM), and an SM3 hash value is added. This forms a two-factor validation mechanism that protects both data confidentiality and integrity.

[0110] Add cryptographic data to the encrypted ciphertext Used for decryption and reverse derivation: ,in, To mark the encryption algorithm (SM2 / SM4) and guide the selection of decryption methods, To record the subkey in The index in the middle is used for precise retrieval. Used to record encryption modes and ensure consistent decryption. Sensitive level, used for permission verification;

[0111] Specifically, encrypted metadata In The (encryption algorithm type) indicates whether the decryption party uses the SM2 or SM4 algorithm. (Subkey Index) Precisely locates dynamic security keys The corresponding subkey in the file. (Encryption mode) ensures that the decryption process is consistent with the encryption process, avoids decryption failure due to unclear parameters, and improves decryption accuracy;

[0112] The final output is a combination of ciphertext and metadata: ,in, To output ciphertext including and ;

[0113] Specifically, the final output ciphertext-metadata combination is the best encryption scheme, which extends ciphertext security protection beyond the encryption stage to decryption permission control. At the same time, the metadata integrates key encryption parameters, eliminating the need to store encryption configuration information separately. In a multi-device environment, devices can quickly decrypt the ciphertext based on the metadata after receiving it, improving the overall management and operating efficiency of the system.

[0114] In the application, several formulas are calculated by removing dimensions and taking their numerical values. The formulas are established by collecting a large amount of data and simulating the most recent real situation. Some coefficients or weights in the formulas are set by those skilled in the art according to the actual situation, so they will not be elaborated here.

[0115] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented in software, the above embodiments can be implemented, in whole or in part, as a computer program product. Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution.

[0116] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A multi-device key-binding data encryption and storage system based on national cryptographic algorithms, characterized in that, include: Initialization module: Based on TPM, generate device identifier and obtain device feature vector through TLS registration. Based on device feature vector, generate initial key through key derivation function. Encrypt initial key through SM2, decrypt it with corresponding private key, and output optimized initial key. The device identifier is generated by calling TPM interface functions and utilizing the key generation and identifier creation mechanism within TPM. ; The device feature vector is used to establish a TLS connection. The device software calls the TLS library to initiate a handshake process and sends its own feature vector to the server. After verifying its legitimacy, the server proceeds via... Generate device feature vectors ; Dynamic management module: Based on the optimized initial key, it performs adaptive allocation and exchange of national cryptographic algorithms through the edge node key pool, and outputs dynamic security keys through an abnormal trigger update mechanism; The process of edge node key pool adaptation and allocation is as follows: Build a key pool at the edge node This will optimize the initial key. The data is sent to the edge nodes, which then distribute it according to the allocation key adapted from the key pool KP. A hash mapping strategy is adopted to obtain an optimized initial key hash value, and the key corresponding to the device is obtained by taking the modulo of the key pool capacity m based on the optimized initial key hash value. The process of implementing the national cryptographic algorithm exchange is as follows: Based on the allocated distribution key The SM4 algorithm is used for data encryption transmission, and the SM2 algorithm is used for key exchange. The newly generated temporary key is encrypted using the SM2 public key, and then the encrypted temporary key ciphertext is exchanged. After both parties decrypt it, they obtain the shared new key. The abnormal trigger update mechanism is implemented as follows: Monitor the operating status of the equipment and trigger a key update when an abnormal event is detected; When an update is triggered, the edge node forces a key reallocation from the key pool and triggers the exchange of national cryptographic algorithms between the device and the edge node to generate a new dynamic security key. At the same time, update the device's local key storage; Initial encryption module: Divides the initial data into blocks of fixed size, and fills the last block to obtain the data after block division. Extracts data features from the data after block division, including content features and metadata features. Based on the data features, a sensitivity level assessment model is constructed to obtain the optimal sensitivity level. Dynamic hybrid encryption module: Based on data blocks with different optimal sensitivity levels, it calls different types of subkeys in the dynamic security key and attaches encryption data to obtain the best encryption scheme adapted to different data blocks.

2. The multi-device key-binding data encryption and storage system based on the national cryptographic algorithm according to claim 1, characterized in that, The process of optimizing the initial key is as follows: Based on the acquired device feature vector The initial key is generated through the key derivation function. ; The initial key is prepared using the national cryptographic SM2 algorithm. Encryption is performed by integrating the SM2 algorithm library, calling encryption functions to generate an SM2 public-private key pair, and decrypting the initial key using the private key from the public-private key pair. .

3. The multi-device key-binding data encryption and storage system based on national cryptographic algorithms according to claim 1, characterized in that, The dynamic security key is a composite key structure, represented as follows: ； in: The master key is derived from the optimized initial key by the dynamic management module. This is a set of multiple session subkeys, including SM2 subkeys and SM4 subkeys, where i is the index.

4. A multi-device key-binding data encryption and storage system based on national cryptographic algorithms according to claim 3, characterized in that, The process of implementing the data after it is divided into blocks is as follows: The original data is divided into blocks of a fixed size. When the last data block is less than the fixed size, it is padded with the number of missing bytes using the encrypted message syntax standard.

5. In the multi-device key-binding data encryption storage system based on national cryptographic algorithms according to claim 4, the process of constructing the sensitivity level assessment model is as follows: feature set Mapping to sensitivity levels 1-3, a weighted scoring method is used to assign weights to each feature and calculate the weighted sum. Sensitivity levels are determined based on the weighted sum of the values: ； ； ； in, For a pre-set threshold, It is classified as sensitive.

6. In the multi-device key-binding data encryption storage system based on national cryptographic algorithms according to claim 5, the process of obtaining the optimal encryption scheme adapted to different data blocks is as follows: For data blocks with a sensitivity level of 2 or less, SM4 subkey encryption is used; for data blocks with a sensitivity level greater than 2, SM2 subkey encryption is used; and ciphertext data is appended to the encrypted ciphertext to obtain the best encryption scheme.

Images