Data encryption method and device, encrypted data decryption method and device, equipment, storage medium and computer program product

Abstract

The invention provides a data encryption method and device, an encrypted data decryption method and device, equipment, a storage medium and a computer program product. Relates to the technical field of Internet of Vehicles. The method comprises the following steps: acquiring to-be-processed data, and dividing the to-be-processed data into a plurality of pieces of first sub-data; respectively converting the plurality of first sub-data into a plurality of second sub-data; and for the plurality of second sub-data, performing the following processing in parallel: dividing the second sub-data into a plurality of data blocks according to a preset data block length, and performing serial encryption processing based on the plurality of data blocks to obtain encrypted sub-data of the second sub-data, the encryption processing of the data blocks ranked later depends on the encryption result of the data blocks ranked front; and combining the encrypted sub-data corresponding to the plurality of pieces of second sub-data into encrypted data. According to the method and the device, the encryption and decryption efficiency can be improved on the basis of ensuring the security of the data.

Description

Technical Field

[0001] The present application relates to the field of vehicle networking technology, and in particular to a data encryption method, an encrypted data decryption method, an apparatus, a device, a storage medium, and a computer program product. Background Art

[0002] With the popularization of sensor technology in geographic information systems, a large number of location-based services and massive amounts of data have emerged. Since the data contains sensitive user information such as addresses, personal hobbies, etc., encryption and decryption processing is required during the transmission and storage of data to improve data security.

[0003] Related technologies encrypt data through methods such as geo-hashing, asymmetric encryption, and Cipher Block Chaining (CBC). The geo-hashing method is a method of converting geographic coordinates (longitude and latitude) into string representation. The accuracy of geo-hashing depends on the length of the string: the longer the string, the higher the accuracy. Asymmetric encryption methods have high computational complexity when facing high-precision data, and the encryption and decryption speeds are slow. CBC encryption has a chain structure and performs serial encryption. Directly using the CBC encryption algorithm for encryption is less efficient. Summary of the Invention

[0004] The embodiments of the present application provide a data encryption method, a decryption method for encrypted data, an apparatus, a device, a storage medium, and a computer program product, which can improve the efficiency of encryption and decryption while ensuring the security of data.

[0005] The technical solution of the embodiment of the present application is implemented as follows:

[0006] This embodiment of the present application provides a data encryption method, the method comprising:

[0007] Acquire data to be processed, and divide the data to be processed into a plurality of first sub-data, wherein the first sub-data are recorded based on a first coordinate system;

[0008] Converting the plurality of first sub-data into a plurality of second sub-data respectively, wherein the second sub-data are recorded based on a second coordinate system, which is a preset reference coordinate system;

[0009] The following processing is performed in parallel on the plurality of second sub-data:

[0010] Divide the second sub-data into a plurality of data blocks according to a preset data block length, and

[0011] Performing serial encryption processing on the plurality of data blocks to obtain encrypted sub-data of the second sub-data, wherein the encryption processing of the data blocks in a later order depends on the encryption result of the data blocks in a previous order;

[0012] The encrypted sub-data respectively corresponding to the plurality of second sub-data are combined into encrypted data.

[0013] In the above scheme, the method also includes: using the preset data as a sensitive parameter; requesting the key management server to generate a master key, so that the key management server encrypts the sensitive parameter based on the master key and generates a ciphertext certificate file for decrypting the encrypted sub-data.

[0014] In the above solution, the data to be processed includes a plurality of sampling point data. Before dividing the data to be processed into a plurality of first sub-data, the method further includes:

[0015] The following processing is iteratively performed on the data to be processed:

[0016] Using a connecting line between a first sampling point and a last sampling point in the data to be processed as a baseline, obtaining a distance from an intermediate point to the baseline, and using the largest distance as a baseline distance, wherein the intermediate point is a sampling point in the data to be processed other than the first sampling point and the last sampling point;

[0017] In the data to be processed, sampling points corresponding to the reference distance that are smaller than a preset sampling point denoising threshold are screened out;

[0018] Determine a boundary sampling point in the data to be processed, wherein the boundary sampling point is a sampling point corresponding to the reference distance greater than the sampling point denoising threshold, divide the boundary sampling point and the sampling point data before it into first data to be processed, divide the boundary sampling point and the sampling point after it into second data to be processed, and use the first data to be processed and the second data to be processed as new data to be processed.

[0019] In the above solution, before dividing the data to be processed into a plurality of first sub-data, the method further includes:

[0020] Perform any of the following processing on the data to be processed:

[0021] Obtaining a time interval between any two adjacent sampling points in the data to be processed, and in response to the time interval being greater than a preset time interval threshold, performing interpolation processing between the adjacent sampling points to obtain at least one new sampling point between the adjacent sampling points;

[0022] Obtaining a distance interval between any two adjacent sampling points in the data to be processed, and in response to the distance interval being greater than a preset distance interval threshold, performing interpolation processing between the adjacent sampling points to obtain at least one new sampling point between the adjacent sampling points;

[0023] A state change value between any two adjacent sampling points in the data to be processed is obtained, and in response to the state change value being greater than a preset state change threshold, interpolation processing is performed between the adjacent sampling points to obtain at least one new sampling point between the adjacent sampling points.

[0024] This embodiment of the present application provides a method for decrypting encrypted data, the method comprising:

[0025] Acquire encrypted data, wherein the encrypted data includes a plurality of encrypted sub-data, and the plurality of encrypted sub-data are obtained by encrypting a plurality of first sub-data respectively;

[0026] The following processing is performed in parallel on the plurality of encrypted sub-data:

[0027] Dividing the encrypted sub-data into a plurality of encrypted data blocks according to a preset data block length, and

[0028] Performing serial decryption processing on the plurality of encrypted data blocks to obtain a plurality of second sub-data corresponding to the plurality of encrypted data blocks, wherein the decryption processing of the encrypted data blocks arranged later depends on the decryption result of the encrypted data blocks arranged earlier;

[0029] converting the plurality of second sub-data into the plurality of first sub-data respectively;

[0030] The plurality of first sub-data respectively corresponding to the plurality of encrypted sub-data are combined into decrypted data.

[0031] In the above solution, before performing coordinate system conversion processing on the second coordinate of each sampling point to obtain the first coordinate of each sampling point based on the first coordinate system, the method further includes:

[0032] Obtaining a random number corresponding to the second sub-data, wherein different second sub-data correspond to different random numbers;

[0033] The second coordinate of each sampling point in the second sub-data is subjected to inverse offset processing according to the random number to form an updated second coordinate.

[0034] In the above solution, the serial decryption processing based on the multiple encrypted data blocks to obtain multiple second sub-data corresponding to the multiple encrypted data blocks respectively includes:

[0035] The plurality of encrypted data blocks are traversed in order from the first encrypted data block to the last encrypted data block, and the traversed encrypted data blocks are used as encrypted data blocks to be processed, so as to iteratively perform the following processing:

[0036] Decrypting the encrypted data block to be processed to obtain a logical operation result of the encrypted data block to be processed, and

[0037] Performing a logical operation on the result of the logical operation of the encrypted data block to be processed and reference data of the encrypted data block to be processed to obtain a data block in plaintext form corresponding to the encrypted data block to be processed, wherein when the encrypted data block to be processed is the first encrypted data block, the reference data is preset data; and when the encrypted data block to be processed is an encrypted data block subsequent to the first encrypted data block, the reference data is an encrypted data block next to the encrypted data block to be processed;

[0038] The plurality of data blocks respectively corresponding to the plurality of encrypted data blocks are combined into the second sub-data in the order.

[0039] In the above scheme, the logical operation is any one of an AND operation, an OR operation, an XNOR operation and an XOR operation; the decryption method of the decryption processing satisfies the following conditions: the logical operation result obtained by applying the decryption method to the encrypted data block to be processed is equivalent to the result obtained after performing the logical operation on the plaintext data, and the plaintext data is obtained by applying the decryption method to the encrypted data block to be processed.

[0040] In the above scheme, the method also includes: sending an interface call request to the key management server, so that the key management server decrypts the ciphertext certificate file based on the pre-generated master key to obtain a plaintext certificate file; receiving the plaintext certificate file sent by the key management server, and reading sensitive parameters used to decrypt the encrypted data from the plaintext certificate file, wherein the sensitive parameters include the mapping table and the random number.

[0041] The present invention provides a data encryption device, comprising:

[0042] a data acquisition module, configured to acquire data to be processed and divide the data to be processed into a plurality of first sub-data, wherein the first sub-data are recorded based on a first coordinate system;

[0043] an encryption module, configured to convert the plurality of first sub-data into a plurality of second sub-data, wherein the second sub-data are recorded based on a second coordinate system, which is a preset reference coordinate system;

[0044] The encryption module is further configured to perform the following processing in parallel on the plurality of second sub-data:

[0045] Divide the second sub-data into a plurality of data blocks according to a preset data block length, and

[0046] Serial encryption processing is performed based on the multiple data blocks to obtain encrypted sub-data of the second sub-data, wherein the encryption processing of the data blocks sorted later depends on the encryption results of the data blocks sorted earlier; and the encrypted sub-data corresponding to the multiple second sub-data are combined into encrypted data.

[0047] The present invention provides a method for decrypting encrypted data, including:

[0048] A data acquisition module, configured to acquire encrypted data, wherein the encrypted data includes a plurality of encrypted sub-data, and the plurality of encrypted sub-data are obtained by encrypting a plurality of first sub-data respectively;

[0049] The decryption module is configured to perform the following processing in parallel on the plurality of encrypted sub-data:

[0050] Dividing the encrypted sub-data into a plurality of encrypted data blocks according to a preset data block length, and

[0051] Performing serial decryption processing on the plurality of encrypted data blocks to obtain a plurality of second sub-data corresponding to the plurality of encrypted data blocks, wherein the decryption processing of the encrypted data blocks arranged later depends on the decryption result of the encrypted data blocks arranged earlier;

[0052] The decryption module is further configured to convert the plurality of second sub-data into the plurality of first sub-data respectively;

[0053] The decryption module is further configured to combine the plurality of first sub-data corresponding to the plurality of encrypted data into decrypted data.

[0054] An embodiment of the present application provides an electronic device, comprising:

[0055] a memory for storing computer-executable instructions;

[0056] The processor is used to implement the data encryption method or the encrypted data decryption method provided in the embodiment of the present application when executing the computer-executable instructions stored in the memory.

[0057] An embodiment of the present application provides a computer-readable storage medium storing a computer program or computer-executable instructions, which, when executed by a processor, implements the data encryption method or encrypted data decryption method provided in the embodiment of the present application.

[0058] An embodiment of the present application provides a computer program product, including a computer program or computer-executable instructions. When the computer program or computer-executable instructions are executed by a processor, the data encryption method or encrypted data decryption method provided in the embodiment of the present application is implemented.

[0059] The embodiments of the present application have the following beneficial effects:

[0060] After the data to be processed is divided into multiple first sub-data, the first sub-data based on the first coordinate system are uniformly converted into second sub-data based on the second coordinate system, thereby realizing the unification of the sub-data; by encrypting the multiple second sub-data in parallel, and the encryption in each second sub-data is realized based on the serial implementation of the data blocks in the second sub-data, since the serial encryption processing of each second sub-data is independent of each other, this independent feature makes the encryption of each second sub-data have no dependency relationship, thereby improving the encryption efficiency; the encryption of the data blocks in the second sub-data is dependent on each other, which increases the difficulty of cracking the encryption, so while improving the data encryption efficiency, it also ensures the reliability of the data encryption. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1A This is a schematic diagram of the structure of the data processing system architecture provided by the embodiment of the present application;

[0062] Figure 1B 1 is a schematic diagram of the structure of the server 100 provided in an embodiment of the present application;

[0063] Figure 2A 1 is a schematic diagram of the structure of a data encryption server 100-1 provided in an embodiment of the present application;

[0064] Figure 2B This is a structural diagram of a decryption server 100-2 for encrypting data provided by the present application;

[0065] Figure 3A This is a first flow chart of the data encryption method provided in an embodiment of the present application;

[0066] Figure 3B This is a second flow chart of the data encryption method provided in an embodiment of the present application;

[0067] Figure 3C This is a third flow chart of the data encryption method provided in an embodiment of the present application;

[0068] Figure 3D This is a fourth flow chart of the data encryption method provided in an embodiment of the present application;

[0069] Figure 3EThis is a fifth flow chart of the data encryption method provided in an embodiment of the present application;

[0070] Figure 3F This is a sixth flow chart of the data encryption method provided in an embodiment of the present application;

[0071] Figure 3G This is a seventh flow chart of the data encryption method provided in an embodiment of the present application;

[0072] Figure 3H This is an eighth flow chart of the data encryption method provided in an embodiment of the present application;

[0073] Figure 4A This is a schematic diagram of a first flow chart of a method for decrypting encrypted data provided in an embodiment of the present application;

[0074] Figure 4B This is a second flow chart of the method for decrypting encrypted data provided by an embodiment of the present application;

[0075] Figure 4C 3 is a schematic diagram of a third flow chart of a method for decrypting encrypted data provided in an embodiment of the present application;

[0076] Figure 4D This is a fourth flow chart of the method for decrypting encrypted data provided in an embodiment of the present application;

[0077] Figure 5 Schematic diagram of the principle of the trajectory data encryption method provided in an embodiment of the present application;

[0078] Figure 6 This is a flowchart illustrating the application of the data encryption method and the encrypted data decryption method provided in the embodiment of the present application in a location service scenario;

[0079] Figure 7 It is a schematic diagram of the principle of the trajectory processing system architecture provided by the embodiment of the present application;

[0080] Figure 8 This is a schematic diagram of an exemplary structure of an encryption and decryption server provided in an embodiment of the present application;

[0081] Figure 9 Schematic diagram of trajectory data provided by an embodiment of the present application.

[0082] It should be pointed out that the above-mentioned "first" and "second" are only used to distinguish different solutions, and do not represent the degree of distinction between the advantages and disadvantages of the solutions or the priority in the implementation process. DETAILED DESCRIPTION

[0083] In order to make the purpose, technical solutions and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. The described embodiments should not be regarded as limiting this application. All other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0084] In the following description, reference is made to “some embodiments”, which describes a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0085] In the following description, the terms "first\second\third" involved are merely used to distinguish similar objects and do not represent a specific ordering of the objects. It can be understood that "first\second\third" can be interchanged with a specific order or sequence where permitted, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein.

[0086] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program that has a predetermined function and works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as processing circuits or memories) or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be part of an overall module or unit that includes the function of the module or unit.

[0087] Unless otherwise defined, all technical and scientific terms used in the embodiments of the present application have the same meanings as those commonly understood by those skilled in the art. The terms used in the embodiments of the present application are only for the purpose of describing the embodiments of the present application and are not intended to limit the present application.

[0088] The relevant data collection and processing in the embodiments of this application should be strictly in accordance with the requirements of relevant national laws and regulations when applied in examples, and the informed consent or separate consent of the personal information subject should be obtained. Subsequent data use and processing should be carried out within the scope of authorization of laws and regulations and the personal information subject.

[0089] Before further explaining the embodiments of the present application in detail, the nouns and terms involved in the embodiments of the present application are explained. The nouns and terms involved in the embodiments of the present application are subject to the following interpretations.

[0090] 1) Sub-data: For a data collection task, data is collected by one or more data collection devices (such as mobile terminals or road test collection vehicles). Each data collection device collects a fragment of the complete data, namely sub-data. When the data collection task is completed by multiple data collection devices, the sub-data collected by multiple data collection devices constitute the complete data.

[0091] 2) The first coordinate system: This is the coordinate system used by the data acquisition device when collecting sampling points. Different data acquisition devices can use the same or different first coordinate systems. For example, the local coordinate system (local coordinate system) used by devices such as inertial navigation systems and gyroscopes describes the position of an object at or around a reference point. The World Geodetic System-1984 Coordinate System (WGS84) is used by devices such as the Global Positioning System (GPS).

[0092] 3) The second coordinate system, also called the reference coordinate system, is a coordinate system used uniformly to uniformly process sub-data collected by different data collection devices. For example, it can be a Mercator coordinate system (such as the WGS84 Web Mercator coordinate system).

[0093] 4) Sampling points, which are used to represent the location information of an object in space. Each sampling point can contain location information (such as longitude and latitude) and other related information (such as timestamp, speed, acceleration, direction, etc.).

[0094] Related technologies encrypt data using methods such as geohashing, asymmetric encryption, and Cipher Block Chaining (CBC). Geohashing converts geographic coordinates (latitude and longitude) into a string representation. The accuracy of geohashing depends on the length of the string: the longer the string, the higher the accuracy. Asymmetric encryption has high computational complexity and slow encryption and decryption speeds when dealing with high-precision data. CBC encryption uses a chained structure and performs serial encryption, making it inefficient when directly using the CBC encryption algorithm. Therefore, these data encryption methods cannot improve encryption and decryption efficiency while ensuring data security when dealing with high-precision data.

[0095] To address the above-mentioned issues, embodiments of the present application provide a data encryption method, encrypted data decryption method, apparatus, device, computer-readable storage medium, and computer program product. These methods can improve the efficiency of data encryption while further enhancing the reliability of data encryption, and can improve the efficiency of encrypted data decryption while further enhancing the reliability of decrypted data.

[0096] The following describes exemplary applications of the devices provided in the embodiments of this application. The electronic devices provided in the embodiments of this application can be implemented as various types of terminals, such as laptops, tablet computers, desktop computers, set-top boxes, smartphones, smart speakers, smart watches, smart TVs, and in-vehicle terminals. They can also be implemented as servers. The following describes exemplary applications of the electronic device implemented as a server.

[0097] See also Figure 1A , Figure 1A This is a schematic diagram of the data processing system architecture provided by the embodiment of the present application, for example, Figure 1A The server 100, the collection device 200, the third-party device 400 and the network 300 are involved. The collection device 200 and the third-party device 400 are connected to the server 100 via the network 300, wherein the network 300 can be a wide area network or a local area network, or a combination of the two.

[0098] In some embodiments, the data processing system provided by the embodiments of the present application can be implemented collaboratively by a server, a collection device (such as a mobile terminal, a high-precision trajectory collection vehicle, and other data collection devices) and a third-party device (such as a terminal device or a server, such as a smart phone). For example, the collection device 200 (i.e., the data collection device) collects the data to be processed and sends the data to be processed to the server 100 through a secure communication protocol (such as Hypertext Transfer Protocol Secure (HTTPS)) to ensure the security of data transmission. The server 100 encrypts the data to be processed using the data encryption method provided by the embodiments of the present application to obtain encrypted data. The server stores the encrypted data and responds to a data access request sent by the third-party device to the server 100 (such as a logistics and transportation company needs to analyze vehicle data). The data access request includes a data access permission. The server 100 decrypts the encrypted data using the encrypted data decryption method provided by the embodiments of the present application to obtain decrypted data and sends it to the third-party device 400.

[0099] In other embodiments, in scenarios where location services require the acquisition of data to be processed (such as trajectory data), the data acquisition device 200 can be a terminal device such as a smart phone. The acquisition device 200 acquires data to be processed (for example, location information is acquired through positioning devices such as GPS), encrypts the data to be processed through the data encryption method provided in the embodiment of the present application, obtains encrypted data, and sends the encrypted data to the server 100. In response to the location service acquisition request of the acquisition device 200, the server 100 decrypts the encrypted data through the encrypted data decryption method provided in the embodiment of the present application to obtain decrypted data, and performs location service processing (for example, generating a navigation route, etc.) through the decrypted data to obtain a location service result. The server 100 encrypts the location service result, for example, through a symmetric encryption algorithm (Advanced Encryption Standard, AES), obtains a location service encryption result, and sends the location service encryption result to the acquisition device 200. After receiving the location encryption result, the acquisition device 200 decrypts it (for example, through AES decryption) to obtain the decrypted location service result, and displays it through the acquisition device 200 to provide route navigation services to the user.

[0100] In some embodiments, the terminal device or server can implement the encryption method of data or the decryption method of encrypted data provided in the embodiments of the present application by running various computer executable instructions or computer programs. For example, the computer executable instructions can be commands, machine instructions or software instructions at the microprogram level. The computer program can be a native program or software module in the operating system. In short, the above-mentioned computer executable instructions can be instructions in any form, and the above-mentioned computer program can be an application, module or plug-in in any form. The terminal devices include but are not limited to mobile phones, computers, intelligent voice interaction devices, smart home appliances, vehicle-mounted terminals, aircraft, etc.

[0101] In some embodiments, multiple servers may form a blockchain network, with server 100 being a node on the blockchain network. Information connections may exist between each node in the blockchain network, and information may be transmitted between nodes via the aforementioned information connections. Data related to the data encryption method or encrypted data decryption method provided in the embodiments of the present application may be stored on the blockchain.

[0102] In some embodiments, the server 100 may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It may also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms. The terminal and the server may be connected directly or indirectly via wired or wireless communication, which is not limited in the embodiments of the present application.

[0103] The embodiments of the present application can be implemented with the help of artificial intelligence (AI) technology. Artificial intelligence is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to achieve the best results. In other words, artificial intelligence is a comprehensive technology in computer science that attempts to understand the essence of intelligence and produce a new type of intelligent machine that can respond in a similar way to human intelligence. Artificial intelligence is to study the design principles and implementation methods of various intelligent machines, so that machines have the functions of perception, reasoning and decision-making.

[0104] Artificial intelligence (AI) technology is a comprehensive discipline encompassing a wide range of fields, encompassing both hardware and software technologies. Foundational AI technologies generally include sensors, specialized AI chips, cloud computing, distributed storage, big data processing, pre-trained models, operating / interaction systems, and mechatronics. Pre-trained models, also known as large models or basic models, can be fine-tuned and widely applied to downstream tasks across various AI disciplines. AI software technologies primarily encompass computer vision, speech processing, natural language processing, and machine learning / deep learning.

[0105] See also Figure 1B , Figure 1BThis is a schematic diagram of the structure of the server 100 provided in an embodiment of the present application. The server 100 includes an encryption server 100-1, a decryption server 100-2 and a key management server 100-3, wherein the encryption server 100-1 is used to enable the server 100 to implement the data encryption method provided in the embodiment of the present application, encrypt the data to be processed, and obtain encrypted data; the decryption server 100-2 is used to enable the server 100 to implement the decryption method of encrypted data provided in the embodiment of the present application, decrypt the encrypted data, and obtain the decrypted original data to be processed (corresponding to the decrypted data above); the key management server 100-3 is used to encrypt and manage sensitive parameters such as mapping tables, initial vectors, random numbers, etc. used in the encryption processing server to improve the security of encrypted data. Sensitive parameters can be encrypted and decrypted through the application programming interface (API) of the key management server 100-1, and the ciphertext file of the sensitive parameters is saved locally after encryption. When used, the decryption server 100-2 decrypts the ciphertext file and does not save it locally, making it difficult for unauthorized persons to obtain it, thereby further improving data security.

[0106] See also Figure 2A , Figure 2A 1 is a schematic diagram of the structure of a data encryption server 100-1 provided in an embodiment of the present application. Figure 2A The encryption server 100-1 shown includes: at least one processor 110-1, a memory 130-1, and at least one network interface 120-1. The various components in the encryption server 100-1 are coupled together via a bus system 140-1. It is understood that the bus system 140-1 is used to achieve connection and communication between these components. In addition to including a data bus, the bus system 140-1 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, the bus system 140-1 is not described in detail. Figure 2A In FIG. 1 , various buses are labeled as bus system 140 - 1 .

[0107] Processor 110-1 can be an integrated circuit chip with signal processing capabilities, such as a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc., where the general-purpose processor can be a microprocessor or any conventional processor, etc.

[0108] Memory 130-1 may be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid-state memory, hard drives, optical drives, etc. Memory 130-1 may optionally include one or more storage devices physically located remotely from processor 110-1.

[0109] The memory 130-1 includes volatile memory or nonvolatile memory, or may include both volatile and nonvolatile memory. The nonvolatile memory may be a read-only memory (ROM), and the volatile memory may be a random access memory (RAM). The memory 130-1 described in the embodiments of the present application is intended to include any suitable type of memory.

[0110] In some embodiments, the memory 130 - 1 can store data to support various operations, examples of which include programs, modules, and data structures, or a subset or superset thereof, as exemplified below.

[0111] Operating system 131-1, including system programs for processing various basic system services and performing hardware-related tasks, such as the framework layer, core library layer, and driver layer, which are used to implement various basic services and process hardware-based tasks;

[0112] A network communication module 132-1, configured to communicate with other electronic devices via one or more (wired or wireless) network interfaces 120-1. Exemplary network interfaces 120-1 include Bluetooth, Wi-Fi, and USB.

[0113] In some embodiments, the apparatus provided in the embodiments of the present application may be implemented in software. Figure 2A The device 133 for encrypting data stored in the memory 130-1 is shown. This device 133 may be software in the form of a program or plug-in, and includes the following software modules: a data acquisition module 1331 and an encryption module 1332. These modules are logical and can be arbitrarily combined or further separated depending on the functions they implement. The functions of each module will be described below.

[0114] See also Figure 2B , Figure 2B 1 is a schematic diagram of the structure of a decryption server 100-2 for encrypting data provided in an embodiment of the present application. Figure 2B The decryption server 100-2 shown includes: at least one processor 110-2, a memory 130-2, and at least one network interface 120-2. The various components in the decryption server 100-2 are coupled together via a bus system 140-2. It is understood that the bus system 140-2 is used to achieve connection and communication between these components. In addition to including a data bus, the bus system 140-2 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, the bus system 140-2 is not described in detail. Figure 2BIn the figure, various buses are labeled as bus system 140-2. The detailed description of processor 110-2 and memory 130-2 is as above and will not be repeated here.

[0115] In some embodiments, the apparatus provided in the embodiments of the present application may be implemented in software. Figure 2B The decryption device 134 for encrypted data stored in the memory 130-2 is shown. This device can be software in the form of a program or plug-in, and includes the following software modules: a data acquisition module 1341 and a decryption module 1342. These modules are logical and can be arbitrarily combined or further separated according to the functions they implement. The functions of each module will be described below.

[0116] In other embodiments, the apparatus provided in the embodiments of the present application may be implemented in hardware. As an example, the apparatus provided in the embodiments of the present application may be a processor in the form of a hardware decoding processor, which is programmed to execute the data encryption method and the encrypted data decryption method provided in the embodiments of the present application. For example, the processor in the form of a hardware decoding processor may be one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), or other electronic components.

[0117] The following will describe the data encryption method provided by the embodiment of the present application in conjunction with the exemplary application and implementation of the server provided by the embodiment of the present application. Figure 3A , Figure 3A This is a first flow chart of the data encryption method provided in the embodiment of the present application, which will be combined with Figure 3A The steps shown are explained.

[0118] In step 101 , data to be processed is acquired and divided into a plurality of first sub-data, wherein the first sub-data is recorded based on a first coordinate system.

[0119] Taking the data to be processed as trajectory data as an example, the trajectory data is acquired and divided into a plurality of first trajectory segment data (corresponding to the first sub-data mentioned above), wherein the first trajectory segment data is recorded based on the first coordinate system.

[0120] In some embodiments, see Figure 9 , Figure 9 This is a schematic diagram of the trajectory data provided in an embodiment of the present application. The trajectory data may include a starting point and an end point. The trajectory data includes multiple trajectory points sorted and spliced ​​according to timestamps. The trajectory points are used to represent the position information of the object in space. Each trajectory point may include position information (such as longitude and latitude) and may also include other relevant information (such as timestamp, speed, acceleration, direction, etc.).

[0121] In some embodiments, the first coordinate system is a coordinate system used by a data acquisition device when acquiring data. For different data acquisition devices, the first coordinate systems used for different first sub-data acquired may be the same or different.

[0122] In some embodiments, the data to be processed is collected by multiple data collection devices, see Figure 3B , Figure 3A The acquisition of the data to be processed in step 101 shown can be achieved through the following steps 1011 to 1014, which are described below.

[0123] In step 1011, mapping processing is performed on the device numbers of multiple data acquisition devices to obtain a hash value of each data acquisition device.

[0124] In some embodiments, the number of each data acquisition device is hash mapped using a preset hash function (eg, Secure Hash Algorithm-256), and a hash value of a fixed length (eg, 256 bits) corresponding to each device number is output.

[0125] In step 1012, the preset number of queues and queue numbers are obtained, and each hash value is subjected to a modulo operation with the number of queues to obtain a queue number corresponding to each data acquisition device.

[0126] In some embodiments, based on business needs, the required number and number of queues (such as Kafka queues, etc.) are determined. For example, the number of queues is determined based on the number of acquisition devices or the data load balancing situation, and each hash value is modulo-operated with the number of queues (i.e., remainder operation) to obtain the queue number corresponding to each data acquisition device (i.e., the queue number corresponding to the remainder obtained by the remainder operation).

[0127] In step 1013, the data collected by the multiple data collection devices are allocated to corresponding queues according to the queue numbers to obtain multiple queues.

[0128] In some embodiments, the data collected by each data acquisition device is sent to the corresponding queue according to the queue number to obtain multiple queues. The queue can be Kafka. For example, there are 3 queues (queue numbers are 0, 1, and 2). There is a data acquisition device numbered "device123". The device number is calculated by the hash function to obtain a hash value of "abcdef123456". Then, the hash value is converted into an integer. Assuming that the converted hash value is "123456789", the modulus of the queue number 3 is taken, and the remainder is 0. Therefore, the data collected by the data acquisition device will be sent to the Kafka queue with queue number 0.

[0129] In step 1014, the data in the multiple queues are sorted according to the timestamps to obtain data to be processed.

[0130] Taking the trajectory data as an example, the trajectory data includes multiple trajectory points (corresponding to the sampling points above), each trajectory point includes information such as timestamp, and the data in multiple queues are sorted according to the timestamp to obtain the complete trajectory data (corresponding to the data to be processed).

[0131] In some embodiments, Figure 3A The step 101 of dividing the data to be processed into a plurality of first sub-data can be achieved by performing any of the following processing on the data to be processed:

[0132] In some embodiments, a preset distance threshold is obtained, and in response to a distance between any two adjacent sampling points in the data to be processed being greater than the distance threshold, division is performed between the any two adjacent sampling points to obtain a plurality of first sub-data;

[0133] In some embodiments, a preset time threshold is obtained, and in response to a time interval between any two adjacent sampling points in the data to be processed being greater than the time threshold, the data is divided between the any two adjacent sampling points to obtain a plurality of first sub-data, wherein the time interval is represented by a timestamp of the sampling points;

[0134] In some embodiments, a preset density threshold is obtained, and the density of the area to which each sampling point in the data to be processed belongs is obtained, and the density corresponding to each sampling point is traversed. In response to the density of the area to which the sampling point belongs being less than the density threshold, the sampling point is used as a segmentation point, and the segmentation point and the previously undivided data to be processed are used as a first sub-data. For example, the data to be processed is represented as [P1, P2, P3, P4, P5], where P1, P2, P3, P4 and P5 represent 5 sampling points respectively. Assuming that only the density of the area to which sampling point P3 belongs is less than the density threshold, P3 is used as a segmentation point, and two first sub-data are obtained by division, which are represented as [P1, P2, P3] and [P4, P5] respectively.

[0135] In some embodiments, the region to which each sampling point in the data to be processed belongs may be a local region centered on the sampling point. Within the local region, the density value of the sampling point is calculated according to a density estimation method, such as a Gaussian kernel density estimation method, a K-nearest neighbor method, etc. After the data to be processed is divided by segmentation points, the initial segmentation results obtained may be further optimized. For example, adjacent first sub-data with lower density may be merged to reduce the number of segments.

[0136] In other embodiments, for a variety of data partitioning schemes to be processed (such as the distance threshold-based partitioning, time threshold-based partitioning, etc. described above), features of multiple first sub-data in each partitioning scheme are obtained through a machine learning model, and the similarity between the multiple first sub-data is calculated. For example, the similarity of each two adjacent segments of first sub-data obtained by the partitioning scheme is obtained (such as Euclidean distance, Manhattan distance, cosine similarity, etc.), and the average of the multiple similarities is taken as the final similarity value corresponding to the partitioning scheme. The partitioning scheme with the smallest similarity is taken, that is, the partitioning scheme with the largest difference between the first sub-data obtained by the partitioning results is adopted, so that the difference between the data is greater, thereby ensuring the difference in the subsequent encryption results of the data to be processed, making the data more irregular, thereby increasing the difficulty of cracking and preventing unauthorized persons from obtaining it.

[0137] Among them, the machine learning model can be trained, for example, by obtaining multiple groups of sub-data and marking the similarity levels of the sub-data, obtaining the feature vectors of the sub-data through a pre-trained convolutional neural network (such as ResNet, VGGNet, etc.), and constructing a machine learning model based on the feature vector and the similarity measurement method such as Euclidean distance mentioned above, such as a support vector machine, random forest or neural network, inputting the feature vector into the model, training the model to predict the similarity, and using the loss function and optimization algorithm to optimize the model parameters, evaluating the trained model, and calculating the performance indicators of the model, such as accuracy, precision, recall rate, etc., and finally tuning the model according to the evaluation results, such as adjusting the model hyperparameters, increasing training data, using regularization methods, etc.

[0138] Continue to see Figure 3A In step 102, the plurality of first sub-data are converted into a plurality of second sub-data respectively, wherein the second sub-data are recorded based on a second coordinate system, which is a preset reference coordinate system.

[0139] Continuing with the above example, taking the first sub-data as the first trajectory segment data as an example, multiple first trajectory segment data are respectively converted into multiple second trajectory segment data (corresponding to the second sub-data), wherein the second trajectory segment data is recorded based on the second coordinate system, and the second coordinate system is a preset reference coordinate system.

[0140] In some embodiments, the first sub-data includes first coordinates (eg, coordinates including longitude and latitude, expressed as (x1, y1)) of a plurality of sampling points based on a first coordinate system (eg, an earth coordinate system, etc.), see Figure 3C , Figure 3A The illustrated step 102 can be implemented by executing the following steps 1021 to 1023 for each of the plurality of first sub-data, which will be described in detail below.

[0141] In step 1021 , coordinate system conversion processing is performed on each sampling point in the first sub-data to obtain a second coordinate of each sampling point based on a second coordinate system.

[0142] In some embodiments, the first coordinates (e.g., longitude and latitude) of each sampling point can be converted into the second coordinates of the second coordinate system (e.g., expressed as (x2, y2)) according to the coordinate system longitude and latitude conversion algorithm. Taking the second coordinate system as the Mercator coordinate system as an example, the coordinate system conversion process is performed using the following formula:

[0143] x2=longitude×20037508.34 / 180 (1)

[0144] Where longitude represents the longitude value, x2 is the coordinate after converting the longitude value to the Mercator projection coordinate system, and 20037508.34 is a constant, which is half of the circumference of the earth in the Mercator projection coordinate system.

[0145] y2=log(tan((90+latitude)×π / 360)) / (π / 180)×20037508.34 / 180 (2)

[0146] Among them, latitude represents the latitude value, and y2 is the coordinate after the latitude value is converted to the Mercator projection coordinate system.

[0147] In step 1022, a preset mapping table is obtained, and coordinate mapping processing is performed on the second coordinate of each sampling point through the mapping table to obtain the third coordinate of each sampling point based on the second coordinate system, wherein in the mapping table, different second coordinates correspond to different third coordinates.

[0148] In some embodiments, a preset mapping table is obtained. Continuing with the above example, the third coordinate can be expressed as (x3, y3), for example. In the mapping table, each integer a within the range of x2 of the second coordinate has one and only one corresponding key value a1 (corresponding to x3), and a1 is any character between AZ and az; each integer b within the range of y2 of the second coordinate has one and only one corresponding key value b1 (corresponding to y3), and b1 is any character between AZ and az; the mapping table can be customized and can be customized according to different business needs.

[0149] In some embodiments, the coordinate system conversion process in step 1021 and the coordinate mapping process in step 1022 can be swapped in order. The embodiment of the present application does not limit the order in which step 1021 and step 1022 are executed.

[0150] In step 1023 , the third coordinates corresponding to the first sub-data are spliced ​​to obtain the second sub-data corresponding to the first sub-data.

[0151] In some embodiments, the third coordinates corresponding to each sampling point in the first sub-data are sequentially concatenated to obtain the second sub-data corresponding to the first sub-data.

[0152] Continue to see Figure 3A In step 103, the following processing is performed in parallel for the plurality of second sub-data:

[0153] The second sub-data is divided into multiple data blocks according to a preset data block length, and serial encryption processing is performed based on the multiple data blocks to obtain encrypted sub-data of the second sub-data, wherein the encryption processing of the data blocks sorted later depends on the encryption results of the data blocks sorted earlier.

[0154] Continuing with the above example, taking the second sub-data as the second trajectory segment data as an example, the following processing is performed in parallel on multiple second trajectory segment data:

[0155] The second track segment data is divided into multiple data blocks according to a preset data block length, and serial encryption processing is performed based on the multiple data blocks to obtain encrypted track segment data of the second track segment data, wherein the encryption processing of the data blocks sorted later depends on the encryption results of the data blocks sorted earlier.

[0156] In some embodiments, the second sub-data is divided into a plurality of data blocks according to a preset data block length (eg, the length of each block is 32 bytes).

[0157] In some embodiments, see Figure 8 , Figure 8This is an exemplary structural diagram of the encryption and decryption server provided in an embodiment of the present application. Since the data to be processed is segmented in the above text (corresponding to dividing the data to be processed into multiple first sub-data in step 101), the encryption processing message of the second sub-data can be distributed through the message queue (that is, the encryption processing of multiple second sub-data is performed in parallel, and one message queue (Partition) can correspond to one second sub-data), and the microservice cluster (such as st ke) respectively opens the thread pool (corresponding to Figure 8 Threads 1 to 4 in the encryption process are used to perform highly parallel encryption processing on multiple second sub-data, significantly improving the encryption processing efficiency, wherein, Figure 8 The multiple application container engines (Docker) shown in the figure can use the sandbox mechanism to form isolated containers and run them, so that the messages received in each message queue do not interfere with each other; locking is used in multi-threaded concurrent operations. In order to avoid data competition and inconsistency, a locking mechanism is required to ensure mutual exclusive access to shared resources; detection and retry refers to detecting and attempting to repeat certain operations multiple times when a system failure or error occurs to ensure that the task can be successfully completed; asynchronous processing refers to allowing certain time-consuming operations to be performed without blocking other operations, thereby improving the concurrency of the system; Structured Query Language (SQL) refers to a standardized language for managing databases, used for storing and managing data, executing queries, updating, and other operations.

[0158] In some embodiments, see Figure 3D , Figure 3A The step 103 shown is to perform serial encryption processing based on multiple data blocks to obtain encrypted sub-data of the second sub-data, which can be achieved by executing the following steps 1031 to 1032, which are described in detail below.

[0159] In step 1031, multiple data blocks are traversed in order from the first data block to the last data block, and the traversed data blocks are used as data blocks to be processed, and the following processing is iteratively performed:

[0160] In some embodiments, a logical operation is performed on the data block to be processed and the reference data of the data block to be processed to obtain the logical operation result of the data block to be processed, and the logical operation result of the data block to be processed is encrypted to obtain an encrypted data block corresponding to the data block to be processed, wherein, when the data block to be processed is the first data block among multiple data blocks, the reference data is preset data (for example, a random vector with the same length as the data block); when the data block to be processed is the data block after the first data block among multiple data blocks, the reference data is the next data block of the data block to be processed.

[0161] As an example, multiple data blocks are represented as [data block 1, data block 2, ..., data block N], and preset data is obtained (for example, a random vector is obtained), and the preset data size is the size of each block (such as 32 bytes), which is used to perform a logical operation (such as an OR operation) with data block 1; the result of the logical operation is encrypted using a selected encryption method (such as homomorphic encryption) (the result is the encrypted data block 1 corresponding to data block 1); then the obtained encrypted data block 1 is logically operated with data block 2; the result of the logical operation is encrypted (the result is encrypted data block 2); then the encrypted data block 2 is logically operated with data block 3; the result of the logical operation is encrypted (the result is encrypted data block 3)... and so on, to obtain multiple encrypted data blocks corresponding to the multiple data blocks.

[0162] In some embodiments, the logical operation is any one of an AND operation, an OR operation, an XOR operation, and an XOR operation; the encryption method of the encryption processing satisfies the following conditions: the encrypted data block obtained by applying the encryption method to the result of the logical operation is equivalent to the result obtained after performing the logical operation on the ciphertext data block, and the ciphertext data block is obtained by applying the encryption method to the data block to be processed.

[0163] In step 1032, the plurality of encrypted data blocks corresponding to the plurality of data blocks are combined in sequence into encrypted sub-data.

[0164] Continuing with the above example, the encrypted sub-data obtained by sequentially combining multiple encrypted data blocks corresponding to multiple data blocks can be expressed as [encrypted data block 1, encrypted data block 2, ..., encrypted data block N].

[0165] In some embodiments, Figure 3C Step 1021 shown performs coordinate system transformation processing on each sampling point in the first sub-data to obtain the second coordinate of each sampling point based on the second coordinate system. Figure 3E , the following steps 1024 to 1025 may also be performed for each second sub-data, as described in detail below.

[0166] In step 1024 , a random number corresponding to the second sub-data is obtained, wherein different second sub-data correspond to different random numbers.

[0167] In some embodiments, the random number can be customized, for example, the random number can be set to an integer or a decimal.

[0168] In step 1025 , the second coordinates of the sampling points in the second sub-data are offset according to random numbers to form updated second coordinates, wherein the updated second coordinates are used for coordinate mapping processing.

[0169] In some embodiments, the second coordinate (x2, y2) obtained in step 1021 is offset according to a random number to obtain a new second coordinate. The offset processing can be performed on the second coordinates of all sampling points in the second sub-data, or on part of them (for example, odd or even sampling points, the first 30% of the sampling points, etc.) to obtain an updated second coordinate.

[0170] In some embodiments, see Figure 3F ,exist Figure 3E After step 1025 shown, the following steps 1026 to 1027 may also be performed, which are described in detail below.

[0171] In step 1026, the mapping table and the random number are used as sensitive parameters.

[0172] In step 1027, a request is made to the key management server to generate a master key, so that the key management server encrypts the sensitive parameters based on the master key and generates a ciphertext certificate file for decrypting the encrypted data.

[0173] In some embodiments, a master key is generated from a key management server, and the key management server's API is called to encrypt sensitive parameters. The encrypted certificate file is returned. The master key (MasterKey) is the highest-level key in the key management scheme, denoted as KM. The master key is used to protect secondary keys and primary keys.

[0174] Continue to see Figure 3A In step 104, the encrypted sub-data corresponding to the plurality of second sub-data are combined into encrypted data.

[0175] Continuing with the above example, taking the second sub-data as the second track segment data as an example, the encrypted track segment data (corresponding encrypted sub-data) corresponding to the plurality of second track segment data are combined into encrypted track data (corresponding encrypted data).

[0176] In some embodiments, the encrypted sub-data corresponding to the plurality of second sub-data are combined into encrypted data in chronological order.

[0177] In some embodiments, see Figure 3G ,exist Figure 3D After step 1032 shown, the following steps 1033 to 1034 may be performed, which are described in detail below.

[0178] In step 1033, the preset data is used as a sensitive parameter.

[0179] In step 1034, a request is made to the key management server to generate a master key, so that the key management server encrypts the sensitive parameters based on the master key and generates a ciphertext certificate file for decrypting the encrypted sub-data.

[0180] Here, refer to the description of step 1027 above.

[0181] In some embodiments, the data to be processed includes multiple sampling point data, see Figure 3H ,exist Figure 3B After step 1014 shown, before dividing the data to be processed into a plurality of first sub-data, the following steps 1015 to 1017 may be iteratively performed on the data to be processed, as described in detail below.

[0182] In step 1015, a line connecting the first sampling point and the last sampling point in the data to be processed is used as a baseline, and the distance from the middle point to the baseline is obtained, and the maximum distance is used as the baseline distance, wherein the middle point is a sampling point other than the first sampling point and the last sampling point in the data to be processed.

[0183] In some embodiments, assuming that the complete sub-area includes sampling points P1, P2, P3, P4, and P5, the connecting line between P1 and P5 is used as the baseline, and the distances from P2, P3, and P4 to the baseline are calculated as d2, d3, and d4, respectively. If d3 is the largest, then d3 is the baseline distance.

[0184] In step 1016, sampling points corresponding to reference distances smaller than a preset sampling point denoising threshold are filtered out from the data to be processed.

[0185] Continuing with the above example, the sampling point denoising threshold is expressed as ε. In response to d3 < ε, P3 is removed.

[0186] In step 1017, a boundary sampling point is determined in the data to be processed, wherein the boundary sampling point is a sampling point corresponding to a reference distance greater than a sampling point denoising threshold, the boundary sampling point and the sampling point data before it are divided into first data to be processed, the boundary sampling point and the sampling point after it are divided into second data to be processed, and the first data to be processed and the second data to be processed are used as new data to be processed.

[0187] Continuing with the above example, in response to d3>ε, point P3 is indicated as a boundary sampling point, and the data to be processed is divided into two segments through P3: P1-P3 (corresponding to the first data to be processed) and P3-P5 (corresponding to the second data to be processed). For the data to be processed in the P1-P3 segment, the connecting line between P1 and P3 is used as the baseline, and the distance d2 from P2 to the baseline is calculated. If d2<ε, P2 is removed. Otherwise, P2 is used as the boundary sampling point of the data to be processed in the P1-P3 segment; for the data to be processed in the P3-P5 segment, the connecting line between P3 and P5 is used as the baseline, and the distance d4 from P4 to the baseline is calculated. If d4<ε, P4 is removed. Otherwise, P4 is used as the boundary sampling point of the data to be processed in the P3-P5 segment. Finally, the remaining sampling points in the data to be processed P1, P2, P3, P4, and P5 are reconnected to form new data to be processed.

[0188] In some embodiments, Figure 3A Before dividing the data to be processed into a plurality of first sub-data in step 101, any of the following processes may be performed on the data to be processed:

[0189] In some embodiments, a time interval between any two adjacent sampling points in the data to be processed is obtained, and in response to the time interval being greater than a preset time interval threshold, an interpolation process (such as linear interpolation, Lagrange interpolation, etc.) is performed between the adjacent sampling points to obtain at least one new sampling point between the adjacent sampling points;

[0190] In some embodiments, a distance interval between any two adjacent sampling points in the data to be processed is obtained, and in response to the distance interval being greater than a preset distance interval threshold, an interpolation process is performed between the adjacent sampling points to obtain at least one new sampling point between the adjacent sampling points;

[0191] In some embodiments, a state change value (such as a velocity change, an acceleration change, etc.) between any two adjacent sampling points in the data to be processed is obtained. In response to the state change value being greater than a preset state change threshold, interpolation processing is performed between the adjacent sampling points to obtain at least one new sampling point between the adjacent sampling points.

[0192] Through steps 101 to 104, by dividing the data to be processed into multiple first sub-data and converting the multiple first sub-data into multiple second sub-data respectively, the conversion of sub-data according to the preset reference coordinate system is realized, thereby improving the security and customizability of the encryption of the data to be processed. By performing serial encryption processing on the multiple second sub-data respectively, parallel encryption of the sub-data is realized. Since the serial encryption processing of each second sub-data is independent of each other, the reliability of the data encryption is further improved while improving the data encryption efficiency. In addition, the data encryption method provided in the embodiment of the present application is reversible and retains sufficient information for subsequent decryption operations. No information of the original data is lost during the encryption process. Therefore, the original data can be completely restored during the decryption process, thereby achieving the beneficial effect of lossless encryption and decryption. For the decryption method of the encrypted data, please refer to steps 201 to 204 below.

[0193] Below, the method for decrypting encrypted data provided by the embodiment of the present application will be described in conjunction with the exemplary application and implementation of the server provided by the embodiment of the present application. Figure 4A , Figure 4A This is a first flow chart of the method for decrypting encrypted data provided by the embodiment of the present application, which will be combined with Figure 4A The steps shown are explained.

[0194] In step 201 , encrypted data is obtained, wherein the encrypted data includes a plurality of encrypted sub-data, and the plurality of encrypted sub-data are obtained by encrypting a plurality of first sub-data respectively.

[0195] Continuing with the above example, taking the encrypted data as encrypted trajectory data as an example, the encrypted trajectory data is obtained, wherein the encrypted trajectory data includes multiple encrypted trajectory segment data (corresponding to encrypted sub-data), and the multiple encrypted trajectory segment data are obtained by respectively encrypting multiple first trajectory segment data (corresponding to first sub-data).

[0196] In some embodiments, the encrypted data is obtained by encrypting data using the data encryption method provided in the embodiments of the present application.

[0197] In step 202, the following processes are performed in parallel on the plurality of encrypted sub-data:

[0198] The encrypted sub-data is divided into multiple encrypted data blocks according to a preset data block length, and serial decryption processing is performed based on the multiple encrypted data blocks to obtain multiple second sub-data corresponding to the multiple encrypted data blocks, wherein the decryption processing of the encrypted data blocks sorted later depends on the decryption results of the encrypted data blocks sorted earlier.

[0199] Continuing with the above example, taking the encrypted sub-data as encrypted trajectory segment data as an example, the following processing is performed in parallel for multiple encrypted trajectory segment data:

[0200] The encrypted trajectory segment data is divided into multiple encrypted data blocks according to a preset data block length, and serial decryption processing is performed based on the multiple encrypted data blocks to obtain multiple second trajectory segment data (corresponding to the second sub-data) corresponding to the multiple encrypted data blocks, wherein the decryption processing of the encrypted data blocks sorted later depends on the decryption results of the encrypted data blocks sorted earlier.

[0201] In some embodiments, the preset data block length corresponds to the data block length in step 103 above (e.g., the length of each block is 32 bytes), and the decryption processing of the encrypted data block sorted later depends on the decryption result of the encrypted data block sorted earlier (i.e., the second sub-data). Step 202 is the inverse process of step 103 above.

[0202] In some embodiments, multiple encrypted data blocks are traversed in order from the first encrypted data block to the last encrypted data block, and the traversed encrypted data blocks are used as the encrypted data blocks to be processed to iteratively perform the following processing:

[0203] Decrypting the encrypted data block to be processed to obtain a logical operation result of the encrypted data block to be processed, and performing a logical operation on the logical operation result of the encrypted data block to be processed and the reference data of the encrypted data block to be processed to obtain a data block in plain text corresponding to the encrypted data block to be processed, wherein when the encrypted data block to be processed is the first encrypted data block, the reference data is preset data, and when the encrypted data block to be processed is the encrypted data block after the first encrypted data block, the reference data is the next encrypted data block of the encrypted data block to be processed.

[0204] In some embodiments, the logical operation is any one of an AND operation, an OR operation, an XOR operation, and an XOR operation; the decryption method of the decryption processing satisfies the following conditions: the logical operation result obtained by applying the decryption method to the encrypted data block to be processed is equivalent to the result obtained after performing the logical operation on the plaintext data, and the plaintext data is obtained by applying the decryption method to the encrypted data block to be processed.

[0205] In some embodiments, multiple data blocks corresponding to the multiple encrypted data blocks are combined in sequence to form the second sub-data.

[0206] In step 203 , the plurality of second sub-data are converted into a plurality of first sub-data respectively.

[0207] Continuing with the above example, taking the second sub-data as the second track segment data as an example, a plurality of second track segment data are respectively converted into a plurality of first track segment data (corresponding to the first sub-data).

[0208] In some embodiments, the first sub-data is recorded based on the first coordinate system, and the second sub-data is recorded based on the second coordinate system, where the second coordinate system is a preset reference coordinate system; the second sub-data includes third coordinates of multiple sampling points based on the second coordinate system, see Figure 4B , Figure 4A The step 203 shown can be implemented by following steps 2031 to 2033, which are described in detail below.

[0209] In step 2031, a preset mapping table is obtained, and coordinate mapping processing is performed on the third coordinate of each sampling point through the mapping table to obtain the second coordinate of each sampling point based on the second coordinate system, wherein in the mapping table, different third coordinates correspond to different second coordinates.

[0210] In some embodiments, the acquisition of the preset table refers to the description of step 1022 above. The third coordinate of each sampling point is mapped by the mapping table to obtain the second coordinate of each sampling point based on the second coordinate system, which refers to the reverse coordinate mapping process of step 1022.

[0211] In step 2032 , coordinate system conversion processing is performed on the second coordinate of each sampling point to obtain the first coordinate of each sampling point based on the first coordinate system.

[0212] In some embodiments, a coordinate system transformation is performed on the second coordinate of each sampling point (corresponding to the coordinate represented as (x2, y2) above) to obtain the first coordinate of each sampling point based on the first coordinate system (corresponding to the coordinate represented as (x1, y1) above), which is the reverse coordinate system transformation performed in step 1021 above.

[0213] In step 2033, the first coordinates corresponding to the second sub-data are spliced ​​to obtain the first sub-data corresponding to the second sub-data.

[0214] In some embodiments, the first coordinates corresponding to each sampling point in the second sub-data are sequentially spliced ​​to obtain the first sub-data corresponding to the second sub-data.

[0215] Continue to see Figure 4A In step 204, the plurality of first sub-data corresponding to the plurality of encrypted sub-data are combined into decrypted data.

[0216] Continuing with the above example, taking the encrypted sub-data as encrypted track segment data as an example, a plurality of first track segment data corresponding to the plurality of encrypted track segment data are combined into decrypted track data (corresponding to decrypted data).

[0217] In some embodiments, see Figure 4C ,exist Figure 4BBefore step 2032 shown, the following steps 2034 to 2035 may also be performed, which are described in detail below.

[0218] In step 2034 , a random number corresponding to the second sub-data is obtained, wherein different second sub-data correspond to different random numbers.

[0219] Here, refer to the description of step 1024 above.

[0220] In step 2035, the second coordinate of each sampling point in the second sub-data is subjected to an inverse offset process according to a random number to form an updated second coordinate.

[0221] In some embodiments, the second coordinate (x2, y2) obtained in step 2031 is reverse-offset calculated according to a random number (i.e., the reverse operation performed in step 1025 above) to obtain a new second coordinate. The reverse-offset processing can be performed on the second coordinates of all sampling points in the second sub-data, or on part of them (for example, odd or even sampling points, the first 30% of the sampling points, etc.) to obtain an updated second coordinate.

[0222] In some embodiments, see Figure 4D ,exist Figure 4C After step 2035 shown, the following steps 2036 to 2037 may also be performed, which are described in detail below.

[0223] In step 2036, an interface call request is sent to the key management server, so that the key management server decrypts the ciphertext certificate file based on the pre-generated master key to obtain the plaintext certificate file.

[0224] In some embodiments, a request is made to the key management server to call an interface, and the API of the key management server is called to decrypt the ciphertext certificate file using the master key and return the plaintext certificate file.

[0225] In step 2037, the plaintext certificate file sent by the key management server is received, and sensitive parameters for decrypting the encrypted data are read from the plaintext certificate file, where the sensitive parameters include a mapping table and a random number.

[0226] In some embodiments, a plaintext certificate file sent by a key management server may also be received, and sensitive parameters for decrypting encrypted data may be read from the plaintext certificate file, wherein the sensitive parameters include preset data.

[0227] The data encryption method provided in the embodiments of the present application can be applied to various application scenarios such as encrypted storage and transmission of trajectory data. For example, in the transportation management scenario, logistics and transportation companies need to perform real-time detection and analysis of vehicle trajectory data. Encrypting trajectory data can ensure the security of data during transmission and storage, and prevent data leakage and tampering; in the smart city scenario, smart city projects involve a large amount of trajectory data, such as traffic flow, public transportation, etc. Encrypting this data can ensure data security and privacy protection; in the analysis and research scenario, trajectory data has important value in many research fields, such as traffic planning, epidemiology, urban planning, etc. When sharing and analyzing data, encrypting trajectory data can protect user privacy and data security; in the location service scenario, many mobile applications provide location-based services, such as navigation, taxi-hailing, etc. In order to protect user privacy, these applications need to encrypt trajectory data to prevent unauthorized access and abuse.

[0228] See also Figure 5 , Figure 5 This is a schematic diagram of the principle of the trajectory data encryption method provided in an embodiment of the present application. After obtaining the trajectory data, the trajectory data is subjected to pre-processing such as denoising (see the description of steps 1015 to 1017 above) and interpolation to obtain new trajectory data. The new trajectory data is subjected to trajectory segmentation processing to obtain multiple first trajectory segment data. Figure 5 The two first track segment data (corresponding to Figure 5 Next, coordinate system conversion and coordinate mapping are performed on each first track segment data to obtain a plurality of second track segment data (corresponding to Figure 5 Here, the random number and mapping table used in the coordinate mapping process for each first track segment data can be different (the coordinate system conversion process refers to the description of step 1021 above, and the coordinate mapping process refers to the description of step 1022 above). Next, each second track segment data is encrypted to obtain multiple encrypted track segment data (corresponding to Figure 5 Here, the preset data used when encrypting each second trajectory segment data can be different (for the encryption process, see the description of step 103 above). Finally, multiple encrypted trajectory segment data are combined to obtain encrypted trajectory data.

[0229] Below, we will explain the exemplary application of the embodiment of the present application in the location service scenario of the map application. Figure 6 , Figure 6This is a flowchart of the application of the trajectory data encryption method and the encrypted trajectory data decryption method provided in the embodiment of the present application in the location service scenario, which is described in detail below.

[0230] In step 301, a navigation request is sent.

[0231] In some embodiments, in response to a user submitting a navigation request through a client such as a map application in a terminal device, the terminal device sends a navigation request to a navigation system server. For example, the navigation request may include information such as the starting point, the end point, and the navigation method (such as walking, driving, cycling, etc.).

[0232] In step 302 , a navigation request is received and a request is made to obtain trajectory data.

[0233] In some embodiments, after receiving the navigation request, the navigation system server requests the terminal device to obtain the trajectory data.

[0234] In step 303, the trajectory data is acquired and encrypted to obtain encrypted trajectory data.

[0235] In some embodiments, the terminal device obtains trajectory data using trajectory data acquisition technology such as GPS. The trajectory data includes multiple trajectory points, each of which may include time, location coordinates (corresponding to the first coordinates above), speed, and other information. Next, the trajectory data is segmented and encrypted in parallel using the trajectory data encryption method provided in the embodiment of the present application to obtain encrypted trajectory data. Here, refer to the description of steps 101 to 104 above, which will not be repeated here.

[0236] In step 304, the encrypted trajectory data is sent.

[0237] In some embodiments, the terminal device sends the encrypted trajectory data to the navigation system server.

[0238] In step 305 , the encrypted trajectory data is received and decrypted to obtain restored trajectory data.

[0239] In some embodiments, the navigation system server receives encrypted trajectory data, decrypts the encrypted trajectory data using the decryption method for encrypted trajectory data provided in an embodiment of the present application, and obtains restored trajectory data. For decrypting the encrypted trajectory data, refer to the description of steps 201 to 204 above and will not be repeated here.

[0240] In step 306 , route planning is performed based on the restored trajectory data to obtain a navigation guidance result.

[0241] In some embodiments, the navigation system server performs route planning (such as calculating the best path, analyzing real-time traffic conditions, etc.) based on the restored trajectory data to obtain navigation guidance results.

[0242] In step 307, the navigation guidance result is encrypted to obtain an encrypted navigation result, and the encrypted navigation result is sent.

[0243] In some embodiments, the navigation system server encrypts the navigation guidance result (such as through a homomorphic encryption method, etc.), obtains an encrypted navigation result, and sends the encrypted navigation result to the terminal device.

[0244] In step 308, the encrypted navigation result is decrypted to obtain a navigation guidance result.

[0245] In some embodiments, the terminal device decrypts the encrypted navigation result (eg, using a decryption method corresponding to step 307 ), obtains a navigation guidance result, and displays it on the terminal device for the user.

[0246] In other embodiments, see Figure 7 , Figure 7 This is a schematic diagram of the principle of the trajectory processing system architecture provided by the embodiment of the present application. When performing traffic information analysis and other processing on the map application, the navigation system server can adopt a similar structure (for example, including Figure 7 ), through device management and trajectory access for multiple collection devices (such as multiple high-precision collection vehicles), the program thread (Worker) collects and splices cached trajectory data. For example, the number of queues can be determined based on the number of collection devices or the load balancing of trajectory data, and the trajectory point data is hashed and mapped to different queues by the collection vehicle number. Here, please refer to the description of steps 1011 to 1014 above (corresponding to Figure 7 In the trajectory consumption, that is, one trajectory consumption corresponds to one queue), after obtaining the trajectory data, the navigation system server encrypts the trajectory data by the trajectory data encryption method provided in the embodiment of the present application to obtain encrypted trajectory data, and stores the encrypted trajectory data. In response to the terminal device or the third-party device sending a data access request to the navigation system server, the data access request includes a data access permission. The navigation system server decrypts the encrypted trajectory data by the encrypted trajectory data decryption method provided in the embodiment of the present application, performs traffic information analysis based on the decrypted trajectory data, or sends it to the third-party device through a secure communication protocol (such as HTTPS) for use by the third-party device (for example, to analyze traffic information), wherein, Figure 7The trajectory preprocessing shown at the business layer corresponds to the denoising and interpolation preprocessing mentioned above; for trajectory segmentation, refer to the description of dividing the trajectory data into multiple first trajectory segment data in step 101 above; for trajectory encryption, refer to the description of steps 102 to 104 above; for trajectory decryption, refer to the description of steps 201 to 204 above; for key management, refer to the description of the key management server above, wherein the encrypted ciphertext file of sensitive parameters is saved locally, decrypted when used, and the plaintext file is not saved locally, making it difficult for unauthorized persons to obtain, thereby further improving the data security of the high-speed trajectory. Figure 7 The components and their functions shown in the figure include: Redis, which caches track points and is used for track point access and splicing; MySQL, which is used to store task data, vehicle management data, etc.; Kafka, which is used to interact with other services, send requests and receive return data; Cos, which is used to store encrypted track data.

[0247] Through steps 301 to 307, the data encryption method and encrypted data decryption method provided by the embodiment of the present application are implemented to encrypt the trajectory data and decrypt the encrypted trajectory data, thereby protecting user privacy, ensuring the security of the trajectory data during transmission and storage, and preventing data leakage and tampering.

[0248] The following continues to describe the exemplary structure of the data encryption device 133 provided in the embodiment of the present application as a software module. In some embodiments, such as Figure 2A As shown, the software modules in the encryption device 133 for data stored in the memory 130-1 may include:

[0249] The data acquisition module 1331 is used to obtain the data to be processed and divide the data to be processed into a plurality of first sub-data, wherein the first sub-data are recorded based on a first coordinate system.

[0250] The encryption module 1332 is configured to convert the plurality of first sub-data into a plurality of second sub-data respectively, wherein the second sub-data are recorded based on a second coordinate system, which is a preset reference coordinate system.

[0251] In some embodiments, the encryption module 1332 is further configured to perform the following processing in parallel on the plurality of second sub-data:

[0252] Divide the second sub-data into a plurality of data blocks according to a preset data block length, and

[0253] Serial encryption processing is performed based on the multiple data blocks to obtain encrypted sub-data of the second sub-data, wherein the encryption processing of the data blocks sorted later depends on the encryption results of the data blocks sorted earlier; and the encrypted sub-data corresponding to the multiple second sub-data are combined into encrypted data.

[0254] In some embodiments, the first sub-data includes first coordinates of multiple sampling points based on the first coordinate system; the encryption module 1332 is further used to perform coordinate system conversion processing on each of the sampling points in the first sub-data to obtain second coordinates of each sampling point based on the second coordinate system; obtain a preset mapping table, and perform coordinate mapping processing on the second coordinate of each sampling point through the mapping table to obtain third coordinates of each sampling point based on the second coordinate system, wherein in the mapping table, different second coordinates correspond to different third coordinates; and splice the third coordinates corresponding to the first sub-data to obtain second sub-data corresponding to the first sub-data.

[0255] In some embodiments, the encryption module 1332 is further used to perform the following processing on each second sub-data: obtaining a random number corresponding to the second sub-data, wherein different second sub-data correspond to different random numbers; and performing offset processing on the second coordinates of the sampling points in the second sub-data according to the random number to form updated second coordinates, wherein the updated second coordinates are used to perform the coordinate mapping processing.

[0256] In some embodiments, the encryption module 1332 is also used to use the mapping table and the random number as sensitive parameters; request the key management server to generate a master key, so that the key management server encrypts the sensitive parameters based on the master key and generates a ciphertext certificate file for decrypting the encrypted data.

[0257] In some embodiments, the data acquisition module 1331 is further configured to perform any of the following processing on the data to be processed:

[0258] Obtaining a preset distance threshold, and in response to a distance between any two adjacent sampling points in the data to be processed being greater than the distance threshold, performing division between the any two adjacent sampling points to obtain the plurality of first sub-data;

[0259] Obtaining a preset time threshold, and in response to a time interval between any two adjacent sampling points in the data to be processed being greater than the time threshold, performing division between the any two adjacent sampling points to obtain the plurality of first sub-data, wherein the time interval is represented by the timestamps of the sampling points;

[0260] A preset density threshold is obtained, and the density of the area to which each sampling point in the data to be processed belongs is obtained, the density corresponding to each sampling point is traversed, and in response to the density of the area to which the sampling point belongs being less than the density threshold, the sampling point is used as a segmentation point, and the segmentation point and the previously undivided data to be processed are used as a first sub-data.

[0261] In some embodiments, the data to be processed is collected by multiple data acquisition devices, and the data acquisition module 1331 is also used to map the device numbers of the multiple data acquisition devices to obtain the hash value of each data acquisition device; obtain the preset queue number and queue number, perform modulo operation on each hash value and the queue number, and obtain the queue number corresponding to each data acquisition device; allocate the data collected by the multiple data acquisition devices to the corresponding queues according to the queue numbers to obtain multiple queues; sort the data in the multiple queues according to timestamps to obtain the data to be processed.

[0262] In some embodiments, the encryption module 1332 is further configured to traverse the plurality of data blocks in order from the first data block to the last data block, and use the traversed data blocks as data blocks to be processed to iteratively perform the following processing:

[0263] Performing a logic operation on the data block to be processed and the reference data of the data block to be processed to obtain a logic operation result of the data block to be processed, and

[0264] The logical operation result of the data block to be processed is encrypted to obtain an encrypted data block corresponding to the data block to be processed, wherein when the data block to be processed is the first data block among the multiple data blocks, the reference data is preset data, and when the data block to be processed is a data block after the first data block among the multiple data blocks, the reference data is a next data block of the data block to be processed; and the multiple encrypted data blocks corresponding to the multiple data blocks are combined into the encrypted sub-data in the order described.

[0265] In some embodiments, the encryption module 1332 is also used to use the preset data as a sensitive parameter; request the key management server to generate a master key, so that the key management server encrypts the sensitive parameter based on the master key and generates a ciphertext certificate file for decrypting the encrypted sub-data.

[0266] In some embodiments, the data acquisition module 1331 is further configured to iteratively perform the following processing on the data to be processed: using a connecting line between the first sampling point and the last sampling point in the data to be processed as a baseline, obtaining a distance from an intermediate point to the baseline, and using the maximum distance as a baseline distance, wherein the intermediate point is a sampling point other than the first sampling point and the last sampling point in the data to be processed; filtering out sampling points corresponding to the baseline distance that is less than a preset sampling point denoising threshold in the data to be processed; determining boundary sampling points in the data to be processed, wherein the boundary sampling points are sampling points corresponding to the baseline distance that is greater than the sampling point denoising threshold, dividing the boundary sampling points and the sampling point data before them into first data to be processed, dividing the boundary sampling points and the sampling points after them into second data to be processed, and using the first data to be processed and the second data to be processed as new data to be processed.

[0267] In some embodiments, the data acquisition module 1331 is further configured to perform any of the following processing on the data to be processed:

[0268] Obtaining a time interval between any two adjacent sampling points in the data to be processed, and in response to the time interval being greater than a preset time interval threshold, performing interpolation processing between the adjacent sampling points to obtain at least one new sampling point between the adjacent sampling points;

[0269] Obtaining a distance interval between any two adjacent sampling points in the data to be processed, and in response to the distance interval being greater than a preset distance interval threshold, performing interpolation processing between the adjacent sampling points to obtain at least one new sampling point between the adjacent sampling points;

[0270] A state change value between any two adjacent sampling points in the data to be processed is obtained, and in response to the state change value being greater than a preset state change threshold, interpolation processing is performed between the adjacent sampling points to obtain at least one new sampling point between the adjacent sampling points.

[0271] The following continues to describe the exemplary structure of the encrypted data decryption device 134 provided in the embodiment of the present application as a software module. In some embodiments, such as Figure 2B As shown, the software modules in the decryption device 134 for the encrypted data stored in the memory 130-2 may include:

[0272] The data acquisition module 1341 is configured to acquire encrypted data, wherein the encrypted data includes a plurality of encrypted sub-data, and the plurality of encrypted sub-data are obtained by encrypting a plurality of first sub-data respectively.

[0273] The decryption module 1342 is configured to perform the following processing in parallel on the plurality of encrypted sub-data:

[0274] The encrypted sub-data is divided into multiple encrypted data blocks according to a preset data block length, and serial decryption processing is performed based on the multiple encrypted data blocks to obtain multiple second sub-data corresponding to the multiple encrypted data blocks, wherein the decryption processing of the encrypted data blocks sorted later depends on the decryption results of the encrypted data blocks sorted earlier.

[0275] In some embodiments, the decryption module 1342 is further configured to convert the plurality of second sub-data into the plurality of first sub-data respectively.

[0276] In some embodiments, the decryption module 1342 is further configured to combine the plurality of first sub-data corresponding to the plurality of encrypted sub-data into decrypted data.

[0277] In some embodiments, the first sub-data is recorded based on a first coordinate system, and the second sub-data is recorded based on a second coordinate system, where the second coordinate system is a preset reference coordinate system; the decryption module 1342 is further configured to obtain a preset mapping table, perform coordinate mapping processing on the third coordinate of each sampling point through the mapping table, and obtain the second coordinate of each sampling point based on the second coordinate system, wherein in the mapping table, different third coordinates correspond to different second coordinates; perform coordinate system conversion processing on the second coordinate of each sampling point to obtain the first coordinate of each sampling point based on the first coordinate system; and perform splicing processing on the first coordinate corresponding to the second sub-data to obtain the first sub-data corresponding to the second sub-data.

[0278] In some embodiments, the decryption module 1342 is further used to obtain a random number corresponding to the second sub-data, wherein different second sub-data correspond to different random numbers; and perform inverse offset processing on the second coordinate of each sampling point in the second sub-data according to the random number to form an updated second coordinate.

[0279] In some embodiments, the decryption module 1342 is further configured to traverse the plurality of encrypted data blocks in order from the first encrypted data block to the last encrypted data block, and use the traversed encrypted data blocks as encrypted data blocks to be processed, so as to iteratively perform the following processing:

[0280] Decrypting the encrypted data block to be processed to obtain a logical operation result of the encrypted data block to be processed, and

[0281] Performing a logical operation on the result of the logical operation of the encrypted data block to be processed and reference data of the encrypted data block to be processed to obtain a data block in plaintext form corresponding to the encrypted data block to be processed, wherein when the encrypted data block to be processed is the first encrypted data block, the reference data is preset data; and when the encrypted data block to be processed is an encrypted data block subsequent to the first encrypted data block, the reference data is an encrypted data block next to the encrypted data block to be processed;

[0282] The plurality of data blocks respectively corresponding to the plurality of encrypted data blocks are combined into the second sub-data in the order.

[0283] In some embodiments, the decryption module 1342 is also used to send an interface call request to the key management server, so that the key management server decrypts the ciphertext certificate file based on the pre-generated master key to obtain a plaintext certificate file; receives the plaintext certificate file sent by the key management server, and reads sensitive parameters used to decrypt the encrypted data from the plaintext certificate file, wherein the sensitive parameters include the mapping table and the random number.

[0284] Embodiments of the present application provide a computer program product, which includes a computer program or computer-executable instructions stored in a computer-readable storage medium. A processor of an electronic device reads the computer-executable instructions from the computer-readable storage medium and executes the computer-executable instructions, causing the electronic device to perform the data encryption method or encrypted data decryption method provided in the embodiments of the present application.

[0285] The embodiment of the present application provides a computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions or computer programs are stored. When the computer-executable instructions or computer programs are executed by a processor, the processor will be caused to execute the data encryption method or the encrypted data decryption method provided by the embodiment of the present application, for example, Figure 3A The encryption method of the data shown or Figure 4A Decryption method of encrypted data is shown.

[0286] In some embodiments, the computer-readable storage medium may be a memory such as RAM, ROM, flash memory, magnetic surface memory, optical disk, or CD-ROM; or may be various devices including one or any combination of the above memories.

[0287] In some embodiments, computer-executable instructions may be in the form of a program, software, software module, script, or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including as a stand-alone program or as a module, component, subroutine, or other unit suitable for use in a computing environment.

[0288] As an example, computer-executable instructions may, but need not, correspond to a file in a file system, may be stored as part of a file that stores other programs or data, such as in one or more scripts in a HyperText Markup Language (HTML) document, in a single file dedicated to the program in question, or in multiple coordinating files (e.g., files storing one or more modules, subroutines, or code portions).

[0289] By way of example, computer-executable instructions may be deployed to be executed on one electronic device, or on multiple electronic devices located at one site, or on multiple electronic devices distributed across multiple sites and interconnected by a communication network.

[0290] To sum up, through the embodiments of the present application, the data to be processed is divided into multiple first sub-data, and the multiple first sub-data are respectively converted into multiple second sub-data, thereby realizing the conversion of sub-data according to a preset reference coordinate system, improving the security and customizability of the encryption of the data to be processed, and realizing parallel encryption of the sub-data by performing serial encryption processing on the multiple second sub-data respectively. Since the serial encryption processing of each second sub-data is independent of each other, the reliability of the data encryption is further improved while improving the data encryption efficiency.

[0291] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. Any modifications, equivalent replacements, and improvements made within the spirit and scope of the present application are included in the scope of protection of the present application.

Claims

1. A data encryption method, characterized in that: The method comprises: Acquire data to be processed, and divide the data to be processed into a plurality of first sub-data, wherein the first sub-data are recorded based on a first coordinate system; Converting the plurality of first sub-data into a plurality of second sub-data respectively, wherein the second sub-data are recorded based on a second coordinate system, which is a preset reference coordinate system; The following processing is performed in parallel on the plurality of second sub-data: Divide the second sub-data into a plurality of data blocks according to a preset data block length, and Performing serial encryption processing on the plurality of data blocks to obtain encrypted sub-data of the second sub-data, wherein the encryption processing of the data blocks in a later order depends on the encryption result of the data blocks in a previous order; The encrypted sub-data respectively corresponding to the plurality of second sub-data are combined into encrypted data.

2. The method according to claim 1, characterized in that The first sub-data includes first coordinates of a plurality of sampling points based on the first coordinate system; The converting the plurality of first sub-data into a plurality of second sub-data respectively includes: The following processing is performed on each of the plurality of first sub-data: Performing coordinate system conversion processing on each sampling point in the first sub-data to obtain a second coordinate of each sampling point based on the second coordinate system; Obtaining a preset mapping table, and performing coordinate mapping processing on the second coordinate of each sampling point using the mapping table to obtain a third coordinate of each sampling point based on the second coordinate system, wherein in the mapping table, different second coordinates correspond to different third coordinates; The third coordinates corresponding to the first sub-data are spliced ​​to obtain second sub-data corresponding to the first sub-data.

3. The method according to claim 2, characterized in that After performing coordinate system conversion processing on each sampling point in the first sub-data to obtain a second coordinate of each sampling point based on the second coordinate system, the method further includes: The following processing is performed on each of the second sub-data: Obtaining a random number corresponding to the second sub-data, wherein different second sub-data correspond to different random numbers; The second coordinates of the sampling points in the second sub-data are offset according to the random number to form updated second coordinates, wherein the updated second coordinates are used for the coordinate mapping process.

4. The method according to claim 2 or 3, characterized in that The method further comprises: Using the mapping table and the random number as sensitive parameters; Requesting a key management server to generate a master key, so that the key management server encrypts the sensitive parameters based on the master key and generates a ciphertext certificate file for decrypting the encrypted data.

5. The method according to any one of claims 1 to 4, characterized in that The step of dividing the data to be processed into a plurality of first sub-data includes: Perform any of the following processing on the data to be processed: Obtaining a preset distance threshold, and in response to a distance between any two adjacent sampling points in the data to be processed being greater than the distance threshold, performing division between the any two adjacent sampling points to obtain the plurality of first sub-data; Obtaining a preset time threshold, and in response to a time interval between any two adjacent sampling points in the data to be processed being greater than the time threshold, performing division between the any two adjacent sampling points to obtain the plurality of first sub-data, wherein the time interval is represented by the timestamps of the sampling points; A preset density threshold is obtained, and the density of the area to which each sampling point in the data to be processed belongs is obtained, the density corresponding to each sampling point is traversed, and in response to the density of the area to which the sampling point belongs being less than the density threshold, the sampling point is used as a segmentation point, and the segmentation point and the previously undivided data to be processed are used as a first sub-data.

6. The method according to any one of claims 1 to 4, characterized in that The data to be processed is collected by multiple data collection devices, and obtaining the data to be processed includes: Mapping the device numbers of the plurality of data acquisition devices to obtain a hash value of each data acquisition device; Obtaining a preset number of queues and a queue number, performing a modulo operation on each of the hash values ​​and the number of queues to obtain the queue number corresponding to each of the data acquisition devices; Allocating the data collected by the multiple data collection devices to corresponding queues according to the queue numbers to obtain multiple queues; The data in the multiple queues are sorted according to timestamps to obtain the data to be processed.

7. The method according to claim 1, characterized in that The serial encryption processing based on the plurality of data blocks to obtain the encrypted sub-data of the second sub-data includes: The plurality of data blocks are traversed in order from the first data block to the last data block, and the traversed data blocks are used as data blocks to be processed, so as to iteratively perform the following processing: Performing a logic operation on the data block to be processed and the reference data of the data block to be processed to obtain a logic operation result of the data block to be processed, and Performing encryption processing on the logical operation result of the data block to be processed to obtain an encrypted data block corresponding to the data block to be processed, wherein when the data block to be processed is the first data block among the multiple data blocks, the reference data is preset data; when the data block to be processed is a data block subsequent to the first data block among the multiple data blocks, the reference data is a data block next to the data block to be processed; The plurality of encrypted data blocks corresponding to the plurality of data blocks are combined into the encrypted sub-data in the order.

8. The method according to claim 7, characterized in that The logical operation is any one of an AND operation, an OR operation, an XOR operation and an XOR operation; The encryption method of the encryption processing satisfies the following conditions: the encrypted data block obtained by applying the encryption method to the logical operation result is equivalent to the result obtained after performing the logical operation on the ciphertext data block, and the ciphertext data block is obtained by applying the encryption method to the data block to be processed.

9. A method for decrypting encrypted data, characterized in that: The method comprises: Acquire encrypted data, wherein the encrypted data includes a plurality of encrypted sub-data, and the plurality of encrypted sub-data are obtained by encrypting a plurality of first sub-data respectively; The following processing is performed in parallel on the plurality of encrypted sub-data: Dividing the encrypted sub-data into a plurality of encrypted data blocks according to a preset data block length, and Performing serial decryption processing on the plurality of encrypted data blocks to obtain a plurality of second sub-data corresponding to the plurality of encrypted data blocks, wherein the decryption processing of the encrypted data blocks arranged later depends on the decryption result of the encrypted data blocks arranged earlier; converting the plurality of second sub-data into the plurality of first sub-data respectively; The plurality of first sub-data respectively corresponding to the plurality of encrypted sub-data are combined into decrypted data.

10. The method according to claim 9, characterized in that The first sub-data is recorded based on a first coordinate system, and the second sub-data is recorded based on a second coordinate system, where the second coordinate system is a preset reference coordinate system; The second sub-data includes third coordinates of a plurality of sampling points based on the second coordinate system, and converting the plurality of second sub-data into the plurality of first sub-data respectively includes: Obtaining a preset mapping table, and performing coordinate mapping processing on the third coordinate of each sampling point using the mapping table to obtain a second coordinate of each sampling point based on the second coordinate system, wherein in the mapping table, different third coordinates correspond to different second coordinates; Performing coordinate system conversion processing on the second coordinate of each sampling point to obtain a first coordinate of each sampling point based on the first coordinate system; The first coordinates corresponding to the second sub-data are spliced ​​to obtain the first sub-data corresponding to the second sub-data.

11. A data encryption device, characterized in that: The device comprises: a data acquisition module, configured to acquire data to be processed and divide the data to be processed into a plurality of first sub-data, wherein the first sub-data are recorded based on a first coordinate system; an encryption module, configured to convert the plurality of first sub-data into a plurality of second sub-data, wherein the second sub-data are recorded based on a second coordinate system, which is a preset reference coordinate system; The encryption module is further configured to perform the following processing in parallel on the plurality of second sub-data: Divide the second sub-data into a plurality of data blocks according to a preset data block length, and Serial encryption processing is performed based on the multiple data blocks to obtain encrypted sub-data of the second sub-data, wherein the encryption processing of the data blocks sorted later depends on the encryption results of the data blocks sorted earlier; and the encrypted sub-data corresponding to the multiple second sub-data are combined into encrypted data.

12. A decryption device for encrypted data, characterized in that: The device comprises: A data acquisition module, configured to acquire encrypted data, wherein the encrypted data includes a plurality of encrypted sub-data, and the plurality of encrypted sub-data are obtained by encrypting a plurality of first sub-data respectively; The decryption module is configured to perform the following processing in parallel on the plurality of encrypted sub-data: Dividing the encrypted sub-data into a plurality of encrypted data blocks according to a preset data block length, and Performing serial decryption processing on the plurality of encrypted data blocks to obtain a plurality of second sub-data corresponding to the plurality of encrypted data blocks, wherein the decryption processing of the encrypted data blocks arranged later depends on the decryption result of the encrypted data blocks arranged earlier; The decryption module is further configured to convert the plurality of second sub-data into the plurality of first sub-data respectively; The decryption module is further configured to combine the plurality of first sub-data corresponding to the plurality of encrypted sub-data into decrypted data.

13. An electronic device, characterized in that: The electronic device comprises: a memory for storing computer-executable instructions; A processor, configured to implement the data encryption method according to any one of claims 1 to 8 or the encrypted data decryption method according to any one of claims 9 to 10 when executing the computer-executable instructions stored in the memory.

14. A computer-readable storage medium storing computer-executable instructions or a computer program, characterized in that: When the computer executable instructions or computer program are executed by a processor, the data encryption method according to any one of claims 1 to 8 or the encrypted data decryption method according to any one of claims 9 to 10 is implemented.

15. A computer program product comprising computer executable instructions or a computer program, characterized in that When the computer executable instructions or computer program are executed by a processor, the data encryption method according to any one of claims 1 to 8 or the encrypted data decryption method according to any one of claims 9 to 10 is implemented.

Images