Data encryption method and device, server, storage medium and program product

Abstract

The invention relates to a data encryption method and device, a server, a storage medium and a program product. The method comprises the following steps: under the condition that a remote video redirection KVM session request sent by a terminal is received, determining a target encryption strategy for transmitting KVM data based on the type of the KVM session request and a candidate encryption strategy set, and sending the target encryption strategy to the terminal; the candidate encryption strategy set is an encryption strategy set supported by both the terminal and the server; and based on the target encryption strategy, performing encryption and decryption processing on the KVM data. By adopting the method, the security of KVM data encryption can be improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a data encryption method, device, server, storage medium and program product. Background Art

[0002] With the rapid development of information technology, servers are playing an increasingly important role in various industries. To facilitate remote management and maintenance of servers, server remote management technology has emerged. During remote server management, the security of remote video redirection (Keyboard, Video, Mouse, KVM) data is crucial.

[0003] In traditional technologies, KVM data is encrypted using an encryption algorithm in a baseboard management controller (BMC).

[0004] However, traditional technologies may have the problem of poor KVM data encryption security. Summary of the Invention

[0005] Based on this, it is necessary to provide a data encryption method, device, server, storage medium and program product that can improve the security of KVM data encryption in response to the above technical problems.

[0006] In a first aspect, the present application provides a data encryption method, the method comprising:

[0007] Upon receiving a remote video redirection KVM session request sent by a terminal, determining a target encryption policy for transmitting KVM data based on the type of the KVM session request and a candidate encryption policy set, and sending the target encryption policy to the terminal; the candidate encryption policy set is a set of encryption policies supported by both the terminal and the server;

[0008] Based on the target encryption policy, the KVM data is encrypted and decrypted.

[0009] In the above data encryption method, since the candidate encryption policy set is a set of encryption policies supported by both the terminal and the server, when the server receives a remote video redirection KVM session request sent by the terminal, the server can flexibly determine the target encryption policy for transmitting KVM data from the candidate encryption policy set based on the type of KVM session request. The target encryption policy can be flexibly configured according to actual needs to meet different security level requirements. Then, based on the target encryption policy, the KVM data can be better encrypted and decrypted to effectively prevent the data from being stolen or tampered with.

[0010] In one embodiment, determining a target encryption policy for transmitting KVM data based on the type of the KVM session request and the candidate encryption policy set includes:

[0011] If the type of the KVM session request is a video data session, determining the target encryption policy from the first type of encryption policies in the candidate encryption policy set;

[0012] If the type of the KVM session request is a keyboard data session, determining the target encryption policy from a second type of encryption policy in the candidate encryption policy set; the encryption strength of the second type of encryption policy is lower than the encryption strength of the first type of encryption policy;

[0013] If the type of the KVM session request is a mouse data session, the target encryption policy is determined from a third type of encryption policy in the candidate encryption policy set; the encryption strength of the third type of encryption policy is lower than the encryption strength of the second type of encryption policy.

[0014] In this embodiment, if the type of KVM session request is a video data session, the target encryption policy can be determined from the first type of encryption policy in the candidate encryption policy set; if the type of KVM session request is a keyboard data session, the target encryption policy can be determined from the second type of encryption policy in the candidate encryption policy set, and the encryption strength of the second type of encryption policy is lower than the encryption strength of the first type of encryption policy; if the type of KVM session request is a mouse data session, the target encryption policy can be determined from the third type of encryption policy in the candidate encryption policy set, and the encryption strength of the third type of encryption policy is lower than the encryption strength of the second type of encryption policy. In this way, different encryption strategies can be used for different types of KVM data, and a lightweight encryption algorithm can be selected according to the data type to reduce performance overhead, or a high-strength encryption algorithm can be selected to improve security.

[0015] In one embodiment, determining the target encryption policy from the first type of encryption policies in the candidate encryption policy set includes any one of the following:

[0016] If the video frame rate of the video data is higher than a preset threshold, determining the first encryption strategy in the first type of encryption strategy as the target encryption strategy;

[0017] If the network bandwidth between the server and the terminal is lower than a preset threshold, the second encryption policy in the first type of encryption policy is determined as the target encryption policy; the encryption strength of the first encryption policy is greater than the encryption strength of the second encryption policy.

[0018] In this embodiment, when the type of the KVM session request is a video data session, by flexibly selecting an encryption strategy and optimizing a key management mechanism, stronger KVM data protection can be provided to effectively prevent data from being stolen or tampered with.

[0019] In one embodiment, determining the target encryption policy from the second type of encryption policies in the candidate encryption policy set includes:

[0020] If the keyboard data includes the target character, the encryption strategy with the strongest encryption strength in the second type of encryption strategy is determined as the target encryption strategy.

[0021] In this embodiment, when the target characters are included in the keyboard data, the encryption strategy with the strongest encryption strength in the second type of encryption strategy is determined as the target encryption strategy for the keyboard data. By adjusting the encryption strategy of the keyboard data in real time, the security of the keyboard data encryption is ensured.

[0022] In one embodiment, the target encryption policy includes at least a target key length, and the method further includes:

[0023] Based on a preset adjustment period, the target key length is adjusted.

[0024] In this embodiment, the target key length of the same target encryption policy is adjusted based on a preset adjustment period, which can improve the security of the key, reduce the risk of key leakage, and ensure the security of KVM data transmission.

[0025] In one embodiment, the method further comprises:

[0026] When the KVM session request ends, the target encryption policy is deleted.

[0027] In this embodiment, when the KVM session request ends, the server deletes its own target encryption policy, which can prevent the leakage of the encryption policy of the KVM data transmitted by this KVM session request and ensure the security protection of the KVM data transmission.

[0028] In a second aspect, the present application further provides a data encryption device, comprising:

[0029] a determination module configured to, upon receiving a remote video redirection KVM session request sent by a terminal, determine a target encryption policy for transmitting KVM data based on the type of the KVM session request and a candidate encryption policy set, and send the target encryption policy to the terminal; the candidate encryption policy set being a set of encryption policies supported by both the terminal and the server;

[0030] The encryption and decryption module is used to encrypt and decrypt the KVM data based on the target encryption policy.

[0031] In a third aspect, the present application further provides a server, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0032] Upon receiving a remote video redirection KVM session request sent by a terminal, determining a target encryption policy for transmitting KVM data based on the type of the KVM session request and a candidate encryption policy set, and sending the target encryption policy to the terminal; the candidate encryption policy set is a set of encryption policies supported by both the terminal and the server;

[0033] Based on the target encryption policy, the KVM data is encrypted and decrypted.

[0034] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0035] Upon receiving a remote video redirection KVM session request sent by a terminal, determining a target encryption policy for transmitting KVM data based on the type of the KVM session request and a candidate encryption policy set, and sending the target encryption policy to the terminal; the candidate encryption policy set is a set of encryption policies supported by both the terminal and the server;

[0036] Based on the target encryption policy, the KVM data is encrypted and decrypted.

[0037] In a fifth aspect, the present application further provides a computer program product, comprising a computer program, which, when executed by a processor, implements the following steps:

[0038] Upon receiving a remote video redirection KVM session request sent by a terminal, determining a target encryption policy for transmitting KVM data based on the type of the KVM session request and a candidate encryption policy set, and sending the target encryption policy to the terminal; the candidate encryption policy set is a set of encryption policies supported by both the terminal and the server;

[0039] Based on the target encryption policy, the KVM data is encrypted and decrypted.

[0040] The above-mentioned data encryption method, device, server, storage medium and program product, since the candidate encryption policy set is a set of encryption policies supported by both the terminal and the server, when the server receives a remote video redirection KVM session request sent by the terminal, the server can flexibly determine the target encryption policy for transmitting KVM data from the candidate encryption policy set based on the type of KVM session request, and can flexibly configure the target encryption policy according to actual needs to meet different security level requirements. Then, based on the target encryption policy, the KVM data can be better encrypted and decrypted to effectively prevent the data from being stolen or tampered with. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the following briefly introduces the drawings required for use in the embodiments of the present application or related technical descriptions. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying any creative work.

[0042] Figure 1 A diagram showing an application environment of a data encryption method in one embodiment;

[0043] Figure 2 Schematic diagram of a data encryption method according to an embodiment;

[0044] Figure 3 A schematic diagram of interaction between a terminal and a server in one embodiment;

[0045] Figure 4 A schematic flow chart of a data transmission method in another embodiment;

[0046] Figure 5 is a structural block diagram of a data transmission device in one embodiment;

[0047] Figure 6 FIG. 4 is a diagram showing the internal structure of a server in one embodiment. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0049] The data encryption method provided in the embodiment of the present application can be applied to Figure 1In the application environment shown, terminal 102 communicates with server 104 via a network to enable remote management of server 104. Terminal 102 may be, but is not limited to, various personal computers, laptops, smartphones, tablets, drones, low-altitude aircraft, IoT devices, and portable wearable devices. IoT devices may include smart speakers, smart TVs, smart air conditioners, smart car devices, and projection devices. Portable wearable devices may include smart watches, smart bracelets, and head-mounted devices. Head-mounted devices may include virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, and the like. Server 104 may be an independent physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server providing cloud computing services.

[0050] In an exemplary embodiment, Figure 2 As shown, a data encryption method is provided, which is applied to Figure 1 The following steps are used as an example to illustrate the server in the example:

[0051] S201, when receiving a remote video redirection KVM session request sent by a terminal, determine the target encryption policy for transmitting KVM data based on the type of KVM session request and the candidate encryption policy set, and send the target encryption policy to the terminal; the candidate encryption policy set is a set of encryption policies supported by both the terminal and the server.

[0052] Among them, remote video redirection (Keyboard, Video, Mouse, KVM) is a technology based on remote management of servers. Through KVM, operation and maintenance personnel can operate the server as if they were locally, such as system installation and troubleshooting.

[0053] Figure 3 A schematic diagram of the flow of KVM data is shown. Figure 3 As shown in the figure, the video engine inside the server's baseboard management controller (BMC) obtains the server's video data through the PCI bus, and supplies it to the application layer in the form of device node / dev / video0, and finally renders and displays it through the terminal's KVM interface.

[0054] For example, the candidate encryption policy set in this embodiment can be a set of encryption policies supported by both the server and the terminal, determined through encryption policy negotiation by means of pre-dynamic configuration, dynamic negotiation, etc. As an example, the encryption policy may include an encryption algorithm, key length, encryption mode, etc.

[0055] Optionally, the types of KVM session requests in this embodiment may include video data sessions, keyboard data sessions, and mouse data sessions. For example, the server can dynamically adjust the encryption policy based on the type and characteristics of the captured KVM data (e.g., the frequency of video frame changes, the frequency of keyboard and mouse operations, etc.). For example, when the video image changes little, the encryption strength can be reduced to save resources; when sensitive information is detected when the user enters, a higher-strength encryption algorithm can be automatically switched.

[0056] In this embodiment, upon receiving a KVM session request from a terminal, the server can negotiate and determine a target encryption policy from a set of encryption policies supported by both the server and the terminal based on the type of the KVM session request. Furthermore, the server can send the determined target encryption policy to the terminal so that the terminal can also use the target encryption policy to encrypt and decrypt KVM data.

[0057] As an optional implementation, after the terminal receives the target encryption policy sent by the server, if the target encryption policy needs to be re-determined, the terminal can send a re-determination instruction to the server, so that the server re-determines a new target encryption policy from the candidate encryption policy set based on the type of KVM session request.

[0058] It's understandable that the encryption and decryption processes require the same key. Key generation, exchange, and management are crucial. During the key exchange / retrieval phase, the terminal obtains the key used for decryption. This key must match the key used by the server's BMC encryption engine. This can be achieved through various secure key exchange protocols (such as Diffie-Hellman) or certificate-based authentication. For example, the server and terminal can use the Diffie-Hellman key exchange protocol to generate session keys, or the terminal can obtain the server's public key through certificate verification. Additionally, optimized key management mechanisms can be used to manage keys, such as using a hardware security module to store keys or using secure key exchange protocols to ensure key security.

[0059] S202: Encrypt and decrypt the KVM data based on the target encryption policy.

[0060] In this embodiment, when the server sends KVM data to the terminal, the server can use the target encryption strategy to encrypt the KVM data and send the encrypted KVM data to the terminal; when the server receives the KVM data sent by the terminal, it can use the decryption strategy corresponding to the target encryption strategy to decrypt the received KVM to obtain the decrypted KVM data.

[0061] Optionally, in this embodiment, if the BMC of the server supports hardware encryption acceleration, the hardware acceleration function can be used preferentially to improve the efficiency of heap KVM data encryption and decryption and reduce the CPU load.

[0062] Additionally, server-side encrypted KVM data must be encapsulated in a specific format, including the encrypted data itself, the encryption algorithm identifier, the key identifier, and any other parameters that may be required (such as IV and authentication tags). The terminal must parse the received data packets in the same format to correctly extract and decrypt the encrypted data.

[0063] In the above data encryption method, since the candidate encryption policy set is a set of encryption policies supported by both the terminal and the server, when the server receives a remote video redirection KVM session request sent by the terminal, the server can flexibly determine the target encryption policy for transmitting KVM data from the candidate encryption policy set based on the type of KVM session request. The target encryption policy can be flexibly configured according to actual needs to meet different security level requirements. Then, based on the target encryption policy, the KVM data can be better encrypted and decrypted to effectively prevent the data from being stolen or tampered with.

[0064] In this embodiment, the detailed process of determining the target encryption strategy for transmitting KVM data by the server is explained. Figure 4 As shown, the above "determining a target encryption policy for transmitting KVM data based on the type of KVM session request and the candidate encryption policy set" in S201 includes:

[0065] S301: If the type of the KVM session request is a video data session, determine a target encryption policy from a first type of encryption policy in a candidate encryption policy set.

[0066] S302: If the type of the KVM session request is a keyboard data session, determine a target encryption policy from the second type of encryption policies in the candidate encryption policy set; the encryption strength of the second type of encryption policies is lower than the encryption strength of the first type of encryption policies.

[0067] S303: If the type of the KVM session request is a mouse data session, determine a target encryption policy from the third type of encryption policies in the candidate encryption policy set; the encryption strength of the third type of encryption policies is lower than the encryption strength of the second type of encryption policies.

[0068] Exemplarily, in this embodiment, the server may determine a target encryption policy for transmitting KVM data based on a mapping table of KVM session request types and encryption policies shown in Table 1.

[0069] Table 1

[0070] Data Type Encryption method Encryption strength Keyboard data AES-GCM High-strength encryption Mouse data AES-CBC Medium-strength encryption Video data ChaCha20 High-performance encryption

[0071] In this embodiment, if the server determines that the KVM session request is a video data session, it can determine a target encryption policy from the first type of encryption policy in the candidate encryption policy set. If the server determines that the KVM session request is a keyboard data session, it can determine a target encryption policy from the second type of encryption policy in the candidate encryption policy set. If the server determines that the KVM session request is a mouse data session, it can determine a target encryption policy from the third type of encryption policy in the candidate encryption policy set. The encryption strength of the second type of encryption policy is lower than that of the first type of encryption policy, and the encryption strength of the third type of encryption policy is lower than that of the second type of encryption policy. That is, the encryption strength for video data sessions is the highest, followed by the encryption strength for keyboard data sessions, which is lower than that for video data sessions, and the encryption strength for mouse data sessions, which is lower than that for keyboard data sessions.

[0072] In this embodiment, if the type of KVM session request is a video data session, the target encryption policy can be determined from the first type of encryption policy in the candidate encryption policy set; if the type of KVM session request is a keyboard data session, the target encryption policy can be determined from the second type of encryption policy in the candidate encryption policy set, and the encryption strength of the second type of encryption policy is lower than the encryption strength of the first type of encryption policy; if the type of KVM session request is a mouse data session, the target encryption policy can be determined from the third type of encryption policy in the candidate encryption policy set, and the encryption strength of the third type of encryption policy is lower than the encryption strength of the second type of encryption policy. In this way, different encryption strategies can be used for different types of KVM data, and a lightweight encryption algorithm can be selected according to the data type to reduce performance overhead, or a high-strength encryption algorithm can be selected to improve security.

[0073] In this embodiment, the detailed process of determining the target encryption policy for KVM data when the type of the KVM session request is a video data session is further explained. In an exemplary embodiment, the above S301 includes any one of the following:

[0074] In step A, if the video frame rate of the video data is higher than a preset threshold, the first encryption strategy in the first type of encryption strategy is determined as the target encryption strategy.

[0075] In this embodiment, if the video frame rate of the video data is higher than a preset threshold, the encryption strategy can be switched to an encryption strategy with higher performance. That is, the encryption strength of the encryption strategy for encrypting the video data can be improved at this time. For example, the first encryption strategy in the first category of encryption strategies can be determined as the target encryption strategy, wherein the encryption strength of the first encryption strategy is greater than the strengths of other encryption strategies in the first category of encryption strategies.

[0076] In step B, if the network bandwidth between the server and the terminal is lower than a preset threshold, the second encryption policy in the first type of encryption policy is determined as the target encryption policy; the encryption strength of the first encryption policy is greater than the encryption strength of the second encryption policy.

[0077] In this embodiment, if the network bandwidth between the server and the terminal is lower than a preset threshold, that is, when the network bandwidth is limited, the encryption strength of the video data can be reduced to reduce the transmission pressure. For example, the second encryption strategy in the first type of encryption strategy can be determined as the target encryption strategy, wherein the encryption strength of the second encryption strategy is lower than the encryption strength of the above-mentioned first encryption strategy.

[0078] In this embodiment, when the type of the KVM session request is a video data session, by flexibly selecting an encryption strategy and optimizing a key management mechanism, stronger KVM data protection can be provided to effectively prevent data from being stolen or tampered with.

[0079] In some scenarios, keyboard data may include some sensitive characters (e.g., input in a password input box). This embodiment further explains how to determine the encryption strategy for keyboard data. In an exemplary embodiment, the above S302 includes:

[0080] Step C: If the keyboard data includes the target character, the encryption strategy with the strongest encryption strength in the second type of encryption strategy is determined as the target encryption strategy.

[0081] In this embodiment, when keyboard data contains target characters, which may be sensitive characters (e.g., characters entered in a password input box), the encryption strength of the keyboard data may be temporarily increased. As an optional implementation, the strongest encryption strategy among the second type of encryption strategies described above may be determined as the target encryption strategy for the keyboard data.

[0082] In this embodiment, when the target characters are included in the keyboard data, the encryption strategy with the strongest encryption strength in the second type of encryption strategy is determined as the target encryption strategy for the keyboard data. By adjusting the encryption strategy of the keyboard data in real time, the security of the keyboard data encryption is ensured.

[0083] As described in the above embodiment, the target encryption policy includes at least a target key length. In an exemplary embodiment, the above method further includes:

[0084] Step D: Adjust the target key length based on a preset adjustment period.

[0085] In this embodiment, the target key length for the same target encryption policy can be dynamically adjusted based on a preset adjustment period. For example, the adjustment period can be set using interfaces such as the WebUI and Redfish. When the server detects that the transmission time exceeds the preset adjustment period, it notifies the terminal to change the target key length of the target encryption policy, ensuring the security of KVM data transmission.

[0086] In this embodiment, the target key length of the same target encryption policy is adjusted based on a preset adjustment period, which can improve the security of the key, reduce the risk of key leakage, and ensure the security of KVM data transmission.

[0087] Based on the above embodiment, in order to ensure the security of KVM data transmitted between the server and the terminal, it is necessary to determine the target encryption policy for each transmission before transmitting KVM data. In an exemplary embodiment, the above method further includes:

[0088] Step E: When the KVM session request ends, delete the target encryption policy.

[0089] In this embodiment, when the KVM session request ends, the server and terminal can clear their respective target encryption policies to avoid leakage of the encryption policies during the KVM data transmission process and improve the security of KVM data protection. For example, after deleting the target encryption policy in its own server, the server can send a deletion instruction to the terminal, instructing the terminal to delete the target encryption policy determined this time.

[0090] In this embodiment, when the KVM session request ends, the server deletes its own target encryption policy, which can prevent the leakage of the encryption policy of the KVM data transmitted by this KVM session request and ensure the security protection of the KVM data transmission.

[0091] The following is a complete example to illustrate the data encryption method provided in the embodiment of the present application:

[0092] S1: Upon receiving a remote video redirection KVM session request sent by a terminal, determine the type of the KVM session request.

[0093] S2. If the KVM session request type is a video data session, a target encryption policy is determined from a first category of encryption policies in a candidate encryption policy set; the candidate encryption policy set is a set of encryption policies supported by both the terminal and the server. Furthermore, if the video frame rate of the video data is higher than a preset threshold, a first encryption policy in the first category of encryption policies is determined as the target encryption policy. If the network bandwidth between the server and the terminal is lower than a preset threshold, a second encryption policy in the first category of encryption policies is determined as the target encryption policy. The encryption strength of the first encryption policy is greater than the encryption strength of the second encryption policy.

[0094] S3. If the KVM session request is a keyboard data session, a target encryption policy is determined from a second category of encryption policies in the candidate encryption policy set; the encryption strength of the second category of encryption policies is lower than the encryption strength of the first category of encryption policies. Furthermore, if the keyboard data includes the target character, the encryption policy with the strongest encryption strength among the second category of encryption policies is determined as the target encryption policy.

[0095] S4, if the type of the KVM session request is a mouse data session, determining a target encryption policy from a third type of encryption policy in the candidate encryption policy set; the encryption strength of the third type of encryption policy is lower than the encryption strength of the second type of encryption policy.

[0096] S5: Encrypt and decrypt the KVM data based on the target encryption policy.

[0097] S6: Adjust the target key length based on a preset adjustment period.

[0098] S7: When the KVM session request ends, the target encryption policy in the server and the terminal is deleted.

[0099] For the description of S1-S7, please refer to the description in the above embodiment. The implementation principles and effects are the same and will not be repeated in this embodiment.

[0100] It should be understood that, although the various steps in the flowcharts involved in the above embodiments are displayed in sequence according to the instructions of the arrows, these steps are not necessarily performed in sequence in the order indicated by the arrows. Unless clearly stated herein, the execution of these steps is not strictly limited in order, and these steps can be performed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily performed at the same time, but can be performed at different times, and the execution order of these steps or stages is not necessarily performed in sequence, but can be performed in turn or alternately with at least a portion of the steps or stages in other steps or other steps. It is understandable that the various steps in different embodiments can be freely combined as needed, and the various non-contradictory schemes formed by the combination all fall within the scope of protection of this application.

[0101] Based on the same inventive concept, embodiments of the present application also provide a data encryption device for implementing the aforementioned data encryption method. The implementation solution provided by this device is similar to the implementation solution described in the aforementioned method. Therefore, the specific limitations of one or more data encryption device embodiments provided below can be found in the above-mentioned limitations of the data encryption method and will not be repeated here.

[0102] In an exemplary embodiment, Figure 5 As shown, a data encryption device is provided, comprising: a determination module and an encryption / decryption module, wherein:

[0103] The determination module is used to determine the target encryption policy for transmitting KVM data based on the type of KVM session request and the candidate encryption policy set when receiving a remote video redirection KVM session request sent by the terminal, and send the target encryption policy to the terminal; the candidate encryption policy set is a set of encryption policies supported by both the terminal and the server.

[0104] The encryption and decryption module is used to encrypt and decrypt KVM data based on the target encryption strategy.

[0105] The data encryption device provided in this embodiment can execute the above method embodiment. Its implementation principle and technical effects are similar and will not be repeated here.

[0106] In one embodiment, the determination module includes: a first determination unit, a second determination unit, and a third determination unit, wherein:

[0107] The first determining unit is configured to determine a target encryption policy from a first type of encryption policy in a candidate encryption policy set if the type of the KVM session request is a video data session.

[0108] The second determining unit is configured to determine a target encryption policy from a second type of encryption policy in the candidate encryption policy set if the type of the KVM session request is a keyboard data session; the encryption strength of the second type of encryption policy is lower than that of the first type of encryption policy.

[0109] The third determining unit is configured to determine a target encryption policy from a third type of encryption policy in the candidate encryption policy set if the type of the KVM session request is a mouse data session; the encryption strength of the third type of encryption policy is lower than that of the second type of encryption policy.

[0110] The data encryption device provided in this embodiment can execute the above method embodiment. Its implementation principle and technical effects are similar and will not be repeated here.

[0111] In one embodiment, the above-mentioned first determination unit is used to determine the first encryption strategy in the first category of encryption strategies as the target encryption strategy if the video frame rate of the video data is higher than a preset threshold; or, if the network bandwidth between the server and the terminal is lower than a preset threshold, determine the second encryption strategy in the first category of encryption strategies as the target encryption strategy; the encryption strength of the first encryption strategy is greater than the encryption strength of the second encryption strategy.

[0112] The data encryption device provided in this embodiment can execute the above method embodiment. Its implementation principle and technical effects are similar and will not be repeated here.

[0113] In one embodiment, the second determining unit is configured to determine the encryption strategy with the strongest encryption strength in the second type of encryption strategies as the target encryption strategy if the keyboard data includes the target character.

[0114] The data encryption device provided in this embodiment can execute the above method embodiment. Its implementation principle and technical effects are similar and will not be repeated here.

[0115] In one embodiment, the target encryption policy includes at least a target key length, and the apparatus further includes an adjustment module, wherein:

[0116] The adjustment module is used to adjust the target key length based on a preset adjustment period.

[0117] The data encryption device provided in this embodiment can execute the above method embodiment. Its implementation principle and technical effects are similar and will not be repeated here.

[0118] In one embodiment, the apparatus further comprises: a deletion module, wherein:

[0119] The deletion module is used to delete the target encryption policy when the KVM session request ends.

[0120] The data encryption device provided in this embodiment can execute the above method embodiment. Its implementation principle and technical effects are similar and will not be repeated here.

[0121] Each module in the above-mentioned data encryption device can be implemented in whole or in part through software, hardware, or a combination thereof. Each module can be embedded in or independent of the processor of the computer device in hardware form, or can be stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0122] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 6 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, abbreviated as I / O) and a communication interface. The processor, memory and input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the computer device is used to store a set of candidate encryption policies. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a data encryption method is implemented.

[0123] Those skilled in the art will understand that Figure 6 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0124] In an exemplary embodiment, a server is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0125] Upon receiving a remote video redirection KVM session request from a terminal, determining a target encryption policy for transmitting KVM data based on the type of the KVM session request and a candidate encryption policy set, and sending the target encryption policy to the terminal; the candidate encryption policy set is a set of encryption policies supported by both the terminal and the server;

[0126] Encrypt and decrypt KVM data based on the target encryption policy.

[0127] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0128] If the type of the KVM session request is a video data session, determining a target encryption policy from the first type of encryption policies in the candidate encryption policy set;

[0129] If the type of the KVM session request is a keyboard data session, a target encryption policy is determined from the second type of encryption policy in the candidate encryption policy set; the encryption strength of the second type of encryption policy is lower than the encryption strength of the first type of encryption policy;

[0130] If the type of the KVM session request is a mouse data session, a target encryption policy is determined from a third type of encryption policy in the candidate encryption policy set; the encryption strength of the third type of encryption policy is lower than the encryption strength of the second type of encryption policy.

[0131] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0132] If the video frame rate of the video data is higher than a preset threshold, determining the first encryption strategy in the first type of encryption strategy as the target encryption strategy;

[0133] If the network bandwidth between the server and the terminal is lower than a preset threshold, the second encryption policy in the first type of encryption policy is determined as the target encryption policy; the encryption strength of the first encryption policy is greater than the encryption strength of the second encryption policy.

[0134] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0135] If the keyboard data includes the target character, the encryption strategy with the strongest encryption strength in the second type of encryption strategy is determined as the target encryption strategy.

[0136] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0137] Adjust the target key length based on the preset adjustment period.

[0138] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0139] When the KVM session request ends, the target encryption policy is deleted.

[0140] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented:

[0141] Upon receiving a remote video redirection KVM session request from a terminal, determining a target encryption policy for transmitting KVM data based on the type of the KVM session request and a candidate encryption policy set, and sending the target encryption policy to the terminal; the candidate encryption policy set is a set of encryption policies supported by both the terminal and the server;

[0142] Encrypt and decrypt KVM data based on the target encryption policy.

[0143] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0144] If the type of the KVM session request is a video data session, determining a target encryption policy from the first type of encryption policies in the candidate encryption policy set;

[0145] If the type of the KVM session request is a keyboard data session, a target encryption policy is determined from the second type of encryption policy in the candidate encryption policy set; the encryption strength of the second type of encryption policy is lower than the encryption strength of the first type of encryption policy;

[0146] If the type of the KVM session request is a mouse data session, a target encryption policy is determined from a third type of encryption policy in the candidate encryption policy set; the encryption strength of the third type of encryption policy is lower than the encryption strength of the second type of encryption policy.

[0147] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0148] If the video frame rate of the video data is higher than a preset threshold, determining the first encryption strategy in the first type of encryption strategy as the target encryption strategy;

[0149] If the network bandwidth between the server and the terminal is lower than a preset threshold, the second encryption policy in the first type of encryption policy is determined as the target encryption policy; the encryption strength of the first encryption policy is greater than the encryption strength of the second encryption policy.

[0150] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0151] If the keyboard data includes the target character, the encryption strategy with the strongest encryption strength in the second type of encryption strategy is determined as the target encryption strategy.

[0152] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0153] Adjust the target key length based on the preset adjustment period.

[0154] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0155] When the KVM session request ends, the target encryption policy is deleted.

[0156] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0157] Upon receiving a remote video redirection KVM session request from a terminal, determining a target encryption policy for transmitting KVM data based on the type of the KVM session request and a candidate encryption policy set, and sending the target encryption policy to the terminal; the candidate encryption policy set is a set of encryption policies supported by both the terminal and the server;

[0158] Encrypt and decrypt KVM data based on the target encryption policy.

[0159] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0160] If the type of the KVM session request is a video data session, determining a target encryption policy from the first type of encryption policies in the candidate encryption policy set;

[0161] If the type of the KVM session request is a keyboard data session, a target encryption policy is determined from the second type of encryption policy in the candidate encryption policy set; the encryption strength of the second type of encryption policy is lower than the encryption strength of the first type of encryption policy;

[0162] If the type of the KVM session request is a mouse data session, a target encryption policy is determined from a third type of encryption policy in the candidate encryption policy set; the encryption strength of the third type of encryption policy is lower than the encryption strength of the second type of encryption policy.

[0163] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0164] If the video frame rate of the video data is higher than a preset threshold, determining the first encryption strategy in the first type of encryption strategy as the target encryption strategy;

[0165] If the network bandwidth between the server and the terminal is lower than a preset threshold, the second encryption policy in the first type of encryption policy is determined as the target encryption policy; the encryption strength of the first encryption policy is greater than the encryption strength of the second encryption policy.

[0166] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0167] If the keyboard data includes the target character, the encryption strategy with the strongest encryption strength in the second type of encryption strategy is determined as the target encryption strategy.

[0168] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0169] Adjust the target key length based on the preset adjustment period.

[0170] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0171] When the KVM session request ends, the target encryption policy is deleted.

[0172] Those skilled in the art will understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. In particular, any reference to memory, database, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The databases involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the various embodiments provided herein may be, but are not limited to, general-purpose processors, central processing units (CPUs), graphics processing units (GPUs), digital signal processors (DSPs), programmable logic devices (PLDs), quantum computing-based data processing logic devices, artificial intelligence (AI) processors, and the like.

[0173] The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0174] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. A data encryption method, characterized in that: The method comprises: Upon receiving a remote video redirection KVM session request sent by a terminal, determining a target encryption policy for transmitting KVM data based on the type of the KVM session request and a candidate encryption policy set, and sending the target encryption policy to the terminal; the candidate encryption policy set is a set of encryption policies supported by both the terminal and the server; Based on the target encryption policy, the KVM data is encrypted and decrypted.

2. The method according to claim 1, characterized in that The determining, based on the type of the KVM session request and the candidate encryption policy set, a target encryption policy for transmitting KVM data includes: If the type of the KVM session request is a video data session, determining the target encryption policy from the first type of encryption policies in the candidate encryption policy set; If the type of the KVM session request is a keyboard data session, determining the target encryption policy from a second type of encryption policy in the candidate encryption policy set; the encryption strength of the second type of encryption policy is lower than the encryption strength of the first type of encryption policy; If the type of the KVM session request is a mouse data session, the target encryption policy is determined from a third type of encryption policy in the candidate encryption policy set; the encryption strength of the third type of encryption policy is lower than the encryption strength of the second type of encryption policy.

3. The method according to claim 2, characterized in that Determining the target encryption policy from the first type of encryption policies in the candidate encryption policy set includes any one of the following: If the video frame rate of the video data is higher than a preset threshold, determining the first encryption strategy in the first type of encryption strategy as the target encryption strategy; If the network bandwidth between the server and the terminal is lower than a preset threshold, the second encryption policy in the first type of encryption policy is determined as the target encryption policy; the encryption strength of the first encryption policy is greater than the encryption strength of the second encryption policy.

4. The method according to claim 2, characterized in that Determining the target encryption policy from the second type of encryption policies in the candidate encryption policy set includes: If the keyboard data includes the target character, the encryption strategy with the strongest encryption strength in the second type of encryption strategy is determined as the target encryption strategy.

5. The method according to any one of claims 1 to 4, characterized in that The target encryption policy includes at least a target key length, and the method further includes: Based on a preset adjustment period, the target key length is adjusted.

6. The method according to claim 1, characterized in that The method further comprises: When the KVM session request ends, the target encryption policy is deleted.

7. A data encryption device, characterized in that: The device comprises: a determination module configured to, upon receiving a remote video redirection KVM session request sent by a terminal, determine a target encryption policy for transmitting KVM data based on the type of the KVM session request and a candidate encryption policy set, and send the target encryption policy to the terminal; the candidate encryption policy set being a set of encryption policies supported by both the terminal and the server; The encryption and decryption module is used to encrypt and decrypt the KVM data based on the target encryption policy.

8. A server comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images