Data adaptive encryption method based on ai analysis and related device

Abstract

The application provides an AI analysis-based data adaptive encryption method and related equipment, which comprises the following steps: obtaining plaintext data to be encrypted containing metadata describing a data structure; extracting the metadata from the plaintext data and inputting the metadata into an AI model to obtain use scenario information, use purpose information and data characteristic information; matching a symmetric encryption algorithm and an asymmetric encryption algorithm according to the scenario information, the use purpose information and the data characteristic information; if the matching result is the symmetric encryption algorithm, encrypting the plaintext data through the symmetric encryption algorithm to obtain a first encryption result in combination with the metadata; and if the matching result is the asymmetric encryption algorithm, performing sampling encryption on the plaintext data through the asymmetric encryption algorithm based on the scenario to determine an encryption density, and then obtaining a second encryption result in combination with the metadata. The metadata of the plaintext is analyzed through AI to dynamically match the encryption algorithm, the characteristics of the symmetric and asymmetric algorithms are taken into account, and the encryption mode is more flexible and efficient.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data encryption, and in particular to a data adaptive encryption method based on AI analysis and related equipment. BACKGROUND

[0002] With the rapid development of digital economy, the demand for secure storage and transmission of data is increasingly urgent. Encryption technology, as the core means of data security, is currently mainly divided into symmetric encryption and asymmetric encryption.

[0003] Symmetric encryption algorithms have the advantages of high encryption efficiency and small computational overhead, but key management is difficult, and are suitable for large data volume and low to medium security requirement scenarios. Asymmetric encryption algorithms achieve high security through public and private key separation and are suitable for small data volume and high security requirement cross-subject communication scenarios, but have low encryption efficiency and high computational cost, making it difficult to meet real-time processing requirements for large data volume.

[0004] Existing data encryption mostly uses a one-size-fits-all algorithm selection, which cannot dynamically adjust the encryption strategy according to the characteristics of the data itself and the application scenario, resulting in a compromise between encryption and efficiency.

[0005] Therefore, the prior art still needs to be improved and developed. SUMMARY

[0006] The present application provides a data adaptive encryption method based on AI analysis and related equipment, and the main purpose of the present application is to solve the technical problems mentioned in the background art of the prior art.

[0007] The first aspect of the present application provides a data adaptive encryption method based on AI analysis, comprising:

[0008] Obtaining plaintext data to be encrypted, the plaintext data containing metadata describing the data structure;

[0009] Extracting the metadata from the plaintext data and inputting the metadata into a pre-trained AI model for analysis to obtain usage scenario information, purpose information and data characteristic information of the plaintext data;

[0010] Matching a preset encryption algorithm according to the scenario information, the purpose information and the data characteristic information, the preset encryption algorithm including a symmetric encryption algorithm and an asymmetric encryption algorithm;

[0011] If the matching result is the symmetric encryption algorithm, then encrypting the plaintext data through the symmetric encryption algorithm to obtain a first encryption result in combination with the metadata;

[0012] If the matching result is the asymmetric encryption algorithm, a second encryption result is obtained by combining the metadata after sampling encryption of the plaintext data based on scene-determined encryption density through the asymmetric encryption algorithm.

[0013] In an optional implementation of the first aspect of the present application, if the matching result is the asymmetric encryption algorithm, obtaining a second encryption result by combining the metadata after sampling encryption of the plaintext data based on scene-determined encryption density through the asymmetric encryption algorithm comprises:

[0014] determining a scene sensitivity level based on the scene information if the matching result is the asymmetric encryption algorithm;

[0015] obtaining an encryption density interval of the plaintext data through the scene sensitivity level;

[0016] encrypting the plaintext data through the asymmetric encryption algorithm with the encryption density interval limit through a sampling encryption manner to obtain a ciphertext subject;

[0017] combining the ciphertext subject and the metadata to obtain the second encryption result.

[0018] In an optional implementation of the first aspect of the present application, encrypting the plaintext data through the asymmetric encryption algorithm with the encryption density interval limit through a sampling encryption manner to obtain a ciphertext subject comprises:

[0019] encrypting structured data, unstructured data and other data in the plaintext data in sequence with the encryption density interval as a guide;

[0020] classifying and encrypting the structured data in the plaintext data according to a field sensitivity matching encryption proportion manner;

[0021] encrypting the unstructured data in the plaintext data according to a random sampling manner;

[0022] grading and encrypting the other data in the plaintext data according to a data importance matching encryption proportion manner.

[0023] In an optional implementation of the first aspect of the present application, classifying and encrypting the structured data in the plaintext data according to a field sensitivity matching encryption proportion manner comprises:

[0024] respectively extracting sensitive fields, non-sensitive fields and other fields in the structured data;

[0025] The sensitive field is encrypted by 100% proportion, the non-sensitive field is extracted for encryption by a first preset proportion, and the other fields are not encrypted.

[0026] In an optional implementation of the first aspect of the present application, the encryption of the non-structured data in the plaintext data in a random sampling manner comprises:

[0027] Obtaining data block information in which the non-structured data exists;

[0028] Constructing a random number generator based on the data block information;

[0029] Obtaining a plurality of target data blocks through the random number generator;

[0030] Encrypting the non-structured data in the plurality of target data blocks.

[0031] In an optional implementation of the first aspect of the present application, the hierarchical encryption of the other data in the plaintext data according to the encryption proportion matching the data importance comprises:

[0032] Respectively extracting core data, ordinary data and redundant data in the other data;

[0033] Encrypting the core data by 100% proportion, extracting the ordinary data for encryption by a second preset proportion, and not encrypting the redundant data.

[0034] In an optional implementation of the first aspect of the present application, the matching of the preset encryption algorithm according to the scene information, the use information and the data characteristic information, the preset encryption algorithm comprising a symmetric encryption algorithm and an asymmetric encryption algorithm comprises:

[0035] Determining the real-time requirement of the plaintext data based on the scene information;

[0036] Determining the security requirement of the plaintext data based on the use information;

[0037] Determining the data volume requirement of the plaintext data based on the data characteristic information;

[0038] Matching the real-time requirement, the security requirement and the data volume requirement with a first condition table of the symmetric encryption algorithm and a second condition table of the asymmetric encryption algorithm respectively;

[0039] Determining the target encryption algorithm of the plaintext data based on the matching degree of the real-time requirement, the security requirement and the data volume requirement with the first condition table and the second condition table respectively.

[0040] The second aspect of the present application provides an AI analysis-based data adaptive encryption device, which comprises:

[0041] A plaintext acquisition module is configured to acquire plaintext data to be encrypted, wherein the plaintext data contains metadata describing a data structure.

[0042] An AI metadata analysis module is configured to extract the metadata from the plaintext data and input the metadata into a pre-trained AI model for analysis to obtain usage scenario information, purpose information, and data characteristic information of the plaintext data.

[0043] An encryption algorithm matching module is configured to match a preset encryption algorithm according to the scenario information, the purpose information, and the data characteristic information, wherein the preset encryption algorithm includes a symmetric encryption algorithm and an asymmetric encryption algorithm.

[0044] A symmetric encryption module is configured to, if the matching result is the symmetric encryption algorithm, encrypt the plaintext data through the symmetric encryption algorithm to obtain a first encryption result in combination with the metadata.

[0045] An asymmetric encryption module is configured to, if the matching result is the asymmetric encryption algorithm, perform sampling encryption on the plaintext data through the asymmetric encryption algorithm based on a scenario-determined encryption density to obtain a second encryption result in combination with the metadata.

[0046] The third aspect of the present application provides an AI analysis-based data adaptive encryption device, which comprises a memory and at least one processor, wherein the memory stores instructions, and the memory and the at least one processor are interconnected through a circuit.

[0047] The at least one processor invokes the instructions in the memory to enable the AI analysis-based data adaptive encryption device to perform the AI analysis-based data adaptive encryption method according to any one of the first aspect of the present application.

[0048] The fourth aspect of the present application provides a computer readable storage medium, which stores a computer program, wherein the computer program is executed by a processor to implement the AI analysis-based data adaptive encryption method according to any one of the first aspect of the present application.

[0049] Beneficial effects: the application provides a data adaptive encryption method based on AI analysis and related equipment, the method comprises the following steps: obtaining plaintext data to be encrypted containing metadata describing data structure; extracting metadata from the plaintext data and inputting the AI model to obtain use scenario information, purpose information and data characteristic information; matching the symmetric encryption algorithm and the asymmetric encryption algorithm according to the scenario information, the purpose information and the data characteristic information; if the matching result is the symmetric encryption algorithm, encrypting the plaintext data through the symmetric encryption algorithm to obtain a first encryption result combined with the metadata; if the matching result is the asymmetric encryption algorithm, performing sampling encryption on the plaintext data through the asymmetric encryption algorithm based on the scene to determine the encryption density, and obtaining a second encryption result combined with the metadata. The metadata of the plaintext is analyzed by the AI to dynamically match the encryption algorithm, the characteristics of the symmetric and asymmetric algorithms are considered, and the encryption mode is more flexible and efficient. BRIEF DESCRIPTION OF DRAWINGS

[0050] Figure 1 An embodiment schematic diagram of main steps of the data adaptive encryption method based on AI analysis of the application;

[0051] Figure 2 An embodiment schematic diagram of encryption logic of the data adaptive encryption method based on AI analysis of the application;

[0052] Figure 3 An embodiment schematic diagram of the data adaptive encryption device based on AI analysis of the application;

[0053] Figure 4 An embodiment schematic diagram of the data adaptive encryption device based on AI analysis of the application. DETAILED DESCRIPTION

[0054] The terms "first", "second", "third", "fourth" and the like in the description of the application and in the claims of the accompanying drawings, if any, are used for distinguishing between similar objects and not necessarily for describing a particular sequential or chronological order. It is to be understood that the use of the terms so termed herein is interchangeable under appropriate circumstances such that the embodiments described herein are, for example, capable of accomplishing operations in other than the illustrative order presented herein. Moreover, the terms "comprising" or "having" and variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, product or apparatus that comprises a list of steps or units not necessarily limited to those listed, but can include other not expressly listed steps or units inherent therein.

[0055] For the convenience of understanding, the specific flow of the embodiments of the application is described below. Please refer to Figure 1The first aspect of the application provides a data adaptive encryption method based on AI analysis, comprising:

[0056] S100, obtaining plaintext data to be encrypted, wherein the plaintext data contains metadata describing the data structure; in the application, the plaintext data is interactive data in the field of finance and taxation, and the security storage and interaction demand thereof are increasingly urgent. The finance and taxation data has unique characteristics of strong sensitive stratification, multi-type fusion, and large scene demand difference, and therefore requires flexible encryption strategies. The metadata includes data type, source IP, and timestamp.

[0057] S200, extracting the metadata from the plaintext data and inputting the metadata into a pre-trained AI model for analysis to obtain usage scenario information, purpose information, and data characteristic information of the plaintext data; in this step, the AI model inputs the metadata (non-sensitive information) of the plaintext data to be encrypted, and the AI model outputs the usage scenario (such as “cross-institutional medical data transmission”, “internal system log storage”) of the plaintext data, the application purpose (such as “private data sharing”, “data backup and archiving”), and the data characteristics (such as data volume), and the identification accuracy is not less than 95%.

[0058] In the application, the training data and the design of the AI model can adopt a supervised learning model (such as a random forest or a deep learning network), and the training data includes “scene labels” (such as “financial transaction”, “medical privacy”, and “public log”) and “sensitive level labels” (high / medium / low) of historical data and corresponding metadata characteristics (such as file type markers.finance.medical.log, data source IP, timestamp, and data volume). For example, a data set with a.medical marker and a hospital server source is labeled as “high-sensitive medical scenario”, and a data set with a.log marker and a public server source is labeled as “low-sensitive log scenario”, and the model is trained to learn the mapping relationship between the metadata and the scene.

[0059] S300, matching a preset encryption algorithm according to the scene information, the use information and the data characteristic information, the preset encryption algorithm including a symmetric encryption algorithm and an asymmetric encryption algorithm. The selection logic of the encryption algorithm in the present application can be summarized as follows: the symmetric encryption algorithm is suitable for the following scene. Large data volume (such as TB-level log, video stream): the symmetric encryption (such as AES) is fast (the encryption rate can reach more than 100 MB / s), is suitable for processing a large amount of data, and avoids the performance bottleneck of asymmetric encryption; the security requirement is medium (such as internal office files): the symmetric encryption security is sufficient, and the key management cost is lower than that of hybrid encryption; the real-time requirement is high (such as real-time monitoring data transmission): the symmetric encryption low delay (millisecond level response) can meet the real-time requirement. The asymmetric encryption algorithm is suitable for the following scene. Small data volume (such as key, instruction, certificate, byte level to KB level): the performance disadvantage of the asymmetric encryption (such as RSA, ECC) can be ignored under small data, and there is no need to worry about the security of key transmission; the security requirement is extremely high (such as financial, medical privacy data): the “public key encryption-private key decryption” mode of the asymmetric encryption can avoid the global risk caused by the leakage of the symmetric key; cross-subject communication (such as user-server data interaction): the asymmetric encryption does not need to share the key in advance, and is suitable for key management in a distributed scene.

[0060] In an optional embodiment of step S300 of the present application, the matching of the preset encryption algorithm according to the scene information, the use information and the data characteristic information includes: determining the real-time requirement of the plaintext data based on the scene information (for example, the real-time requirement of the scene is high in the financial transaction scene); determining the security requirement of the plaintext data based on the use information (for example, the security requirement is high in the privacy data sharing); determining the data volume requirement of the plaintext data based on the data characteristic information (for example, the data volume requirement is high when the data volume of the plaintext data is TB level); matching the real-time requirement, the security requirement and the data volume requirement with a first condition table (recording the requirement of the symmetric encryption algorithm for one or more of real-time, security and data volume) of the symmetric encryption algorithm and a second condition table (recording the requirement of the asymmetric encryption algorithm for one or more of real-time, security and data volume) of the asymmetric encryption algorithm respectively; and determining the target encryption algorithm of the plaintext data based on the matching degree of the real-time requirement, the security requirement and the data volume requirement with the first condition table and the second condition table respectively. In the present application, the more the same data items in the condition table that meet the real-time requirement, the security requirement and the data volume requirement, the higher the matching degree, and if the number of matching items is the same, the target algorithm is determined based on the importance of the matching characteristics.

[0061] S400, if the matching result is the symmetric encryption algorithm, then a first encryption result is obtained by combining the metadata after the plaintext data is encrypted by the symmetric encryption algorithm; in an exemplary conditional scenario of the present application, the symmetric encryption algorithm is mainly used in a data encryption scenario with large data volume, medium security and high real-time performance, and the main advantage of the symmetric encryption algorithm is high security, and the key length of the symmetric encryption algorithm can be adjusted as needed, thereby achieving very high security.

[0062] S500, if the matching result is the asymmetric encryption algorithm, then a second encryption result is obtained by combining the metadata after the plaintext data is sample encrypted based on a scene-determined encryption density by the asymmetric encryption algorithm; the advantage of the asymmetric encryption algorithm is flexible key management, each user has his own public key and private key, which makes the key management more flexible, and based on the characteristics of the symmetric encryption algorithm and the asymmetric encryption algorithm, symmetric encryption and asymmetric encryption can also be combined in an actual application of the present application to further balance security and performance. For example, the symmetric key is securely exchanged using the asymmetric encryption algorithm, and the actual data is encrypted using the symmetric encryption.

[0063] In an optional embodiment of step S500 of the present application, if the matching result is the asymmetric encryption algorithm, then a second encryption result is obtained by combining the metadata after the plaintext data is sample encrypted based on a scene-determined encryption density by the asymmetric encryption algorithm, which comprises:

[0064] S501, if the matching result is the asymmetric encryption algorithm, then a scene sensitivity level is determined based on the scene information; in the present application, the scene sensitivity level includes a high sensitivity scene (such as financial transactions, medical privacy), a medium sensitivity scene (such as user registration information) and a low sensitivity scene (such as public announcement backup).

[0065] S502, an encryption density interval of the plaintext data is obtained by the scene sensitivity level; encryption density definition. Encryption density = (encrypted data volume / total data volume) x 100%, according to the scene sensitivity level quantization threshold: high sensitivity scene: encryption density ≥ 90%; medium sensitivity scene: encryption density 50%-80%; low sensitivity scene: encryption density ≤ 30%.

[0066] S503, obtain ciphertext subjects by encrypting the plaintext data in the encryption density interval through a sampling encryption manner; in this step, the structured data, unstructured data and other data in the plaintext data can be encrypted in sequence according to the encryption density interval (when the plaintext encryption density reaches the lower limit or upper limit of the encryption density interval, the encryption process stops); the structured data in the plaintext data is classified and encrypted according to a field sensitivity matching encryption proportion; the unstructured data in the plaintext data is encrypted according to a random sampling manner; and the other data in the plaintext data is classified and encrypted according to a data importance matching encryption proportion. The application reduces the data amount of high-density-level encryption through sampling encryption, improves the encryption rate by 30%-60% (especially for big data scenarios) while ensuring security, and reduces the consumption of computing resources (CPU / memory) by more than 40%; is compatible with mainstream encryption standards (such as AES-256, RSA-2048 and ECC-256), can be directly integrated into existing systems, and reduces the interface development cost; through AI accurate identification of scenarios and encryption density matching, the encryption coverage of high-sensitivity data is greater than or equal to 90%, and performance waste caused by excessive encryption or security risks caused by insufficient encryption is avoided.

[0067] More specifically, the classified encryption of the structured data in the plaintext data according to the field sensitivity matching encryption proportion includes: extracting sensitive fields, non-sensitive fields and other fields in the structured data respectively; encrypting the sensitive fields at a 100% proportion, encrypting the non-sensitive fields at a first preset proportion, and not encrypting the other fields. In the application, the structured data (such as a database table) is encrypted by field, and only the sensitive fields (such as an ID number and a bank card number) are encrypted, and the non-sensitive fields (such as gender and region) are in plaintext. For example, in a user table, the mobile phone number and the payment password are encrypted (accounting for 60%, meeting the medium sensitive scenario density), and the remaining fields are in plaintext.

[0068] The unstructured data in the plaintext data is encrypted according to a random sampling manner, which includes: obtaining data block information of the unstructured data; constructing a random number generator based on the data block information; obtaining a plurality of target data blocks through the random number generator; and encrypting the unstructured data in the plurality of target data blocks. In the application, the unstructured data (such as logs and video streams) is sampled and encrypted in proportion, and data blocks are randomly selected for encryption through a pseudo-random number generator (seed and data hash value are bound to ensure unpredictability). For example, 20% of the entries in low-sensitive logs are randomly sampled and encrypted (meeting the density of less than or equal to 30%), and the remaining entries are in plaintext but with a hash check value.

[0069] The hierarchical encryption according to the encryption proportion of data importance for the other data in the plaintext data comprises: respectively extracting core data, ordinary data and redundant data in the other data; performing 100% proportion encryption on the core data, performing second preset proportion encryption on the ordinary data, and not performing encryption on the redundant data. In the present application, the hierarchical encryption (such as core-ordinary-redundant data) is as follows: the core data (such as transaction amount and medical record diagnosis result) is 100% encrypted, the ordinary data (such as transaction time and examination item) is 50% encrypted, and the redundant data (such as repeated check field) is not encrypted.

[0070] S504, combining the ciphertext body and the metadata to obtain the second encryption result. Referring to Figure 2 In brief, the simple logic of the encryption process of the present application can be as follows: input plaintext data (containing metadata), extract metadata (plaintext) and input an AI model to identify the scene and purpose; select symmetric / asymmetric encryption algorithm based on the scene and data characteristics (such as ECC for high-sensitivity small data and AES for low-sensitivity large data); encrypt the data according to the encryption density corresponding to the scene by using the above sampling strategy to generate mixed data of “plaintext metadata + ciphertext body”; the encrypted data can be safely transmitted or stored, and the ciphertext part is decrypted only by the corresponding key, and the plaintext metadata is used for the receiving party to identify the data structure (without sensitive information).

[0071] The main technical means used by the AI analysis-based data adaptive encryption method of the present application are as follows: AI technology is used to identify the data use scene and application purpose, specifically by training a model based on metadata characteristics to realize accurate mapping of the scene and the sensitivity level; a single encryption algorithm (symmetric or asymmetric) is selected based on data characteristics (data volume, security requirement, real-time performance) to reduce the complexity of hybrid encryption; a quantified encryption density (≥90% / 50%-80% / ≤30% corresponding to high / medium / low sensitive scenes) is defined, and a differential sampling encryption strategy (field-level encryption, proportion sampling encryption, hierarchical encryption) is designed for structured / unstructured data; the decryption process combines key matching, plaintext metadata integration and integrity checking (such as hash comparison) to ensure data security and integrity.

[0072] Referring to Figure 3 The second aspect of the present application provides an AI analysis-based data adaptive encryption device, which comprises:

[0073] A plaintext acquisition module 10 is configured to acquire plaintext data to be encrypted, wherein the plaintext data contains metadata describing a data structure;

[0074] The AI metadata analysis module 20 is configured to extract the metadata from the plaintext data, and input the metadata into a pre-trained AI model for analysis to obtain usage scenario information, usage information, and data characteristic information of the plaintext data.

[0075] The encryption algorithm matching module 30 is configured to match a preset encryption algorithm according to the scenario information, the usage information, and the data characteristic information, wherein the preset encryption algorithm includes a symmetric encryption algorithm and an asymmetric encryption algorithm.

[0076] The symmetric encryption module 40 is configured to, if the matching result is the symmetric encryption algorithm, encrypt the plaintext data by using the symmetric encryption algorithm to obtain a first encryption result in combination with the metadata.

[0077] The asymmetric encryption module 50 is configured to, if the matching result is the asymmetric encryption algorithm, perform sampling encryption on the plaintext data by using the asymmetric encryption algorithm based on a scenario-determined encryption density to obtain a second encryption result in combination with the metadata.

[0078] In an optional implementation of the second aspect of the present application, the asymmetric encryption module includes:

[0079] The scenario sensitivity determination unit is configured to, if the matching result is the asymmetric encryption algorithm, determine a scenario sensitivity level based on the scenario information.

[0080] The encryption density interval determination unit is configured to obtain an encryption density interval of the plaintext data by using the scenario sensitivity level.

[0081] The sampling encryption unit is configured to perform encryption on the plaintext data by using the asymmetric encryption algorithm in the encryption density interval to obtain a ciphertext subject.

[0082] The encryption result generation unit is configured to combine the ciphertext subject and the metadata to obtain the second encryption result.

[0083] In an optional implementation of the second aspect of the present application, the sampling encryption unit includes:

[0084] The sequential encryption subunit is configured to sequentially encrypt structured data, unstructured data, and other data in the plaintext data by using the encryption density interval as a guide.

[0085] The structured data encryption subunit is configured to, for the structured data in the plaintext data, perform classified encryption according to a field sensitivity matching encryption proportion.

[0086] an unstructured data encryption subunit configured to encrypt the unstructured data in the plaintext data in a random sampling manner;

[0087] a further data encryption subunit configured to encrypt the further data in the plaintext data in a data importance matching encryption proportion manner.

[0088] In an optional implementation of the second aspect of the present application, the structured data encryption subunit comprises:

[0089] a field extraction subunit configured to extract sensitive fields, non-sensitive fields and other fields in the structured data respectively;

[0090] a field encryption subunit configured to encrypt the sensitive fields in a 100% proportion, extract and encrypt the non-sensitive fields in a first preset proportion, and not encrypt the other fields.

[0091] In an optional implementation of the second aspect of the present application, the unstructured data encryption subunit comprises:

[0092] a data block information acquisition subunit configured to acquire data block information in which the unstructured data exists;

[0093] a random number generator construction subunit configured to construct a random number generator based on the data block information;

[0094] a target data block acquisition subunit configured to acquire a plurality of target data blocks through the random number generator;

[0095] an unstructured data encryption subunit configured to encrypt the unstructured data in the plurality of target data blocks.

[0096] In an optional implementation of the second aspect of the present application, the further data encryption subunit comprises:

[0097] a data hierarchical extraction subunit configured to extract core data, ordinary data and redundant data in the further data respectively;

[0098] a data hierarchical encryption subunit configured to encrypt the core data in a 100% proportion, extract and encrypt the ordinary data in a second preset proportion, and not encrypt the redundant data.

[0099] In an optional implementation of the second aspect of the present application, the encryption algorithm matching module comprises:

[0100] a real-time determination subunit configured to determine real-time requirements of the plaintext data based on the scene information;

[0101] a security determination unit configured to determine a security requirement of the plaintext data based on the usage information;

[0102] a data volume determination unit configured to determine a data volume requirement of the plaintext data based on the data characteristic information;

[0103] a condition table matching unit configured to match the real-time requirement, the security requirement and the data volume requirement with a first condition table of the symmetric encryption algorithm and a second condition table of the asymmetric encryption algorithm respectively;

[0104] an encryption algorithm determination unit configured to determine a target encryption algorithm of the plaintext data based on a matching degree of the real-time requirement, the security requirement and the data volume requirement with the first condition table and the second condition table respectively.

[0105] Figure 4 is a structural schematic diagram of a data adaptive encryption device based on AI analysis provided by an embodiment of the present application. The data adaptive encryption device based on AI analysis can have relatively large differences due to different configurations or performances, and can include one or more processors 60 (central processing units, CPU) (for example, one or more processors) and a memory 70, one or more storage media 80 (for example, one or more mass storage devices) storing application programs or data. Among them, the memory and the storage medium can be temporary storage or persistent storage. The programs stored in the storage medium can include one or more modules (not shown in the figure), each module can include a series of instruction operations in the data adaptive encryption device based on AI analysis. Further, the processor can be configured to communicate with the storage medium and execute a series of instruction operations in the storage medium on the data adaptive encryption device based on AI analysis.

[0106] The data adaptive encryption device based on AI analysis of the present application can also include one or more power supplies 90, one or more wired or wireless network interfaces 100, one or more input and output interfaces 110, and / or one or more operating systems, such as Windows Serve, Mac OS X, Unix, Linux, FreeBSD, etc. Those skilled in the art can understand that, Figure 4 The structure of the data adaptive encryption device based on AI analysis shown does not constitute a limitation on the data adaptive encryption device based on AI analysis, and can include more or fewer components than shown, or combine certain components, or different component arrangements.

[0107] The application further provides a computer readable storage medium, which can be a nonvolatile computer readable storage medium or a volatile computer readable storage medium, and the computer readable storage medium stores instructions, and the instructions enable a computer to execute the steps of the AI analysis based data self-adaptive encryption method when the instructions are run on the computer.

[0108] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described system or system units can refer to the corresponding processes in the foregoing method embodiments, and will not be described here.

[0109] The integrated units, if implemented in the form of software function units and sold or used as independent products, can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the application or the whole or part of the technical solutions that essentially contribute to the prior art can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in the various embodiments of the application. The foregoing storage medium includes a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various program code storage media.

[0110] The above-described embodiments are only used to illustrate the technical solutions of the application, rather than limit the application; although the application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part of the technical features; and these modifications or replacements do not make the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the application.

Claims

1. A data adaptive encryption method based on AI analysis, characterized in that, include: Obtain plaintext data to be encrypted, wherein the plaintext data contains metadata describing the data structure; The metadata is extracted from the plaintext data and input into a pre-trained AI model for analysis to obtain the usage scenario information, purpose information and data feature information of the plaintext data; The preset encryption algorithm is matched based on the scenario information, the purpose information, and the data feature information. The preset encryption algorithm includes symmetric encryption algorithm and asymmetric encryption algorithm. If the matching result is the symmetric encryption algorithm, then the plaintext data is encrypted using the symmetric encryption algorithm and combined with the metadata to obtain the first encryption result; If the matching result is the asymmetric encryption algorithm, then the plaintext data is sampled and encrypted using the asymmetric encryption algorithm with encryption density determined based on the scenario, and then combined with the metadata to obtain the second encryption result.

2. The AI-based adaptive data encryption method according to claim 1, characterized in that, If the matching result is the asymmetric encryption algorithm, then obtaining the second encryption result by sampling and encrypting the plaintext data using the asymmetric encryption algorithm with a scenario-based encryption density determination, and then combining it with the metadata, includes: If the matching result is the asymmetric encryption algorithm, then the scene sensitivity level is determined based on the scene information; The encryption density range of the plaintext data is obtained by using the scene sensitivity level; The plaintext data is encrypted using the asymmetric encryption algorithm with the encryption density range limited by sampling encryption to obtain the ciphertext body; The second encryption result is obtained by combining the ciphertext body and the metadata.

3. The AI-based adaptive data encryption method according to claim 2, characterized in that, The method of encrypting the plaintext data using the asymmetric encryption algorithm with the encryption density range limited by sampling encryption to obtain the ciphertext body includes: Using the encryption density range as a guide, the structured data, unstructured data, and other data in the plaintext data are encrypted sequentially. The structured data within the plaintext data is classified and encrypted according to the encryption ratio matched with the field sensitivity. The unstructured data in the plaintext data is encrypted using a random sampling method; For the other data in the plaintext data, hierarchical encryption is performed according to the encryption ratio matched by the data importance.

4. The AI-based adaptive data encryption method according to claim 3, characterized in that, The method of classifying and encrypting the structured data in the plaintext data according to the field sensitivity matching encryption ratio includes: Sensitive fields, non-sensitive fields, and other fields are extracted separately from the structured data; The sensitive fields are encrypted at a 100% ratio, the non-sensitive fields are encrypted at a first preset ratio, and the other fields are not encrypted.

5. The AI-based adaptive data encryption method according to claim 3, characterized in that, The encryption of the unstructured data in the plaintext data using a random sampling method includes: Obtain the data block information where the unstructured data exists; A random number generator is constructed based on the data block information; Several target data blocks are obtained through the random number generator; The unstructured data in several target data blocks is encrypted.

6. The AI-based adaptive data encryption method according to claim 3, characterized in that, The other data in the plaintext data are encrypted hierarchically according to the encryption ratio based on data importance, including: The core data, ordinary data, and redundant data in the other data are extracted separately. The core data is encrypted at a 100% ratio, the ordinary data is extracted and encrypted at a second preset ratio, and the redundant data is not encrypted.

7. The AI-based adaptive data encryption method according to claim 6, characterized in that, The matching of preset encryption algorithms based on the scene information, the purpose information, and the data feature information, wherein the preset encryption algorithms include symmetric encryption algorithms and asymmetric encryption algorithms, including: The real-time requirements of the plaintext data are determined based on the scenario information. The security requirements for the plaintext data are determined based on the aforementioned usage information; The data volume requirement for the plaintext data is determined based on the data feature information; The real-time requirements, security requirements, and data volume requirements are respectively matched with the first condition table of the symmetric encryption algorithm and the second condition table of the asymmetric encryption algorithm; Based on the degree of matching between the real-time requirements, security requirements, and data volume requirements and the first and second condition tables, respectively, the target encryption algorithm for the plaintext data is determined.

8. A data adaptive encryption device based on AI analysis, characterized in that, The AI-based adaptive data encryption device includes: The plaintext acquisition module is used to acquire plaintext data to be encrypted, wherein the plaintext data contains metadata describing the data structure; The AI ​​metadata analysis module is used to extract the metadata from the plaintext data and input the metadata into a pre-trained AI model for analysis to obtain the usage scenario information, purpose information and data feature information of the plaintext data. An encryption algorithm matching module is used to match a preset encryption algorithm based on the scenario information, the purpose information, and the data feature information. The preset encryption algorithm includes a symmetric encryption algorithm and an asymmetric encryption algorithm. A symmetric encryption module is used to encrypt the plaintext data using the symmetric encryption algorithm and then combine it with the metadata to obtain a first encryption result if the matching result is the symmetric encryption algorithm. An asymmetric encryption module is used to obtain a second encryption result by sampling and encrypting the plaintext data with a scenario-based encryption density determined by the asymmetric encryption algorithm and then combining it with the metadata if the matching result is the asymmetric encryption algorithm.

9. A data adaptive encryption device based on AI analysis, characterized in that, The AI-based adaptive data encryption device includes: a memory and at least one processor, wherein the memory stores instructions, and the memory and the at least one processor are interconnected via a circuit. The at least one processor invokes the instructions in the memory to cause the AI-based adaptive data encryption device to perform the AI-based adaptive data encryption method as described in any one of claims 1-7.

10. A computer-readable storage medium storing a computer program thereon, characterized in that, When the computer program is executed by the processor, it implements the AI-based adaptive data encryption method as described in any one of claims 1-7.

Images