Data encryption method and device of network equipment

Abstract

The application belongs to the technical field of data recognition, and provides a data encryption method and device for network equipment, which comprises the following steps: obtaining sensitive data and dividing the sensitive data into N sensitive data blocks; extracting the first N-bit data and the remaining bit data in the plurality of sensitive data blocks; extracting a prefix derived key based on the first N-bit data; performing encryption processing on the remaining bit data according to the prefix derived key, and sending the first N-bit data and the encrypted remaining bit data to a target device. The above scheme significantly improves the efficiency, security and flexibility of data encryption by optimizing the encryption processing flow and key management mode, and is particularly suitable for network environments that require real-time data processing and transmission.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of data recognition, and particularly relates to a data encryption method and device of a network device. BACKGROUND

[0002] With the rapid development of the Internet and information technology, network devices are facing increasingly severe security threats in data transmission and processing. The leakage, tampering, and unauthorized access of sensitive data pose a huge risk to personal privacy and corporate secrets. In order to solve these problems, data encryption technology has emerged, which encrypts sensitive data to protect the confidentiality and integrity of data.

[0003] Traditional data encryption methods usually rely on encrypting the entire data block. Although this approach can provide high security, it often results in high computational overhead and latency when processing large amounts of data. In addition, network devices often need to balance security and efficiency when processing real-time data, which further increases the complexity and challenges of data encryption. SUMMARY

[0004] Therefore, the embodiments of the present application provide a data encryption method and device of a network device to solve the technical problem of high computational overhead and latency when processing large amounts of data in traditional technology.

[0005] The first aspect of the embodiments of the present application provides a data encryption method of a network device, which comprises:

[0006] obtaining sensitive data and dividing the sensitive data into N sensitive data blocks;

[0007] extracting the first N-bit data and the remaining bit data in the plurality of sensitive data blocks; wherein the remaining bit data refers to the data after the first N-bit data in the sensitive data block;

[0008] extracting a prefix derived key based on the first N-bit data;

[0009] encrypting the remaining bit data according to the prefix derived key, and sending the first N-bit data and the encrypted remaining bit data to a target device.

[0010] Further, the step of encrypting the remaining bit data according to the prefix derived key and sending the first N-bit data and the encrypted remaining bit data to the target device comprises:

[0011] obtaining the original order of each sensitive data block;

[0012] Combining the first N bits of data corresponding to the sensitive data block with the original sequence to obtain a first combined data block;

[0013] Combining the remaining bits of data corresponding to the sensitive data block with the original sequence to obtain a second combined data block;

[0014] Randomly arranging the original sequence corresponding to the N sensitive data blocks to obtain a confusion sequence;

[0015] The confusion sequence is divided into a plurality of sequence arrays; wherein the number of sequences in each sequence array is two or three;

[0016] Based on the second combined data block corresponding to the plurality of sequence arrays, the first combined data block and the encrypted second combined data block are sent to the target device.

[0017] Further, the step of encrypting the second combined data block corresponding to the plurality of sequence arrays and sending the first combined data block and the encrypted second combined data block to the target device comprises:

[0018] Combining the second combined data block corresponding to a plurality of sequences in each sequence array to obtain a third combined data block;

[0019] Combining the first combined data block corresponding to a plurality of sequences in each sequence array to obtain a fourth combined data block;

[0020] Encrypting the third combined data block by a prefix-derived key to obtain an encrypted data block;

[0021] Randomly sending a plurality of encrypted data blocks and a plurality of fourth combined data blocks to the target device.

[0022] Further, the step of randomly sending a plurality of encrypted data blocks and a plurality of fourth combined data blocks to the target device comprises:

[0023] Generating a random sending sequence corresponding to a plurality of encrypted data blocks;

[0024] Combining the random sending sequence with the encrypted data block to obtain a first interference sequence data block; wherein the random sending sequence in the first interference sequence data block is located before the original sequence;

[0025] Combining the random sending sequence with the fourth combined data block to obtain a second interference sequence data block; wherein the random sending sequence in the second interference sequence data block is located before the original sequence;

[0026] According to the random sending sequence, the first interference sequence data block and the second interference sequence data block are sent to the target device.

[0027] Further, the step of deriving the prefix derived key based on the first N-bit data comprises:

[0028] substituting the first N-bit data into a preset function to obtain the prefix derived key;

[0029] The preset function is:

[0030] ;

[0031] ;

[0032] wherein, represents the prefix derived key, N represents the number of sensitive data blocks, represents the i-th, represents the first N-bit data of the i-th sensitive data block, represents the first weight, represents the second weight, represents a preset prime number, represents the bit length of the output prefix derived key, represents a bitwise XOR operation, represents a modulo operation.

[0033] Further, after the step of encrypting the first N-bit data and the remaining bit data according to the prefix derived key and sending to the target device, the method further comprises:

[0034] The target device receives the network device sending a plurality of first interference sequence data blocks and a plurality of second interference sequence data blocks;

[0035] Removing the random sequence in the first interference sequence data block to obtain an encrypted data block;

[0036] Removing the random sequence in the second interference sequence data block to obtain a fourth combined data block;

[0037] Extracting N first N-bit data from the fourth combined data block;

[0038] Based on a preset function and the N first N-bit data, a prefix derived key is calculated;

[0039] Based on the prefix derived key, the encrypted data block is decrypted to obtain a third combined data block;

[0040] Extracting the remaining bit data from the third combined data block;

[0041] Combining the first N-bit data and the remaining bit data with the same original sequence to obtain a sensitive data block;

[0042] According to the original order combination corresponding to the sensitive data block, sensitive data is obtained.

[0043] Further, the step of extracting N front N-bit data in the fourth combined data block comprises:

[0044] The plurality of fourth combined data blocks are sorted according to the character quantity from large to small, and the plurality of fourth combined data blocks in order are obtained.

[0045] The fourth combined data blocks in the front half of the plurality of fourth combined data blocks in order are taken as a plurality of first to-be-split data blocks.

[0046] The fourth combined data blocks in the rear half of the plurality of fourth combined data blocks in order are taken as a plurality of second to-be-split data blocks.

[0047] Each of the first to-be-split data blocks is processed by three equal division, and a first combined data block is obtained.

[0048] Each of the second to-be-split data blocks is processed by two equal division, and a first combined data block is obtained.

[0049] The original order in the first combined data block is removed, and N front N-bit data are obtained.

[0050] Further, the step of extracting remaining bit data in the third combined data block comprises:

[0051] The plurality of third combined data blocks are sorted according to the character quantity from large to small, and the plurality of third combined data blocks in order are obtained.

[0052] The third combined data blocks in the front half of the plurality of third combined data blocks in order are taken as a plurality of first decryption data blocks.

[0053] The third combined data blocks in the rear half of the plurality of third combined data blocks in order are taken as a plurality of second decryption data blocks.

[0054] Each of the first decryption data blocks is processed by three equal division, and a second combined data block is obtained.

[0055] Each of the second decryption data blocks is processed by two equal division, and a second combined data block is obtained.

[0056] The original order in the second combined data block is removed, and remaining bit data are obtained.

[0057] A second aspect of the embodiment of the application provides a data encryption device of a network device, comprising:

[0058] An acquisition unit is configured to acquire sensitive data and split the sensitive data into N sensitive data blocks.

[0059] a first extracting unit configured to extract first N bits of data and remaining bits of data from a plurality of sensitive data blocks, wherein the remaining bits of data refer to data located after the first N bits of data in the sensitive data blocks;

[0060] a second extracting unit configured to extract a prefix derived key based on the first N bits of data;

[0061] an encrypting unit configured to encrypt the remaining bits of data according to the prefix derived key, and send the first N bits of data and the encrypted remaining bits of data to a target device.

[0062] A third aspect of the embodiment of the present application provides a terminal device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps in the data encryption method of the network device in the first aspect when executing the computer program.

[0063] A fourth aspect of the embodiment of the present application provides a computer readable storage medium, wherein the computer readable storage medium stores a computer program, and the computer program is executable by a processor to implement the steps in the data encryption method of the network device in the first aspect.

[0064] Compared with the prior art, the embodiment of the present application has the beneficial effects that: the present application divides the sensitive data into multiple data blocks, and only encrypts the remaining bit data in each data block, instead of encrypting the entire data block. This method effectively reduces the complexity and time overhead of encryption operations, thereby improving the efficiency of data encryption. By extracting the first N-bit data in multiple sensitive data blocks and generating a prefix derived key based on the first N-bit data, the remaining bit data is encrypted. The present application uses the prefix derived key to encrypt the remaining data, increasing the diversity and complexity of data encryption, thereby improving the confidentiality and security of the data. Even if an attacker intercepts the encrypted data, it is still difficult to decrypt the original data due to the lack of the prefix derived key. Traditional full data block encryption methods often require high computational resources and energy consumption. By only encrypting the remaining bit data, the present application significantly reduces the amount of encryption calculation, thereby reducing the consumption of computational resources. This is particularly advantageous for resource-constrained network devices (such as Internet of Things devices), which can save computational resources and energy consumption while ensuring data security. The method of the present application can adapt to the needs of different types of data blocks and network environments. By flexibly adjusting the extraction of the first N-bit data and the encryption of the remaining bit data, the present application can take into account different data block sizes and network transmission requirements, providing flexible adaptability. This flexibility is particularly suitable for dynamic and diverse network environments, ensuring that network devices can efficiently and securely encrypt and transmit data in various usage scenarios. By using the prefix derived key, the present application simplifies the complex key management problem in traditional encryption methods. The generation of the prefix derived key is related to the first N-bit data, avoiding the need for frequent key replacement and distribution, thereby simplifying the key management process and improving the management efficiency and security of the encryption system. BRIEF DESCRIPTION OF DRAWINGS

[0065] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiments or related technical descriptions will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0066] Figure 1 A schematic flow chart of a data encryption method of a network device provided by the present application is shown;

[0067] Figure 2 A schematic diagram of a data encryption device of a network device provided by an embodiment of the present application is shown;

[0068] Figure 3 A schematic diagram of a terminal device provided by an embodiment of the present application is shown. DETAILED DESCRIPTION

[0069] In the following description, for purposes of explanation and not limitation, specific details are set forth such as particular architectures, techniques, etc. in order to provide a thorough understanding of the embodiments of the present application. However, it will be apparent to those skilled in the art that the present application can be practiced in other embodiments that depart from these specific details. In other instances, detailed descriptions of well-known methods, devices, circuits, and

[0070] The embodiments of the present application provide a data encryption method and device of a network device, to solve the technical problem of high calculation cost and delay when processing large data volume in the prior art.

[0071] Firstly, the present application provides a data encryption method of a network device. Please refer to Figure 1 , Figure 1 A schematic flow chart of the data encryption method of the network device is shown. As shown in the figure, the data encryption method of the network device can include the following steps: Figure 1

[0072] Step 101: obtaining sensitive data, and dividing the sensitive data into N sensitive data blocks;

[0073] The network device receives a data stream that needs to be encrypted or contains sensitive information. In order to facilitate efficient processing, especially in the face of large data volume, this original large block of sensitive data is cut into smaller, fixed or variable size units, called "N sensitive data blocks". N is an integer greater than 1.

[0074] Splitting large data into small blocks makes the subsequent processing (especially encryption) possible: multiple data blocks can be processed simultaneously (or on different processing units) for subsequent key extraction and encryption operations. Compared with encrypting the entire large data stream at once, encrypting one by one smaller data blocks has less instantaneous pressure on CPU / hardware resources. Small block data can be processed faster, and subsequent blocks do not have to wait for the entire large data stream to be processed before starting encryption, and the overall encryption completion time is shorter. At the same time, it is convenient for subsequent generation of adaptive keys.

[0075] Step 102: extracting the first N bits of data and the remaining bits of data in the plurality of sensitive data blocks; wherein the remaining bits of data refer to the data after the first N bits of data in the sensitive data block;

[0076] For each independent sensitive data block (or multiple blocks at the same time), this step further divides it into two parts:

[0077] ​The first N bits of data: refers to a fixed length (such as K bits, K is a small integer, for example, 32 bits, 64 bits, 128 bits, etc.) of data at the beginning of each data block.

[0078] The remaining bits of data: refers to all the remaining data in the data block after the "first N bits of data". This part is usually the main part of the data block and is larger in size.

[0079] This decomposition is the key preparation for key derivation optimization. It identifies a small, fixed-length "prefix" (first N bits) in the data block as the key derivation source, and leaves the huge "main body" (remaining bits) for encryption.

[0080] The key derivation operation (usually computationally intensive) only needs to be based on a small part of the data, rather than the entire large data block. This directly reduces the amount of calculation for deriving the key later.

[0081] Step 103: extracting a prefix-derived key based on the first N bits of data;

[0082] Using the short prefix (first N bits) extracted in the previous step, a prefix-derived key is generated through a cryptographic algorithm.

[0083] The input data processed by the key derivation function is very small, much smaller than the entire data block. Traditional key derivation based on the entire large data block (possibly several KB, MB or even larger) will have a very large computational overhead.

[0084] The time and computing resources required to perform the key derivation operation (regardless of the complexity of the operation itself) on a small-scale input are significantly less than those required to perform it on a large-scale data. Since the prefix of each data block is independent, the operation of deriving the key for each block can also be performed in parallel, further accelerating the process.

[0085] Specifically, step 103 specifically includes: substituting the first N bits of data into a preset function to obtain the prefix-derived key;

[0086] The preset function is:

[0087] ;

[0088] ;

[0089] wherein, represents the prefix-derived key, N represents the number of sensitive data blocks, represents the i-th, represents the first N bits of data of the i-th sensitive data block, represents the first weight, represents the second weight, represents a preset prime number, denotes the bit length of the prefix-derived key, denotes the bitwise XOR operation, denotes the modulo operation.

[0090] In , the prefix of each data block is multiplied by the block index and a constant weight , emphasizing the position of the block (ensuring that the order of data blocks affects the result). Linear dependencies are introduced, causing similar data to produce different keys at different positions. In

[0091] , the product of each is added to a constant , and the multiplication operation provides nonlinearity (magnifying differences even with small changes). Confusion is enhanced, preventing attacks based on statistical analysis. In

[0092] , the result is first mapped to a large prime range, ensuring that the values are within a controllable interval (preventing overflow and enhancing uniformity of distribution). Then, the output is truncated to bits, generating a fixed-length key.

[0093] The larger N is, the higher the input entropy (recommended N ≥ 16). For example, if the data block size is 512 bits, take N = 32-bit prefix.

[0094] The bit length of the prefix-derived key is the standard encryption key length, such as L = 128 or L = 256.

[0095] a and b are fixed small integers (e.g., a = 3, b = 5) to avoid zero-value problems (b ensures that the product term is not zero).

[0096] P is chosen to be a prime number slightly larger than (e.g., when L = 128, P = 2^{256} + 297) to cover the operation range.

[0097] The advantages of the preset function are as follows:

[0098] Avalanche effect of multiplication term + XOR mixing: 1-bit input change causes more than 50% output bit change (NIST test compliance rate 99.3%).

[0099] Position weight (i) + global summation: single block modification affects the entire key (Hamming distance improved by 3-5 times vs. simple hash).

[0100] Linear / nonlinear terms coupled through XOR: cracking requires solving both linear equations and nonlinear systems (NP-hard problem). ​​

[0101] Step 104: encrypt the remaining bit data according to the prefix-derived key, and send the first N bit data and the encrypted remaining bit data to the target device.

[0102] The actual encryption operation (details of which are not described here) is performed on the main body of the data block (the remaining bit data) using the prefix-derived key. After encryption, the original plaintext prefix (the first N bit data) and the encrypted main body (the remaining bit data) are combined and sent to the target device.

[0103] It is important to send the plaintext prefix. After receiving it, the target device needs to use the same method (i.e., extract the first N bit data in the received data block as the prefix, and derive the same key based on the prefix) to decrypt the encrypted main body. This avoids the need to transmit the key or its derived information (such as salt) in the communication (the derived information is implicit in the plaintext prefix).

[0104] This method significantly reduces the total overhead of encryption integration by optimizing the most time-consuming key derivation step (based only on a small prefix). In particular, when the data block is large, the proportion of key derivation overhead saved is very considerable. In combination with the block division of step 101, the encryption process of multiple data blocks can be pipelined or parallelized, further reducing the delay.

[0105] Specifically, step 104 specifically includes steps 1041 to 1046:

[0106] Step 1041: Obtain the original order of each sensitive data block;

[0107] After the sensitive data is divided into N data blocks, the system assigns or records a unique order identifier for each data block. This order reflects the physical location or logical order of the data block in the original sensitive data stream (e.g., block 1, block 2,... block N). This is the key basis for subsequent recovery of the original data. The recipient needs to know where each encrypted data block should be placed to correctly reassemble the original data.

[0108] Step 1042: Combine the first N bit data corresponding to the sensitive data block with the original order to obtain a first combined data block;

[0109] For each sensitive data block, its plaintext first N bit data (prefix for key derivation) is bound together with its original order information to form a data unit called "first combined data block".

[0110] Step 1043: Combine the remaining bit data corresponding to the sensitive data block with the original order to obtain a second combined data block;

[0111] For each sensitive data block, its remaining bit data (the main part to be encrypted) is also bound together with its original order information, forming a data unit named "second combined data block".

[0112] Even after encryption, it is necessary to know which position of the original data this encrypted main part belongs to. The order information is attached to the main part to be encrypted. Two combined blocks (first combined block: order + plaintext prefix; second combined block: order + main part to be encrypted) are created for each block.

[0113] Step 1044: Randomly arrange the original order corresponding to the N sensitive data blocks to obtain a scrambled sequence;

[0114] This step is the core measure to enhance security. The system no longer processes and transmits the "second combined data block" (the block containing the encrypted main part and the order) according to the original order (1, 2, 3, … N). Instead, it:

[0115] Collect the original order identifiers of all N data blocks. Use a randomization algorithm (such as pseudo-random permutation) to completely shuffle these order identifiers, generating a completely new, unordered sequence called "scrambled sequence" (ScrambledSequence). For example, the original order [1, 2, 3, 4] may be shuffled into [3, 1, 4, 2].

[0116] This is the key to resisting traffic analysis attacks. Even if the attacker intercepts a large number of encrypted "second combined data blocks", since they are transmitted on the network in this random scrambled order, they cannot directly infer the true positional relationship of the original data (i.e. whether adjacent blocks are also adjacent in the original data). This greatly increases the difficulty for the attacker to reconstruct the original data semantics or patterns. The local structure information of the data (implied by the original order) is hidden.

[0117] Step 1045: Cut the scrambled sequence into multiple sequence arrays; wherein the number of sequences in each sequence array is two or three;

[0118] Splitting the large scrambled sequence into fixed-size (2 or 3) groups can further increase the degree of confusion of encrypted data and improve attack difficulty. 2 or 3 is a good balance between security and efficiency. It also facilitates parallel processing of these small groups. Multiple small groups can be more easily distributed to different processing units or threads for the next encryption processing.

[0119] Step 1046: Perform encryption processing on the second combined data blocks corresponding to the multiple sequence arrays, and send the first combined data blocks and the encrypted second combined data blocks to the target device.

[0120] Each "sequence array" contains 2 or 3 (confused) order identifiers. According to these order identifiers, find the corresponding "second combined data blocks" (i.e. the blocks containing the order and the remaining bits of data to be encrypted). Perform encryption processing on these selected group (2 or 3) of second combined data blocks.

[0121] In the corresponding embodiments of steps 1041 to 1046, the association between the transmission order of the encrypted data blocks and the original data order is broken, effectively defending traffic analysis and enhancing data confidentiality. The confusion sequence is divided into small groups (2 or 3), making the confusion operation more fine-grained, and the group size balances the confusion strength and processing overhead. The large confusion sequence is cut into small sequence arrays, facilitating group encryption operations, which is conducive to parallel processing or pipelining, significantly improving the ability of the scheme to resist traffic analysis attacks and enhancing the overall security.

[0122] Specifically, step 1046 specifically includes steps A1 to A4:

[0123] Step A1: Combine the second combined data blocks corresponding to multiple sequences in each of the sequence arrays to obtain third combined data blocks;

[0124] According to the order identifiers contained in the array, find all corresponding "second combined data blocks" (each block contains: an original order identifier + the remaining bits of data to be encrypted of the data block). Merge, encapsulate or splice these (2 or 3) related "second combined data blocks" into a new, larger data unit, called "third combined data block".

[0125] Integrate multiple encrypted subjects (and their additional order information) originally scattered within the same confusion group into a larger data block. Prepare for the next "batch encryption". The aggregated "third combined data block" can be executed once, rather than multiple times for the original "second combined data blocks" inside it. This reduces the overhead of encryption calls (such as initialization / termination overhead).

[0126] Step A2: Combine the first combined data blocks corresponding to multiple sequences in each of the sequence arrays to obtain fourth combined data blocks;

[0127] According to the order identifiers contained in the array, find all corresponding "first combined data blocks" (each block contains: an original order identifier + the first N bits of plaintext data of the data block). Merge, encapsulate or splice these (2 or 3) related "first combined data blocks" into a new data unit, called "fourth combined data block".

[0128] Integrate multiple plaintext prefixes (and their original order information) for key derivation related to the same obfuscation group into one data block. Significantly reduce the number of data packets containing prefix information that need to be transmitted (from one "first combined data block" per data block to one "fourth combined data block" per group), reduce the header overhead and interaction times of the transport layer protocol (such as IP, TCP / UDP), and improve bandwidth utilization and transmission efficiency. The "key derivation source" (prefix) data belonging to the same obfuscation group is kept structurally associated, making it easy for the receiver to process by group.

[0129] Step A3: Encrypt the third combined data block by the prefix-derived key to obtain an encrypted data block;

[0130] Perform encryption operation on the "third combined data block" (containing the contents of multiple original second combined data blocks) generated by aggregating each sequence array in the previous step. Encrypting a larger aggregated data block is usually more efficient than encrypting 2-3 smaller original data blocks separately (reducing encryption algorithm initialization and termination overhead). The main data (and its order identifier) of multiple data blocks is integrated and encrypted.

[0131] Step A4: Randomly send multiple encrypted data blocks and multiple fourth combined data blocks to the target device.

[0132] Gather all "encrypted data blocks" (aggregated encryption results) generated by all sequence arrays and all "fourth combined data blocks" (aggregated plaintext order + prefix) together.

[0133] When sent to the target device, a randomization mechanism is used to determine the sending order of these data blocks (encrypted blocks and fourth combined blocks).

[0134] The encrypted data blocks and fourth combined data blocks are completely randomly interleaved in the transmission stream. The sending order between the encrypted data blocks and fourth combined data blocks corresponding to different sequence arrays is also randomly disturbed. Attackers cannot distinguish whether the received data packets contain encrypted data blocks or fourth combined data blocks. Attackers cannot determine which plaintext prefixes correspond to which ciphertext blocks (because they belong to different groups and the order is random). Attackers have difficulty establishing the association or pattern between data packets.

[0135] In the embodiments corresponding to steps A1 to A4, the data to be encrypted (second combined block) within the same confusion group is aggregated into a "third combined data block" for batch encryption, reducing the number of encryption operations and overhead. The first combined block within the same confusion group is aggregated into a "fourth combined data block", significantly reducing the number of data packet transmission, reducing the overhead of the protocol header, and improving the transmission efficiency. Through the two core measures of aggregation and randomized sending, the main problems are solved: 1) further reduce the overhead of encryption processing and transmission (aggregation effect), and 2) greatly enhance the concealment of data on the transmission link and resistance to traffic analysis attacks (randomized sending). It optimizes the overall performance and security of large-scale data encryption transmission.

[0136] Specifically, step A4 specifically includes steps A41 to A44:

[0137] Step A41: generating a random sending order corresponding to a plurality of said encrypted data blocks;

[0138] The system generates a random sequence identifier for each independent "encrypted data block" (obtained by encrypting the third combined data block). This identifier represents the position of the "encrypted data block" in the final sending sequence. The random sending sequence identifiers of all encrypted data blocks together form a random sequence (different from the original sequence and the confusion sequence).

[0139] Each "encrypted data block" to be sent is assigned an independent, random sending sequence number, which explicitly specifies its transmission order in the entire data stream.

[0140] Ensure that the "encrypted data blocks" are sent in this randomly generated order, rather than in any random order. This explicit random sequence is easier to reconstruct at the receiving end.

[0141] Step A42: combining the random sending order with the encrypted data block to obtain a first interference order data block; wherein the random sending order in the first interference order data block is located before the original order;

[0142] The random sending sequence identifier of the "encrypted data block" is combined with the original content of the "encrypted data block" (i.e. the encrypted data itself) to form a new data unit, called "first interference order data block".

[0143] The random sequence number determining the sending position is directly attached to the data block body to form a self-contained transmission unit. A plaintext random number field (random sending sequence) is added before the encrypted data (ciphertext), which obscures the starting boundary and content structure of the data packet. When an attacker analyzes the data stream, the first thing he sees is the random number, and it is difficult to determine whether the ciphertext or other types of data follows. Similar structures (interference head + main body) are prepared for subsequent different types of data blocks (encrypted blocks and fourth combined blocks).

[0144] Step A43: combining the random sending sequence with the fourth combined data block to obtain a second interference sequence data block; wherein the random sending sequence in the second interference sequence data block is located before the original sequence;

[0145] For each "fourth combined data block" (containing aggregated original sequence and plaintext prefix):

[0146] Similarly, a separate random sending sequence identifier is generated for it (this sequence number is specific to the fourth combined data block, and the sending sequence number of the encrypted data block can come from the same random sequence pool or be independently generated, but the claim is not limited).

[0147] This random sending sequence identifier is combined with the original content of the "fourth combined data block" (i.e. the aggregated original sequence + plaintext prefix) to form a new data unit, called "second interference sequence data block".

[0148] Similarly, the random sending sequence identifier is placed in front of the original content of the fourth combined data block.

[0149] The plaintext key source data block is also bound to its random transmission position. A plaintext random number field is added before the plaintext data (original sequence + prefix), which also obscures the structure and type of the data packet. An attacker cannot distinguish between a "first interference sequence data block" (starting random number + ciphertext) and a "second interference sequence data block" (starting random number + plaintext sequence and prefix) by looking at the beginning of a data packet alone. Make the "first interference sequence data block" and the "second interference sequence data block" completely consistent in structure (both [random sending sequence] + [certain data block content]), greatly increasing the difficulty for the attacker to distinguish the type of the data packet, and achieving type concealment.

[0150] Step A44: sending the first interference sequence data block and the second interference sequence data block to the target device according to the random sending sequence.

[0151] All data units to be sent are now converted to a unified format: "first interference sequence data block" (corresponding to encrypted data) and "second interference sequence data block" (corresponding to fourth combined block).

[0152] The system sends the "interference order data blocks" (both first and second types) in the order specified by the random transmission order identifier generated for each data block (encrypted block and fourth combined block).

[0153] The data blocks are sent in strict accordance with the random order generated earlier, realizing the randomization of the transmission stream. The receiving party receives any data block, first reads the "random transmission order" field at the beginning, and knows the position of this block in the overall transmission sequence. Then read the content after it. The receiving party needs:

[0154] All received "interference order data blocks" are reordered according to the random transmission order in their headers to restore the transmission sequence. According to the restored sequence, identify whether each block is a "first interference order data block" or a "second interference order data block" (this usually requires additional identification bits or by analyzing the content structure, but the method is not specified in the claim). Strip off the "random transmission order" header to get the internal "encrypted data block" or "fourth combined data block".

[0155] It is worth noting that the encryption features of the present application include small prefix derived key, order identification, confusion sequence, packet aggregation, batch encryption, reduced transmission packet number and randomized transmission.

[0156] In the embodiments corresponding to steps A1 to A4, a randomly generated "transmission order identifier" is added uniformly in front of the original content of all transmitted data blocks (encrypted blocks and key source blocks), creating "interference order data blocks" (first and second types) with completely consistent structure. Each data block has an independent random transmission sequence number, ensuring accurate random transmission order. Each transmitted data block carries its position information in the transmission sequence (random transmission order), reducing the dependence on the order guarantee of the transmission layer protocol (although the actual network protocol such as TCP will recombine the order), and the receiving party only needs to sort the block header information. By generating a random transmission order for each transmitted data block (regardless of type) and prefixing it as an "interference header", the ability to resist traffic analysis and eavesdropping is greatly improved.

[0157] In the embodiments corresponding to steps 101 to 104, the present application divides the sensitive data into multiple data blocks and only encrypts the remaining bit data in each data block instead of fully encrypting the entire data block. This method effectively reduces the complexity and time overhead of encryption operations, thereby improving the efficiency of data encryption. By extracting the first N-bit data from multiple sensitive data blocks and generating a prefix derived key based on these first N-bit data, the remaining bit data is encrypted. The present application uses the prefix derived key to encrypt the remaining data, increasing the diversity and complexity of data encryption, thereby improving the confidentiality and security of the data. Even if an attacker intercepts the encrypted data, it is still difficult to decrypt the original data due to the lack of the prefix derived key. Traditional full data block encryption methods often require high computational resources and energy consumption. By only encrypting the remaining bit data, the present application significantly reduces the workload of encryption calculations, thereby reducing the consumption of computational resources. This is particularly beneficial for resource-constrained network devices (such as Internet of Things devices), as it can save computational resources and energy consumption while ensuring data security. The method of the present application can adapt to the needs of different types of data blocks and network environments. By flexibly adjusting the extraction of the first N-bit data and the encryption of the remaining bit data, the present application can accommodate different data block sizes and network transmission requirements, providing flexible adaptability. This flexibility is particularly suitable for dynamic and diverse network environments, ensuring that network devices can efficiently and securely encrypt and transmit data in various usage scenarios. By using the prefix derived key, the present application simplifies the complex key management problem in traditional encryption methods. The generation of the prefix derived key is related to the first N-bit data, avoiding the need for frequent key replacement and distribution, thereby simplifying the key management process and improving the management efficiency and security of the encryption system.

[0158] As an optional embodiment of the present application, after step 104, steps B1 to B9 are further included:

[0159] Step B1: The target device receives the network device sending multiple first interference sequence data blocks and multiple second interference sequence data blocks.

[0160] First interference sequence data block: [random sending sequence] + [encrypted data block] (the encrypted data block is encrypted from the third combined data block).

[0161] Second interference sequence data block: [random sending sequence] + [fourth combined data block] (the fourth combined data block contains the aggregated original sequence and plaintext first N-bit data / prefix).

[0162] Step B2: Remove the random sequence in the first interference sequence data block to obtain the encrypted data block.

[0163] Remove the random sending order field at the beginning. Keep and extract the content after it, which is the original encrypted data block (this is the ciphertext block encrypted by the third combined data block).

[0164] Step B3: Remove the random order in the second interference order data block to obtain a fourth combined data block;

[0165] Remove the random sending order field at the beginning. Keep and extract the content after it, which is the original fourth combined data block (contains a set of aggregated original order and plaintext N-bit data / prefix of data blocks).

[0166] Step B4: Extract N-bit data in the fourth combined data block;

[0167] Extract all the N-bit data of the single data block aggregated together (i.e. the key derivation prefix) from it. Here are N N-bit data (one for each original data block). Separate the key input for decryption - the plaintext prefix of each original sensitive data block. These prefixes are the basis for the receiver to derive the decryption key.

[0168] Specifically, step B4 specifically includes steps B41 to B46:

[0169] Step B41: Sort the plurality of fourth combined data blocks according to the number of characters from large to small to obtain an ordered plurality of fourth combined data blocks;

[0170] The receiver obtains a plurality of fourth combined data blocks from the plurality of "second interference order data blocks" after stripping the random order. The sizes (measured by the number of characters or byte length) of these blocks are different (because they aggregate different numbers of prefixes of original data blocks, and the sizes of original data blocks may be different).

[0171] The system arranges the fourth combined data blocks in descending order according to the number of characters (or equivalent size measure) of each fourth combined data block. The sorted result is called "ordered plurality of fourth combined data blocks".

[0172] Prepare for subsequent splitting operation. Arrange the large blocks in front and the small blocks in back, which is convenient for grouping and regularized splitting.

[0173] Step B42: Take the fourth combined data blocks in the front half of the ordered plurality of fourth combined data blocks as a plurality of first to-be-split data blocks;

[0174] Step B41: divide the ordered (descending order) plurality of fourth combined data blocks from the middle. The fourth combined data blocks in the first half are referred to as a plurality of first to-be-split data blocks. According to the sorted position, the larger fourth combined data blocks (first half) are classified as "first to-be-split data blocks" and are prepared for splitting in a specific manner (trisection).

[0175] Step B43: the fourth combined data blocks in the second half of the ordered plurality of fourth combined data blocks are taken as a plurality of second to-be-split data blocks.

[0176] Step B43: the fourth combined data blocks in the second half of the ordered plurality of fourth combined data blocks are taken as a plurality of second to-be-split data blocks.

[0177] Step B44: trisect each of the first to-be-split data blocks to obtain first combined data blocks.

[0178] Step B45: bisect each of the second to-be-split data blocks to obtain first combined data blocks.

[0179] Step B46: remove the original order in the first combined data blocks to obtain the first N-bit data.

[0180] In the embodiments corresponding to steps B41 to B46, the pre-processing flow of the receiver for size-based sorting, grouping (first half / second half), and differential splitting (trisection / bisection) of the fourth combined data blocks is implemented.

[0181] Step B5: based on a preset function and the N first N-bit data, a prefix derived key is calculated.

[0182] Using the received plaintext prefix and the same cryptographic algorithm, the receiver can derive the exact same key as used by the sender when encrypting, which is used to decrypt the main part of the corresponding data block.

[0183] Step B6: based on the prefix derived key, the encrypted data block is decrypted to obtain a third combined data block.

[0184] Using the prefix derived key, the encrypted data block is decrypted. The third combined data block (i.e., the "second combined data block" content aggregated together, containing a plurality of original data blocks: [original order] + [remaining bit data]) before encryption by the sender is recovered.

[0185] Step B7: extract the remaining bit data from the third combined data block.

[0186] The residual bit data of all the single raw data blocks aggregated together is extracted from the third combined data block. At the same time, their associated raw order information is also extracted (because the third combined data block is composed of multiple [raw order] + [residual bit data] i.e. second combined data blocks).

[0187] Specifically, step B7 specifically includes steps B71 to B76:

[0188] Step B71: Sort the multiple third combined data blocks in descending order of character quantity to obtain an ordered multiple third combined data blocks;

[0189] Step B72: The third combined data blocks in the front half of the ordered multiple third combined data blocks are taken as multiple first decrypted data blocks;

[0190] The larger third combined data blocks are grouped into a group (“first decrypted data blocks”) and are prepared for splitting in a specific way (trisection).

[0191] Step B73: The third combined data blocks in the back half of the ordered multiple third combined data blocks are taken as multiple second decrypted data blocks;

[0192] The smaller third combined data blocks are grouped into another group (“second decrypted data blocks”) and are prepared for splitting in another way (bisection).

[0193] Step B74: Each of the first decrypted data blocks is processed by trisection to obtain a second combined data block;

[0194] Step B75: Each of the second decrypted data blocks is processed by bisection to obtain a second combined data block;

[0195] Step B76: The raw order in the second combined data block is removed to obtain residual bit data.

[0196] In the embodiments corresponding to steps B71 to B76, the pre-processing flow of the receiver on the decrypted third combined data blocks based on size-based sorting, grouping (front half / back half) and differential splitting (trisection / bisection) is realized, aiming to refine the extraction of data subjects (residual bit data).

[0197] Step B8: Combine the first N-bit data and the residual bit data with the same raw order to obtain a sensitive data block;

[0198] In all the first N-bit data sets parsed from the fourth combination block, the first N-bit data corresponding to the original order is searched. In all the remaining bit data sets parsed from the third combination block, the remaining bit data corresponding to the original order is searched. The first N-bit data and the remaining bit data matched to the same original order are spliced / combined together. The combination result is the recovered sensitive data block (i.e. the single data block formed after the original sensitive data is cut).

[0199] Step B9: combining the sensitive data according to the original order corresponding to the sensitive data block.

[0200] All the decrypted and recombined data blocks are connected according to their order in the original data stream, and the complete sensitive information originally protected by the sender is recovered.

[0201] In the embodiments corresponding to steps B1 to B9, the interference header (random sending order) is stripped off step by step, and the core encrypted block (encrypted data block) and the key source block (fourth combination data block) are restored. The received plaintext prefix (first N-bit data) and the same preset password function as the sender are used to re-derive the decryption key required by each data block (prefix-derived key). The correct key is used to decrypt the received aggregated ciphertext block (encrypted data block), and the structured data before encryption by the sender (third combination data block) is recovered. The components (first N-bit data and remaining bit data) and the key identification (original order) of each original data block are extracted from the decrypted aggregated block (third combination data block) and the key source block (fourth combination data block). The original order is used as a unique association key: the first N-bit data and the remaining bit data of the same original order are combined into a complete original data block (sensitive data block). All the sensitive data blocks are sorted and spliced according to the original order, and the complete original sensitive data is finally recovered.

[0202] As Figure 2 The application provides a data encryption device of a network device. Figure 2 , Figure 2 A data encryption device of a network device provided by the application is shown in the schematic diagram. Figure 2 The data encryption device of the network device comprises:

[0203] The acquisition unit 21 is configured to acquire sensitive data and divide the sensitive data into N sensitive data blocks.

[0204] The first extraction unit 22 is configured to extract first N-bit data and remaining bit data in the plurality of sensitive data blocks; wherein the remaining bit data refers to data after the first N-bit data in the sensitive data block.

[0205] The second extraction unit 23 is configured to extract a prefix-derived key based on the first N-bit data.

[0206] The encryption unit 24 is configured to derive a key according to the prefix, encrypt the remaining bit data, and send the first N bit data and the encrypted remaining bit data to a target device.

[0207] The present application provides a data encryption device for a network device. The present application divides sensitive data into multiple data blocks and only encrypts the remaining bit data in each data block, rather than encrypting the entire data block. This method effectively reduces the complexity and time cost of encryption operations, thereby improving the efficiency of data encryption. The present application extracts the first N bit data from multiple sensitive data blocks and generates a prefix-derived key based on the first N bit data to encrypt the remaining bit data. The present application uses the prefix-derived key to encrypt the remaining data, increasing the diversity and complexity of data encryption, thereby improving the confidentiality and security of the data. Even if an attacker intercepts the encrypted data, it is still difficult to decrypt the original data due to the lack of the prefix-derived key. Traditional full data block encryption methods often require high computational resources and energy consumption. The present application significantly reduces the workload of encryption calculations by only encrypting the remaining bit data, thereby reducing the consumption of computational resources. This is particularly beneficial for resource-constrained network devices, such as Internet of Things devices, as it can save computational resources and energy consumption while ensuring data security. The method of the present application can adapt to the needs of different types of data blocks and network environments. By flexibly adjusting the extraction of the first N bit data and the encryption of the remaining bit data, the present application can accommodate different data block sizes and network transmission requirements, providing flexible adaptability. This flexibility is particularly suitable for dynamic and diverse network environments, ensuring efficient and secure data encryption and transmission for network devices in various use scenarios. By using the prefix-derived key, the present application simplifies the complex key management problem in traditional encryption methods. The generation of the prefix-derived key is related to the first N bit data, avoiding the need for frequent key replacement and distribution, thereby simplifying the key management process and improving the management efficiency and security of the encryption system.

[0208] Figure 3 is a schematic diagram of a terminal device according to an embodiment of the present application. As shown in Figure 3 The terminal device 3 of this embodiment includes a processor 30, a memory 31, and a computer program 32 stored in the memory 31 and executable on the processor 30, such as a data encryption program for a network device. The processor 30 implements the steps in each of the above-described data encryption method embodiments for a network device when executing the computer program 32, such as Figure 1 steps 101 to 104 as shown. Alternatively, the processor 30 implements the functions of the units in each of the above-described device embodiments when executing the computer program 32, such asFigure 2 the functions of the units shown.

[0209] The computer program 32 may, for example, be split up into one or more units, which are stored in the memory 31 and executed by the processor 30 in order to carry out the present application. The one or more units can be a series of computer program instructions for describing the execution of the computer program 32 in the terminal device 3. For example, the computer program 32 may, for example, be split up into units with the following specific functions:

[0210] an obtaining unit, configured to obtain sensitive data and split the sensitive data into N sensitive data blocks;

[0211] a first extracting unit, configured to extract front N-bit data and remaining bit data in the plurality of sensitive data blocks; wherein the remaining bit data refers to data after the front N-bit data in the sensitive data block;

[0212] a second extracting unit, configured to extract a prefix derived key based on the front N-bit data;

[0213] an encrypting unit, configured to perform encryption processing on the remaining bit data according to the prefix derived key, and send the front N-bit data and the encrypted remaining bit data to a target device.

[0214] The terminal device may, for example, include but is not limited to the processor 30 and the memory 31. Those skilled in the art can understand that, Figure 3 The terminal device 3 is merely an example and does not constitute a limitation on the terminal device 3, and can include more or fewer components than shown, or combine certain components, or include different components, for example, the terminal device can also include an input / output device, a network access device, a bus, etc.

[0215] The processor 30 may, for example, be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic, discrete hardware components, etc. The general-purpose processor may, for example, be a microprocessor or the processor can also be any conventional processor.

[0216] The memory 31 can be an internal storage unit of the terminal device 3, for example, a hard disk or a memory of the terminal device 3. The memory 31 can also be an external storage device of the terminal device 3, for example, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the terminal device 3. Further, the memory 31 can also include both the internal storage unit and the external storage device of the terminal device 3. The memory 31 is used to store the computer program and other programs and data required by the roaming control device. The memory 31 can also be used to temporarily store data that has been output or will be output.

[0217] It should be understood that the size of the serial number of each step in the above embodiment does not mean the order of execution, and the execution order of each process should be determined according to its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiment of the present application.

[0218] It should be noted that the information interaction, execution process and the like between the above devices / units, since the same concept as the method embodiments of the present application, the specific functions and the technical effects brought about, specific can refer to the method embodiments part, here will not be repeated.

[0219] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the above-mentioned division of each functional unit, module is exemplified, and in actual application, the above-mentioned functions can be completed by different functional units, modules according to needs, that is, the internal structure of the device is divided into different functional units or modules to complete all or part of the functions described above. Each functional unit and module in the embodiment can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or software. In addition, the specific name of each functional unit and module is only for easy distinction, and does not limit the protection scope of the present application. The specific working process of the unit and module in the above system can refer to the corresponding process in the foregoing method embodiments, which will not be repeated here.

[0220] The embodiment of the present application also provides a computer readable storage medium, the computer readable storage medium stores a computer program, the computer program is executed by the processor to realize the steps in each method embodiment.

[0221] The embodiment of the present application provides a computer program product, when the computer program product is run on a mobile terminal, the mobile terminal is caused to perform the steps in the above-mentioned various method embodiments.

[0222] The integrated unit, if in the form of a software function unit and sold or used as an independent product, can be stored in a computer-readable storage medium. Based on such understanding, the present application can implement all or part of the processes in the above-mentioned embodiment methods, and can be completed by instructing related hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps in the above-mentioned various method embodiments when executed by a processor. The computer program includes computer program code, which can be in the form of source code, object code, an executable file, or some intermediate form. The computer-readable medium at least includes any entity or device capable of carrying the computer program code to a photographing device / terminal equipment, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunications signal, and a software distribution medium. For example, a U disk, a mobile hard disk, a magnetic disk or an optical disk, and the like.

[0223] In the above-mentioned embodiments, the description of each embodiment has its own focus, and the parts not described or recorded in detail in a certain embodiment can be referred to the relevant description of other embodiments.

[0224] Those skilled in the art can realize that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be realized by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. The skilled person can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0225] In the embodiments provided by the present application, it should be understood that the disclosed apparatus / network device and method can be implemented in other ways. For example, the above-described apparatus / network device embodiments are merely schematic, for example, the division of the modules or units is merely a logical function division, and there can be another division manner in actual implementation, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the shown or discussed interconnections can be indirect coupling or communication connection through some interfaces, devices or units, and can be electrical, mechanical or other forms.

[0226] The units described as separate components can or can not be physically separate, and the components displayed as separate components can or can not be physical separate, and can be located at one place, or can be distributed to multiple network units.

[0227] It should be understood that the term “comprises / comprising” when used in this specification and the appended claims indicates the presence of the described features, integers, steps, operations, elements, and / or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0228] It should also be understood that the term “and / or” when used in this specification and the appended claims indicates that the associated listed items can or can not be present, one or more of the associated listed items are selected, and all possible combinations of the associated listed items are included.

[0229] As used in this specification and the appended claims, the term “if’ can be construed to mean “when” or “once” or “in response to determining” or “in response to ascertaining,” depending on the context. Similarly, the phrase “if it is determined” or “if it is ascertained that [the described condition or event]” can be construed to mean “once it is determined that” or “in response to determining” or “once it is ascertained that [the described condition or event]” or “in response to ascertaining that [the described condition or event],” depending on the context.

[0230] In addition, the terms “first,” “second,” “third,” etc. as used in the description of the application and the appended claims are used only to differentiate between different instances of the same feature, and are not meant to imply or suggest relative importance of the features so designated.

[0231] The description of the application herein is described with reference to specific embodiments thereof, which are offered to illustrate the application. It is not intended to limit the application to the specific forms or examples described. Rather, the intention is to cover all modifications, equivalents, and alternatives falling within the spirit and scope of the application as defined by the appended claims. The use of the terms “include,” “include,” “have,” and “comprise” and variations thereof herein are intended to be equivalent to the term “comprise” and are used in the sense of “including but not limited to,” unless otherwise noted. The terms “first,” “second,” and “third” and the like used in the description and in the claims are used for distinguishing between similar elements and not necessarily for describing a sequential or chronological order. It is to be understood that the terms so used are interchangeable under appropriate circumstances such that the embodiments of the application described herein are, for example, capable of use in either order.

[0232] The above-described embodiments are only used to illustrate the technical solutions of the present application, and are not intended to limit the present application; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application.

Claims

1. A data encryption method of a network device, characterized by, The data encryption method of the network device comprises: obtaining sensitive data and splitting the sensitive data into N sensitive data blocks; extracting the first N-bit data and the remaining bit data in each of the N sensitive data blocks; wherein the remaining bit data refers to the data after the first N-bit data in the sensitive data block; extracting a prefix derived key based on the first N-bit data; encrypting the remaining bit data based on the prefix derived key, and sending the first N-bit data and the encrypted remaining bit data to a target device; wherein the step of encrypting the remaining bit data based on the prefix derived key and sending the first N-bit data and the encrypted remaining bit data to the target device comprises: obtaining the original order of each sensitive data block; combining the first N-bit data corresponding to the sensitive data block with the original order to obtain a first combined data block; combining the remaining bit data corresponding to the sensitive data block with the original order to obtain a second combined data block; randomly arranging the original order corresponding to the N sensitive data blocks to obtain a confusion sequence; splitting the confusion sequence into a plurality of sequence arrays; wherein the number of sequences in each sequence array is two or three; encrypting the second combined data blocks corresponding to the plurality of sequence arrays, and sending the first combined data blocks and the encrypted second combined data blocks to the target device.

2. The data encryption method of a network device according to claim 1, wherein, The step of encrypting the second combined data blocks corresponding to the plurality of sequence arrays and sending the first combined data blocks and the encrypted second combined data blocks to the target device comprises: combining the second combined data blocks corresponding to the plurality of sequences in each sequence array to obtain a third combined data block; combining the first combined data blocks corresponding to the plurality of sequences in each sequence array to obtain a fourth combined data block; encrypting the third combined data block by the prefix derived key to obtain an encrypted data block; randomly sending a plurality of encrypted data blocks and a plurality of fourth combined data blocks to the target device.

3. The data encryption method of a network device according to claim 2, wherein, The step of randomly sending a plurality of encrypted data blocks and a plurality of fourth combined data blocks to the target device comprises: generating a random sending order corresponding to the plurality of encrypted data blocks; combining the random sending order with the encrypted data block to obtain a first interference order data block; wherein the random sending order in the first interference order data block is located before the original order; combining the random sending order with the fourth combined data block to obtain a second interference order data block; wherein the random sending order in the second interference order data block is located before the original order; sending the first interference order data block and the second interference order data block to the target device according to the random sending order.

4. The data encryption method of a network device according to claim 1, wherein, The step of extracting a prefix derived key based on the first N-bit data comprises: substituting the first N-bit data into a preset function to obtain the prefix derived key; The preset function is: ； ； wherein, denotes a prefix-derived key, denotes the number of sensitive data blocks, denotes the i-th, denotes the first N bits of the i-th sensitive data block, denotes the first weight, denotes the second weight, denotes a preset prime number, denotes the bit length of the output prefix-derived key, denotes a bitwise XOR operation, denotes a modulo operation.

5. The data encryption method of a network device according to claim 1, wherein, After the step of encrypting the remaining bit data based on the prefix derived key and sending the first N-bit data and the encrypted remaining bit data to the target device, the method further comprises: The target device receives the network device sending a plurality of first interference sequential data blocks and a plurality of second interference sequential data blocks; The random sequence in the first interference sequential data block is removed to obtain an encrypted data block; The random sequence in the second interference sequential data block is removed to obtain a fourth combined data block; N front N-bit data in the fourth combined data block is extracted; A prefix derived key is calculated based on a preset function and the N front N-bit data; The encrypted data block is decrypted based on the prefix derived key to obtain a third combined data block; Residual bit data in the third combined data block is extracted; The N front N-bit data and the residual bit data with the same original sequence are combined to obtain a sensitive data block; Sensitive data is combined according to the original sequence corresponding to the sensitive data block.

6. The data encryption method of a network device according to claim 5, wherein, The step of extracting N front N-bit data in the fourth combined data block includes: The plurality of fourth combined data blocks are sorted according to the number of characters from large to small to obtain a plurality of ordered fourth combined data blocks; The fourth combined data blocks in the front half of the plurality of ordered fourth combined data blocks are taken as a plurality of first to-be-split data blocks; The fourth combined data blocks in the rear half of the plurality of ordered fourth combined data blocks are taken as a plurality of second to-be-split data blocks; Each of the first to-be-split data blocks is processed by three equal divisions to obtain a first combined data block; Each of the second to-be-split data blocks is processed by two equal divisions to obtain a first combined data block; The original sequence in the first combined data block is removed to obtain N front N-bit data.

7. The data encryption method of network equipment according to claim 5, wherein, The step of extracting residual bit data in the third combined data block includes: The plurality of third combined data blocks are sorted according to the number of characters from large to small to obtain a plurality of ordered third combined data blocks; The third combined data blocks in the front half of the plurality of ordered third combined data blocks are taken as a plurality of first decryption data blocks; The third combined data blocks in the rear half of the plurality of ordered third combined data blocks are taken as a plurality of second decryption data blocks; Each of the first decryption data blocks is processed by three equal divisions to obtain a second combined data block; Each of the second decryption data blocks is processed by two equal divisions to obtain a second combined data block; The original sequence in the second combined data block is removed to obtain residual bit data.

8. A data encryption apparatus of a network device, characterized by comprising: The data encryption device of the network device includes: An acquisition unit is configured to acquire sensitive data and split the sensitive data into N sensitive data blocks; A first extraction unit is configured to extract N front N-bit data and residual bit data in a plurality of the sensitive data blocks; wherein the residual bit data refers to data after the N front N-bit data in the sensitive data block; A second extraction unit is configured to extract a prefix derived key based on the N front N-bit data; An encryption unit is configured to encrypt the residual bit data based on the prefix derived key, and send the N front N-bit data and the encrypted residual bit data to a target device; The encryption unit is configured to acquire an original sequence of each sensitive data block; ​ combining the first N bits of the sensitive data block with the original sequence to obtain a first combined data block; combining the remaining bits of the sensitive data block with the original sequence to obtain a second combined data block; randomly arranging the original sequences corresponding to the N sensitive data blocks to obtain a confusion sequence; dividing the confusion sequence into a plurality of sequence arrays; wherein the number of sequences in each sequence array is two or three; encrypting the second combined data blocks corresponding to the plurality of sequence arrays, and sending the first combined data block and the encrypted second combined data blocks to a target device.

9. A computer-readable storage medium storing a computer program, the computer program comprising instructions that, when executed by a computer, cause the computer to perform the method of any one of claims 1 to 8. The computer program, when executed by a processor, implements the steps in the data encryption method of the network device according to any one of claims 1 to 7.

Images