Data protection method and device, data decryption method and device, computer equipment, readable storage medium and program product

Abstract

The invention relates to a data protection method and device, a data decryption method and device, computer equipment, a computer readable storage medium and a computer program product. The data protection method comprises the steps of obtaining to-be-protected data; partitioning the to-be-protected data to obtain a plurality of to-be-protected data blocks; performing chaos processing on each to-be-protected data block to obtain a chaos value of each to-be-protected data block; according to the chaotic value, determining a protection identifier corresponding to each to-be-protected data block and an insertion position of the protection identifier; and performing protection processing on each to-be-protected data block according to the protection identifier and the insertion position to obtain a protected data block corresponding to each to-be-protected data block. By adopting the method, the security of the data can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer data processing, and particularly relates to a data protection method and device, a data decryption method and device, a computer equipment, a computer readable storage medium and a computer program product. BACKGROUND

[0002] In the field of data transmission, in order to improve the security of data, the data can be protected, and in the related technology, the data is generally protected and transmitted based on the traditional encryption algorithm such as DES (Data Encryption Standard, symmetric key block cipher algorithm) and AES (Advanced Encryption Standard, high-level protection standard), which has the problem of insufficient security and cannot be applied to sensitive data transmission scenarios with high security requirements. SUMMARY

[0003] Therefore, it is necessary to provide a data protection and decryption method, device, computer equipment, computer readable storage medium and computer program product capable of improving data security in view of the above technical problems.

[0004] In a first aspect, the present application provides a data protection method, which comprises:

[0005] obtaining to-be-protected data;

[0006] performing block processing on the to-be-protected data to obtain a plurality of to-be-protected data blocks;

[0007] performing chaotic processing on each to-be-protected data block to obtain a chaotic value of each to-be-protected data block;

[0008] determining a protection identifier corresponding to each to-be-protected data block and an insertion position of the protection identifier according to the chaotic value;

[0009] performing protection processing on each to-be-protected data block according to the protection identifier and the insertion position to obtain a protected data block corresponding to each to-be-protected data block.

[0010] In a second aspect, the present application provides a data decryption method, which comprises:

[0011] receiving to-be-decrypted data; the to-be-decrypted data comprises a plurality of to-be-decrypted data blocks;

[0012] identifying a protection identifier from each to-be-decrypted data block; the protection identifier is obtained by performing chaotic processing on original data corresponding to the to-be-decrypted data in advance;

[0013] decrypt the to-be-decrypted data according to the protection identifier, to obtain a decrypted data block corresponding to the to-be-decrypted data block;

[0014] combine the decrypted data blocks, to obtain the original data corresponding to the to-be-decrypted data.

[0015] In a third aspect, the present application provides a data protection device, the device comprising:

[0016] an acquisition module configured to acquire to-be-protected data;

[0017] a first processing module configured to perform block processing on the to-be-protected data, to obtain a plurality of to-be-protected data blocks;

[0018] a second processing module configured to perform chaotic processing on each to-be-protected data block, to obtain a chaotic value of each to-be-protected data block;

[0019] a determination module configured to determine, according to the chaotic value, a protection identifier corresponding to each to-be-protected data block and an insertion position of the protection identifier;

[0020] an insertion module configured to perform protection processing on each to-be-protected data block according to the protection identifier and the insertion position, to obtain a protected data block corresponding to each to-be-protected data block, respectively.

[0021] In a fourth aspect, the present application provides a data decryption device, the device comprising:

[0022] a receiving module configured to receive to-be-decrypted data; the to-be-decrypted data comprising a plurality of to-be-decrypted data blocks;

[0023] an identification module configured to identify, for each to-be-decrypted data block, a protection identifier from the to-be-decrypted data block; the protection identifier being obtained by performing chaotic processing on original data corresponding to the to-be-decrypted data;

[0024] a decryption module configured to decrypt the to-be-decrypted data according to the protection identifier, to obtain a decrypted data block corresponding to the to-be-decrypted data block;

[0025] a combination module configured to combine the decrypted data blocks, to obtain the original data corresponding to the to-be-decrypted data.

[0026] In a fifth aspect, the present application provides a computer device comprising a memory and a processor, the memory storing a computer program, and the processor implementing the steps of the method of any one of the first aspect or the second aspect when executing the computer program.

[0027] In a sixth aspect, the present application provides a computer readable storage medium, having stored thereon a computer program, which, when executed by a processor, implements the steps of the method of the first aspect or the second aspect.

[0028] In a seventh aspect, the present application provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of the method of the first aspect or the second aspect.

[0029] The data protection method, device, computer device, computer readable storage medium and computer program product can improve the efficiency of data protection by obtaining to-be-protected data, performing block processing on the to-be-protected data to obtain a plurality of to-be-protected data blocks, performing chaotic processing on each to-be-protected data block to obtain a chaotic value of each to-be-protected data block, determining a protection identifier corresponding to each to-be-protected data block and an insertion position of the protection identifier according to the chaotic value, increasing the cracking difficulty of the protection identifier and the randomness of the insertion position of the protection identifier through chaotic processing, and finally inserting the protection identifier corresponding to each to-be-protected data block into the insertion position corresponding to each to-be-protected data block to obtain a protected data block corresponding to each to-be-protected data block, thereby effectively improving the effectiveness of data protection.

[0030] The data decryption method can improve the protection strength of to-be-decrypted data by receiving to-be-decrypted data, identifying a protection identifier from each to-be-decrypted data block, and performing decryption processing on the to-be-decrypted data according to the protection identifier. The protection identifier is obtained through chaotic processing of original data corresponding to the to-be-decrypted data in advance. The to-be-decrypted data can be decrypted according to the data encryption type and the parameters used for data protection parsed from the protection identifier based on a preset identifier format, thereby improving the decryption accuracy of the to-be-decrypted data. The decrypted data block corresponding to each to-be-decrypted data block is obtained by decrypting each to-be-decrypted data block according to the data encryption type and the parameters used for data protection. The original data corresponding to the to-be-decrypted data is obtained by combining the decrypted data blocks, thereby improving the accuracy and effectiveness of data decryption. BRIEF DESCRIPTION OF DRAWINGS

[0031] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related art, the drawings needed to be used in the description of the embodiments of the present application or the related art will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other related drawings can also be obtained without creative labor.

[0032] Figure 1 a diagram of an application environment of a data protection method in an embodiment;

[0033] Figure 2 a flowchart of a data protection method in an embodiment;

[0034] Figure 3 a flowchart of a data decryption method in an embodiment;

[0035] Figure 4 a flowchart of a data protection method in another embodiment;

[0036] Figure 5 a flowchart of a data protection step in another embodiment;

[0037] Figure 6 a structural block diagram of a data protection device in an embodiment;

[0038] Figure 7 a structural block diagram of a data decryption device in an embodiment;

[0039] Figure 8 an internal structure diagram of a computer device in an embodiment. DETAILED DESCRIPTION

[0040] In order to make the purposes, technical solutions and advantages of the present application clearer, further detailed description will be made to the present application in combination with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application, and are not used to limit the present application.

[0041] Before the data protection method of the embodiments of the present application is described, the related art and the problems thereof will be further described:

[0042] In the related art, in the field of data transmission, data protection in the transmission process can be achieved by encrypting the data. The encryption algorithm generally includes symmetric encryption (using block cipher, stream cipher) and asymmetric encryption (using public key cryptography). Among them, symmetric encryption can include DES (Data Encryption Standard) block cipher, AES (Advanced Encryption Standard), asymmetric encryption algorithm can include RSA (Rivest-Shamir-Adleman, asymmetric encryption) algorithm, the data processing mode of the above traditional encryption algorithm is too fixed, and the static key taken is easy to be leaked and cracked. For example, the DES (Data Encryption Standard) algorithm divides the plaintext data into fixed-length 64-bit blocks, and then encrypts each block independently, which is vulnerable to chosen plaintext attacks.

[0043] With the increasing demand for data protection, dynamic keys based on chaos theory are generated. For example, combining a chaotic sequence with a DES block cipher, the key of the DES algorithm is dynamically generated through chaos, thereby improving the key expansion mechanism of the traditional block cipher and improving the encryption strength. However, this improvement scheme only focuses on the dynamic key generation link of the encryption link, and the security assumption still stays at the protection level of the traditional encryption algorithm, and it cannot verify the integrity of the data.

[0044] The data protection method provided by the embodiments of the present application can be applied to, for example Figure 1The application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data required by the server 104 to process. The data storage system can be integrated on the server 104, or placed on the cloud or other network servers. The server 104 obtains the to-be-protected data sent by the terminal 102; the to-be-protected data is processed by block, and a plurality of to-be-protected data blocks are obtained; each to-be-protected data block is processed by chaos, and the chaos value of each to-be-protected data block is obtained; according to the chaos value, the protection identifier corresponding to each to-be-protected data block and the insertion position of the protection identifier are determined; the protection identifier corresponding to each to-be-protected data block is inserted into the insertion position corresponding to each to-be-protected data block, and the protected data block corresponding to each to-be-protected data block is obtained. Among them, the terminal 102 can be, but not limited to, various personal computers, notebook computers, smart phones, tablet computers, Internet of Things devices and portable wearable devices, Internet of Things devices can be smart speakers, smart televisions, smart air conditioners, smart car-mounted devices, projection devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The head-mounted device can be a virtual reality (VR) device, an augmented reality (AR) device, smart glasses, etc. The server 104 can be a standalone physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0045] In an exemplary embodiment, as shown in Figure 2 , a data protection method is provided, and the method is applied to Figure 1 the server 104 as an example for illustration, including the following steps 202 to 208. Among them:

[0046] Step 202, obtaining to-be-protected data.

[0047] Among them, the to-be-protected data can be to-be-transmitted data. Specifically, the to-be-protected data can be data with high data security requirements, such as medical images, financial transactions and other sensitive data.

[0048] Step 204, processing the to-be-protected data by block to obtain a plurality of to-be-protected data blocks.

[0049] The block processing is used to divide the to-be-protected data into a plurality of data blocks, and each data block is taken as a to-be-protected data block for subsequent data protection processing. Specifically, the block processing can include stream encoding processing such as base64. Base64 converts 3 bytes (24 bits) of binary data into 4 Base64 characters. In the embodiment of the present application, the block processing before data protection can improve the processing efficiency of the to-be-protected data, and through the block stream processing, the data is read and protected at the same time, which can improve the transmission and processing of low-latency data such as financial data and medical data. In addition, by dividing the to-be-protected data into a plurality of to-be-protected data blocks, each to-be-protected data block is processed respectively, the processing process of each to-be-protected data block is independent of each other, the processing result of a single data block will not affect the transmission of the entire data stream, and different data blocks can be processed in parallel, thereby improving the performance.

[0050] In step 206, each to-be-protected data block is subjected to chaotic processing to obtain a chaotic value of each to-be-protected data block.

[0051] The chaotic processing refers to a nonlinear data processing based on the chaos theory, which is applied to data to realize data protection through the pseudo-random characteristics generated by a deterministic system. Specifically, the to-be-protected data block can be input into a preset chaotic processing model to obtain a corresponding chaotic value. The chaotic processing model can include Logistic mapping, Tent mapping, Henon mapping, Lorenz mapping, etc.

[0052] Considering the size of the to-be-protected data block, in order to improve the efficiency of the chaotic processing, the data features of the to-be-protected data block can be extracted, and the extracted data features are input into a chaotic processing model such as a Logistic equation for calculation to obtain a chaotic value sequence of the to-be-protected data block. The data features of the to-be-protected data block can be obtained by hash calculation of the to-be-protected data block.

[0053] Optionally, in order to further increase the information amount of the chaotic value protection, so as to improve the protection strength and effectiveness of the data protection in the subsequent step according to the chaotic processing result, the current data transmission scene features can be input into a preset chaotic processing model together with the aforementioned data features to obtain the chaotic value of the to-be-protected data output by the model, so that the chaotic value not only represents the data features of the original to-be-protected data but also carries the scene features during data transmission. The current data transmission scene features can include the current network state and the current time information, the current network state can include the device fingerprint of the sending device of the to-be-protected data, and the current time information can include the sending timestamp of the to-be-protected data, etc.

[0054] Step 208, according to the chaos value, determining the protection identifier corresponding to each of the to-be-protected data blocks and the insertion position of the protection identifier.

[0055] In order to improve the strength of data protection and the difficulty of plaintext attack on the protected data, unlike the scheme of inserting the identifier at a fixed position in the related art, in the embodiment of the present application, the insertion position of the protection identifier is obtained by mapping according to the chaos value. For example, the chaos value can be processed according to the preset identifier length of the protection identifier to obtain the insertion position. For example, the identifier length can be 1 bit, and the length of the chaos value sequence can be 256 bits, and the protection identifier can be the value of the chaos sequence value modulo 256. The insertion position of the protection identifier is dynamically controlled by mapping the chaos value, thereby eliminating the fixed block feature of the data block.

[0056] Correspondingly, considering that the insertion position reflects the chaos value information of the to-be-protected data block, the insertion position is inserted into the to-be-protected data block as the protection identifier, thereby realizing the recording of the original information of the to-be-protected data block. Alternatively, in order to further improve the complexity and cracking difficulty of the protection identifier, the insertion position and the data feature of the to-be-protected data block can also be data fused to obtain the protection identifier. The data feature can be a block fingerprint of the to-be-protected data block, and the block fingerprint can be obtained by hashing calculation on the to-be-protected data block, and the first preset length, such as the first 2 bits, is taken.

[0057] In order to improve the efficiency of data protection processing while ensuring the effectiveness of data protection, the protection mode type of the to-be-protected data block, such as whether to perform encryption processing or only perform data confusion processing, can also be determined according to the chaos value of the to-be-protected data block. Therefore, in another embodiment of the present application, the protection identifier can also include the information of the protection type, and the type information of the protection strategy is used to represent the protection type of the to-be-protected data block, thereby facilitating subsequent data restoration processing on the protected data according to the corresponding type, and realizing the restoration of the transmission data.

[0058] Step 210, according to the protection identifier and the insertion position, performing protection processing on each of the to-be-protected data blocks to obtain the corresponding protected data block of each of the to-be-protected data blocks.

[0059] The protection identifier is inserted into the to-be-protected data block at the insertion position, so as to protect the to-be-protected data. Optionally, the chaos value of the to-be-protected data block can represent the information certainty and complexity of the data block, for example, the amount of information carried by the data block. Different protection strategies can be adopted for data blocks with different information amounts and complexities, so as to achieve the required data protection strength. For example, for a to-be-protected data block with a small chaos value, a processing method with slightly lower protection strength can be adopted, for example, only the data is shuffled, so as to improve the data processing efficiency while ensuring the data security. Correspondingly, for a to-be-protected data block with a large chaos value, the data block can carry more complex information, and therefore, the protection strength required by the data block is large. Therefore, in addition to inserting the protection identifier obtained by mixing the data characteristics and the insertion position into the to-be-protected data block, so as to record the original information of the data and complete the data protection, the to-be-protected data block can also be encrypted, so as to further improve the strength of the data protection. The encryption processing can use a preset encryption key. Preferably, in order to improve the cracking difficulty of the encrypted data, the encryption key can be derived based on the chaos value of the to-be-protected data block. The key derivation is used to improve the cracking difficulty of the encryption key, and can include quantum cryptography-based key derivation, for example, N-th Degree Truncated Polynomial Ring (NTRU) lattice-based cryptography.

[0060] Optionally, in order to ensure the effectiveness of the protected data, a lossless insertion technology can be used to insert the protection identifier. The lossless insertion technology can be implemented by character set replacement and data bit multiplexing, and the embodiments of the present application do not limit this. Optionally, after the protection identifier is inserted, the effectiveness of the protected data can be detected. For example, based on the data block method, the format of the protected data block is verified whether it still meets the data format requirements of the data block. For example, in the case of Base64 encoding for data block, the Base64 encoding legality of the protected data can be detected.

[0061] In an exemplary embodiment, the step of chaotically processing each to-be-protected data block to obtain a chaos value of each to-be-protected data block includes:

[0062] For each to-be-protected data block, the data characteristics of the to-be-protected data block are extracted.

[0063] The device fingerprint of a first device that sends the to-be-protected data and the current timestamp are obtained.

[0064] The data characteristics, the current timestamp, and the device fingerprint are chaotically processed to obtain the chaos value of the to-be-protected data block.

[0065] The data feature can be obtained by performing hash calculation on the to-be-protected data block, the type of the hash calculation can include SHA3-256, MD5, etc., and the hash value obtained by the hash calculation is subjected to floating-point mapping to obtain a floating-point value as a data fingerprint. The device fingerprint of the first device can include MAC / IMEI and other information for specifically representing the first device. In order to improve the complexity of the data chaos value and thus improve the security of data protection, the current timestamp can be millisecond-level. The generation process of the chaos sequence can include inputting the data feature, the current timestamp and the device fingerprint into a preset chaos processing model to obtain a chaos sequence output by the chaos processing model, and taking the value of the chaos sequence as the chaos value of the to-be-protected data block. The chaos processing model can include a Logistic equation. Alternatively, in order to ensure the dynamics and randomness of the chaos value and thus improve the security of data protection, the Logistic equation can be an improved Logistic equation, wherein a nonlinear strength control parameter μ ∈ [3.8, 4.0]. For example, the current timestamp can be 20231030123000, the device fingerprint can be IMEI-1234567890, and the data feature can be SHA3-256 (“data_block”) = 0xA1B2.... The data feature, the current timestamp and the device fingerprint are combined as an initial value x0 = MD5 (timestamp || device ID || data hash), and x0 can be obtained as a floating-point number 0.7321. The initial value is input into the improved Logistic equation (μ = 3.9) for iteration for a preset number of times (denoted as n) to obtain a chaos value sequence: x n +1=μx n (1-x n ). For example, for the floating-point number 0.7321, the iteration can be performed for 5 times, and the iteration obtains [0.7321→0.653 →0.8123→...] as the corresponding chaos sequence.

[0066] In an exemplary embodiment, the determination of the protection identifier corresponding to each to-be-protected data block and the insertion position of the protection identifier according to the chaos value includes:

[0067] Comparing the chaos value with a preset chaos value threshold to determine the protection type corresponding to the to-be-protected data block;

[0068] Calculating according to the data feature of the to-be-protected data block to obtain a data fingerprint of the to-be-protected data block;

[0069] Converting the chaos value to obtain the insertion position;

[0070] The protection identifier is obtained by combining the data fingerprint, the insertion position, and the protection type.

[0071] The protection type is used to represent the type of the way of protecting the data to be protected, and can include confusion processing, protection processing, etc. Considering that the chaos value can represent the amount of information carried by the data, and the protection strength required for data security of data with different information amounts can be different, for example, data with a larger amount of information carried needs a stronger protection way to protect, and correspondingly, data with a lower chaos value contains higher information redundancy, so a relatively lower data protection way can be taken. Specifically, the type label can be a binary value, if the chaos value of the data block to be protected is greater than the chaos value threshold, it is set to 1, representing that the data block to be protected is encrypted, and if the chaos value of the data block to be protected is less than or equal to the chaos value threshold, it is set to 0, representing that the data block is protected by confusion. The chaos value threshold can be set to be relatively large, for example, it can be set to 0.7.

[0072] If the chaos value is greater than the chaos value threshold, it represents that the chaos degree of the data block to be protected is large, that is, the amount of information it contains is large, so it needs stronger protection, and correspondingly, if the chaos value is less than the chaos value threshold, it represents that the chaos degree of the data block to be protected is relatively low, that is, the amount of information it carries is small, so a relatively low protection way can be taken to ensure the data security of the data block. Therefore, if the chaos value is greater than the chaos value threshold, the protection type can be obtained by combining the data fingerprint, the insertion position, and the type label corresponding to the protection type of the data block to be protected, to obtain a protection identifier that can represent the data characteristics and the current data transmission scenario. The complexity of the protection identifier is high, and the protection processing of the data block to be protected is based on the protection identifier with high complexity. Correspondingly, if the chaos value is less than or equal to the chaos value threshold, the protection type can be confusion processing, such as only scrambling the data of the data block to be protected to achieve effective protection of the data block.

[0073] The determination process of the data fingerprint can include: performing hash calculation on the data block to be protected, and taking the result of the hash calculation as the data fingerprint. The hash calculation can be BLAKE3, and the pre-set bits can be set according to requirements, for example, the first 2 bytes.

[0074] The coordinates of the insertion position can be converted according to the pre-set coordinate length of the insertion position, to obtain the insertion position. For example, the insertion position can be obtained by taking the chaos sequence value modulo 256.

[0075] Optionally, the determination process of the insertion position can be as follows:

[0076] pos = (SHA256 (timestamp || device fingerprint) [0:4]) % (L-T-B) + B;

[0077] wherein, pos is the insertion position; L is the total length of the data to be protected; T is the preset length of the protection identifier (e.g., can be 4 bytes); B is the preset anti-overflow buffer (e.g., can be 16 bytes by default). In the above formula, the first 4 bytes of the data feature are extracted by SHA256, thereby reducing the amount of calculation, ensuring the calculation efficiency and providing a sufficient entropy value space of 2 32 In addition, by setting the buffer B, the marker overflow can be prevented, and the division rule of the aforementioned data block can be compatible, such as line break every 76 characters. In addition, dynamic modulo operation is performed by %(L-T-B), which ensures that the marker is randomly distributed within the effective data range.

[0078] In an exemplary embodiment, the process of data protection further comprises:

[0079] According to the protection type, the data block to be protected is protected to obtain a processed data block; wherein, if the chaotic value is less than or equal to the chaotic value threshold, the protection type includes confusion protection; if the chaotic value is greater than the chaotic value threshold, the protection type includes encryption protection; the key information used in the encryption protection is determined according to the chaotic value;

[0080] According to the insertion position, the protection identifier is inserted into the processed data block to obtain a protected data block corresponding to the data block to be protected.

[0081] Based on the data protection by inserting the protection identifier, the protection mode for the data plaintext of the data block to be protected is determined based on the data feature (represented as the chaotic value) of the data block to be protected, which can improve the effectiveness of data protection, and also improve the flexibility and efficiency of data protection.

[0082] Specifically, if the chaos value is less than or equal to the chaos value threshold, the data uncertainty of the data block to be protected is relatively low, and the information carried is relatively less. Therefore, in order to improve the data processing efficiency and save the resources of data protection calculation, for the data block to be protected with relatively low chaos value, the corresponding protection strength is relatively low, and therefore only the plaintext of the data block can be subjected to confusion processing. The confusion processing is used to eliminate the regularity of the plaintext of the data block, and can be chaos displacement confusion, disorder processing, etc. Correspondingly, in order to facilitate decryption of the data, the type label can be inserted into the data block to be protected as a protection identifier. The chaos displacement confusion refers to an encryption technology based on a chaotic system, which includes the following processes: first, a pseudo-random sequence is generated by using a Logistic mapping, a Lorenz system, etc. as a displacement or replacement rule. Then, each bit of the plaintext is subjected to nonlinear displacement (such as cyclic shift, random index exchange) according to the chaos sequence value. Finally, the plaintext statistical characteristics (such as frequency distribution) tend to be uniform through multi-round operation for chaos confusion. For example, as shown in Table 1, there can be a data block to be protected 1 and a data block to be protected 2, wherein the data block to be protected 1 is "Hello, World!...", and the data block to be protected 2 is "{encrypted_data}". The protection identifiers corresponding to the data block to be protected 1 and the data block to be protected 2 are as shown in the following table.

[0083] Table 1: Protection identifier example table

[0084]

[0085] In an exemplary embodiment, in order to ensure the effectiveness of the data to be protected in the data transmission process, an identifier capable of representing data effectiveness can also be inserted into the data to be protected. The data effectiveness can include data integrity, data timeliness, etc. Considering that the transmission process of the data to be protected can be streaming transmission, in order to improve the efficiency of the candidate data to be protected according to the data effectiveness identifier for effectiveness verification, the above-mentioned data effectiveness identifier can be inserted into the data block to be protected at the target position, such as the head and / or tail position. Therefore, the processing process of the data block to be protected also includes:

[0086] Embedding the verification identifier into the target data block to be protected based on the target position; wherein the target position includes at least one of the head data block and the tail data block of the data to be protected; and the verification identifier includes at least one of a data integrity identifier and a data timeliness identifier.

[0087] The target data block to be protected is a data block to be protected located at a target position in the data to be protected. The data integrity identifier is used to represent the integrity of the data, and the data integrity identifier is verified to prevent data tampering. The verification method of the data integrity identifier can be to detect whether the data to be verified (to be decrypted) includes the data integrity identifier. Specifically, the data integrity identifier can be obtained by inserting a preset random value into the hash value (which can be calculated by SM3) corresponding to the data to be protected. The random value can be a pre-generated salt value of a preset length, such as 8 bytes. Preferably, considering the characteristics of the streaming processing of the data to be protected, the data integrity identifier can be embedded in the data block to be protected at the head position, so that when the data block to be protected is verified at the receiving end, the integrity of the data can be verified first, so that in the case of incomplete data, it can be determined that there may be illegal conditions such as data tampering, thereby the receiving and processing of the data block at the subsequent position can be stopped, thereby ensuring the legality of the data while improving the data processing efficiency. The data block to be protected at the head position can be the first data block to be protected.

[0088] The salt value can be generated by an algorithm capable of generating a high-security random number, such as by a CSPRNG (Cryptographically Secure Pseudorandom Number Generator).

[0089] The data validity identifier is used to represent the time information of the data, such as a timestamp of data generation or transmission. By verifying the data validity identifier, data replay attacks can be effectively prevented. Preferably, considering the characteristics of the streaming processing and transmission of the data to be protected, in order to improve the timeliness of the data validity identifier, the data validity identifier can be embedded in the data block to be protected at the tail position. The data block to be protected at the tail position can be the last data block to be protected.

[0090] Specifically, the generation process of the data validity identifier can include:

[0091] The SM4-CTR algorithm is used to encrypt and protect the timestamp according to a preset key. The preset key can be derived from the chaotic value corresponding to the aforementioned data block to be protected.

[0092] For example, first, the original timestamp, the encryption key, and the SM4-CTR parameters are obtained as follows: original timestamp T1 = 2025-06-15 14:30:00.123 encryption key: 256-bit key, which can be 0x7f3a1b9d...c89b and SM4-CTR parameters: counter initial value IV = 0x3A7FD41D.

[0093] The timestamp is formatted as follows: convert T1 to a Unix timestamp: 1750000000123, and encode the Unix timestamp to 16 bytes of binary: 0x00000198A05F9B7B.

[0094] SM4-CTR protection is performed: a keystream is generated using a key and an IV, and is XORed with the aforementioned formatted timestamp, including: first, a keystream is generated by SM4 protection of the counter: keystream = SM4_Encrypt(IV, key), such as: 0x5C3D...F2A1. Then, the keystream and the timestamp are XORed for protection: ciphertext = 0x00000198A05F9B7B^keystream, to obtain the data validity identifier.

[0095] In still another embodiment, as shown in Figure 3 a data decryption method is provided, the method comprising:

[0096] Step 302: receiving data to be decrypted; the data to be decrypted includes a plurality of data blocks to be decrypted.

[0097] The data to be decrypted can be protected sensitive data, such as protected financial data, medical data, etc. The data to be decrypted can be data with high requirements for data transmission delay.

[0098] Step 304: For each of the data blocks to be decrypted, a protection identifier is identified from the data block to be decrypted; the protection identifier is obtained by pre-chaotic processing of the original data corresponding to the data to be decrypted.

[0099] The determination and insertion processes of the protection identifier can refer to the foregoing embodiments, which will not be described here. According to the preset identifier format of the protection identifier, the extraction of the protection identifier is performed for each data block to be decrypted. The preset identifier format is used to represent the start and end of the protection identifier and the format characteristics of the data inside the identifier. For example, a specific character can be added before the protection identifier to represent the existence of the protection identifier, such as a specific character, which can be a preset field such as "‰TAG". The format characteristics of the data inside the identifier can include, for example, the length of the identifier, the number of constituent parts, the length and format of each constituent part, etc. For example, it can be specified that the length of the protection identifier is 4 bytes, and the constituent parts include, in order, 1 byte of protection type, 2 bytes of data fingerprint, and 1 byte of insertion position. The preset identifier format of the protection identifier can be previously agreed upon between the data transmitting and receiving ends.

[0100] Step 306: decrypting the data to be decrypted according to the protection identifier to obtain the decrypted data block corresponding to the data block to be decrypted.

[0101] The information of the protection type and the field position of the protection parameter in the protection identifier according to the preset identifier format corresponding to the protection identifier is parsed, to obtain the protection type and the protection parameter used by the to-be-decrypted data block during the protection processing. The protection type is used to represent the type of the data protection mode used for the original data corresponding to the to-be-decrypted data, which can include encryption protection, plaintext confusion protection, etc. The protection parameter is used to represent the data protection related parameter, such as the position of the protection identifier insertion, the data feature of the original data of the protected data.

[0102] For example, the identifier format can specify that the length of the protection identifier is 4 bytes, and the components thereof include 1 byte of protection type, 2 bytes of data fingerprint, and 1 byte of insertion position in sequence. Therefore, the information of the 1st byte of the protection identifier is read as the protection type, and the information of the 2nd to 4th bytes of the protection identifier is read as the protection parameter. Then, the to-be-decrypted data is decrypted (i.e., data restoration) according to the protection type and the protection parameter, to obtain the decrypted data block corresponding to the to-be-decrypted data block.

[0103] The process of data restoration can include: first determining the data restoration mode of the to-be-decrypted data according to the protection type, such as the data restoration mode corresponding to the encryption protection is decryption processing, and the data restoration mode corresponding to the confusion protection is inverse confusion processing; and then determining the key information of the encryption protection or the confusion rule for the confusion processing according to the protection parameter. In the embodiment of the present application, the insertion position of the protection identifier can be determined according to the chaos value of the original data corresponding to the to-be-verified data, and the key information of the encryption protection and the confusion rule for the confusion processing can be derived based on the chaos value. Therefore, the chaos value of the to-be-decrypted data block can be obtained by reverse processing based on the insertion position in the protection parameter, the data restoration parameter of the to-be-decrypted data can be determined based on the chaos value, such as the key information of the encryption protection or the confusion sequence value for the confusion processing derived based on the chaos value, and then the to-be-decrypted data block is restored based on the data restoration parameter, to obtain the decrypted data block corresponding thereto.

[0104] Step 308: combining the decrypted data blocks to obtain the original data corresponding to the to-be-decrypted data.

[0105] The decrypted data blocks are sequentially combined in the receiving order of the decrypted data blocks, to obtain the original data corresponding to the to-be-decrypted data, thereby realizing the decryption of the data.

[0106] In one embodiment, the protection identifier is parsed to obtain the protection type and the protection parameter corresponding to the to-be-decrypted data block;

[0107] According to the protection type, data restoration processing is performed on the to-be-decrypted data to obtain to-be-verified data;

[0108] According to the protection parameter, the original data feature corresponding to the to-be-verified data is determined.

[0109] The data feature of the to-be-verified data is compared with the original data feature to obtain an effectiveness verification result of the to-be-decrypted data.

[0110] According to the protection type, the data restoration manner of the to-be-decrypted data is determined, for example, the data restoration manner corresponding to encryption protection is decryption processing, and the data restoration manner corresponding to confusion protection is inverse confusion processing. According to the protection parameter, the key information of encryption protection or the confusion rule for confusion processing is determined. Based on the insertion position in the protection parameter, inverse processing is performed to obtain a chaotic value of the to-be-decrypted data block. Based on the chaotic value, the data restoration parameter for the to-be-decrypted data is determined, for example, the key information of encryption protection or the confusion sequence value for confusion processing is obtained based on the chaotic value. Therefore, based on the data restoration parameter, the to-be-decrypted data block is restored to obtain the to-be-verified data block.

[0111] According to the preset data format of the protection identifier, the original data feature corresponding to the to-be-verified data is read from the protection parameter. For example, first, the protection identifier is identified from the to-be-decrypted data block according to the preset identification format of the protection identifier (for example, a fixed character before the identifier, such as four fixed characters ‰TAG, and a preset identification data type, such as a tag content fixed four bytes = protection identifier (one byte) + fingerprint (two bytes) + coordinate (one byte)). Then, the original data fingerprint is read from the protection identifier.

[0112] In order to prevent tampering with the data, the data fingerprint of the to-be-verified data block and the data fingerprint recorded in the protection identifier can be compared. If the data feature of the to-be-verified data is consistent with the original data feature, it is determined that the to-be-decrypted data is valid, otherwise it is determined that the to-be-decrypted data is abnormal.

[0113] In one embodiment, the method further comprises:

[0114] The to-be-decrypted data block located at a target position in the to-be-decrypted data is identified according to a verification identifier. The verification identifier includes at least one of a data integrity identifier and a data timeliness identifier. The target position includes at least one of a head position and a tail position.

[0115] The at least one of the data integrity identifier and the data timeliness identifier is checked to obtain the effectiveness verification result.

[0116] The process of identifying and extracting the data integrity identifier and the data timeliness identifier can include: identifying and extracting the data integrity identifier in the to-be-decrypted data block according to a preset identifier format of the data integrity identifier and a target position of insertion. For example, the data integrity identifier can be a result of hash calculation on data added with a random string, where the random string can be salt information, the salt information is a uniquely generated random string, and the hash calculation can be performed through a one-way protection algorithm such as SHA-256 or bcrypt. The hash salt value is extracted from the to-be-decrypted data block at the head position according to the preset format of the hash salt value. Correspondingly, the data timeliness identifier can be identified and extracted from the to-be-decrypted data block according to the target position of insertion of the data timeliness identifier and a preset format of the data timeliness identifier.

[0117] The verification process of the data timeliness identifier can include: decrypting the data timeliness identifier according to a preset decryption key to obtain a decrypted timestamp. The decryption key can be derived from a chaos value of original data of the to-be-decrypted data. Then, a current time is obtained, and a time difference between the current time and the decrypted timestamp is calculated. Taking the to-be-decrypted data block with a Base64 tail as an example, the Base64 tail is extracted and decoded to obtain ciphertext 0x5C3D...E9DA, and then SM4-CTR decryption is performed to obtain the decrypted timestamp T1=2025-06-15 14:30:00.123 from plaintext 0x00000198A05F9B7B. The current time T2=2025-06-15 14:30:02.456 is obtained, and the original time difference ΔT_raw=T2-T1=2.333 seconds is calculated. Optionally, the original time difference can also be calibrated based on Kalman filtering. Finally, a calibrated time difference is output by filtering, and whether the calibrated time difference meets a preset time difference threshold is determined, so as to determine whether the timeliness of the to-be-verified data is legal, thereby avoiding a replay attack.

[0118] In one embodiment, the method further includes:

[0119] extracting the data integrity identifier, the data timeliness identifier, and the data fingerprint of the to-be-decrypted data by a first thread;

[0120] verifying the data integrity identifier, the data timeliness identifier, and the data fingerprint by a second thread; the second thread is executed asynchronously with the first thread.

[0121] The decryption process can be performed by the main thread to obtain the decryption result, and the decryption result can be verified by an independent thread pool separate from the main thread, including data integrity marking, data timeliness marking, and data fingerprint verification. Optionally, a dual-buffered queue can be established, with two buffers working alternately: one for writing (i.e., decryption) and the other for reading (i.e., verification). For example, the decryption thread writes data to buffer A, and the verification thread reads data from buffer B. When buffer A is full (or buffer B is empty), the roles of the two are switched by atomic pointer swapping. The decryption thread then writes to buffer B, and the verification thread reads from buffer A, thereby achieving real-time synchronization between the decryption and verification results. This embodiment of the invention, by asynchronously performing the data integrity marking, data timeliness marking, and data fingerprint extraction and verification processes, can effectively improve the efficiency of data verification and reduce data transmission latency, such as reducing end-to-end latency to less than 15ms.

[0122] Optionally, to improve data processing efficiency and better suit low-latency data transmission scenarios, in this embodiment of the invention, the extraction of data integrity identifiers, data timeliness identifiers, and data fingerprints can be implemented separately by multiple asynchronous threads, such as using the main thread for salt hash comparison (latency ≤ 0.5ms). Intermediate layer parallel parsing: a thread pool (e.g., 8 threads) extracts the markers, with a throughput greater than or equal to 1.2GB / s. Tail-end synchronous decryption: for example, dedicated hardware can be used to perform SM4 decryption, with a latency less than or equal to 1ms. By using independent threads to decrypt and verify the data to be decrypted in parallel, the efficiency of data decryption can be improved.

[0123] like Figure 4 As shown, in another embodiment of the present invention, the data protection process may include a selective data encryption process and a selective data decryption process:

[0124] The selective data encryption process includes: acquiring Base64 data to be protected; dynamically grouping the Base64 data to obtain multiple data groups, such as data group G1 and data group G2; calculating the chaos value of data group G1 and data group G2 respectively; deriving a key based on the chaos value; determining the encryption strategy of the data group based on the chaos value; encrypting data blocks with chaos values ​​greater than a preset chaos value threshold (e.g., 0.7) based on the derived key; preserving the original text for data blocks with chaos values ​​less than or equal to the preset chaos value threshold (e.g., 0.7); injecting the protection identifier corresponding to the data group into the data; and synthesizing the injected data to obtain the data to be transmitted.

[0125] Correspondingly, the data selective decryption process includes: receiving data to be decrypted, the data to be decrypted including a plurality of data groups, each data group including a plurality of data blocks, identifying a protection identifier of each data block, determining a data protection type of the data block according to the identification result, whether to perform encryption processing, if encryption processing is performed, performing decryption processing on the data according to the key corresponding to the data group, if encryption processing is not performed, removing the protection identifier from the data block to obtain original data. Finally, the processing result is recombined to obtain the original data corresponding to the data to be decrypted.

[0126] In one embodiment, as shown in FIG. 6, the data verification process includes: Figure 5

[0127] Receiving data to be verified, verifying the data integrity identifier of the data header of the data to be verified, wherein the data integrity identifier can be a hash salt value information. If the data integrity identifier verification of the data header is passed, the asynchronous verification process is started, otherwise it is judged that the data is invalid, and the data to be verified is discarded. Wherein, starting the asynchronous verification process is used to verify the protection identifier of the data to prevent the data from being tampered. Specifically, the protection identifier in the data is scanned out, the protection identifier is parsed to obtain the original data fingerprint corresponding to the data to be verified, the data fingerprint of the data to be verified is calculated, and the calculation result is compared with the original data fingerprint. If they are consistent, it is determined that the data fingerprint verification is passed, and the data time limit verification is continued. If they are not consistent, the data block inserted by the protection identifier corresponding to the inconsistent data fingerprint is recorded as an abnormal data block. The time limit verification process includes extracting and verifying the time limit identifier of the data block located at the tail. If the verification is passed, it is determined that the data to be verified is legal and valid, and the corresponding decryption data is output. If the verification is not passed, it is determined that the data is out of time, and there is a possibility of replay attack.

[0128] It should be understood that although each step in the flowchart involved in each embodiment as described above is displayed in sequence according to the arrow, these steps are not necessarily executed in sequence according to the arrow. Unless otherwise specified herein, the execution of these steps has no strict order limitation, and these steps can be executed in other order. Moreover, at least part of the steps in the flowchart involved in each embodiment as described above can include multiple steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily sequential, but can be executed in rotation or alternation with at least part of other steps or steps or stages in other steps.

[0129] ​Based on the same inventive concept, the embodiments of the present application further provide a data protection apparatus for implementing the above-mentioned data protection method. The implementation scheme for solving the problem provided by the apparatus is similar to the implementation scheme described in the above-mentioned method, and therefore the specific limitations in one or more data protection apparatus embodiments provided below can refer to the limitations of the data protection method described above, which will not be repeated here.

[0130] In one exemplary embodiment, as shown in Figure 6 a data protection apparatus is provided, comprising:

[0131] an acquisition module, configured to acquire to-be-protected data;

[0132] a first processing module, configured to perform block processing on the to-be-protected data to obtain a plurality of to-be-protected data blocks;

[0133] a second processing module, configured to perform chaotic processing on each to-be-protected data block to obtain a chaotic value of each to-be-protected data block;

[0134] a determination module, configured to determine, according to the chaotic value, a protection identifier corresponding to each to-be-protected data block and an insertion position of the protection identifier;

[0135] an insertion module, configured to perform protection processing on each to-be-protected data block according to the protection identifier and the insertion position, to obtain a protected data block corresponding to each to-be-protected data block.

[0136] Each module in the above-mentioned data protection apparatus can be realized wholly or partially by software, hardware and a combination thereof. Each module can be embedded in or independent of a processor in a computer device in hardware form, or can be stored in a memory in a computer device in software form, so as to be called and executed by a processor to perform the operations corresponding to each module.

[0137] Based on the same inventive concept, the embodiments of the present application further provide a data decryption apparatus for implementing the above-mentioned data decryption method. The implementation scheme for solving the problem provided by the apparatus is similar to the implementation scheme described in the above-mentioned method, and therefore the specific limitations in one or more data decryption apparatus embodiments provided below can refer to the limitations of the data protection method described above, which will not be repeated here.

[0138] In one exemplary embodiment, as shown in Figure 7 a data decryption apparatus is provided, comprising:

[0139] a receiving module, configured to receive to-be-decrypted data; the to-be-decrypted data comprises a plurality of to-be-decrypted data blocks;

[0140] The identification module is configured to identify a protection identifier from each of the to-be-decrypted data blocks; the protection identifier is obtained by performing chaotic processing on original data corresponding to the to-be-decrypted data.

[0141] The decryption module is configured to perform decryption processing on the to-be-decrypted data according to the protection identifier, to obtain a decrypted data block corresponding to the to-be-decrypted data block.

[0142] The combination module is configured to combine the decrypted data blocks, to obtain the original data corresponding to the to-be-decrypted data.

[0143] In an exemplary embodiment, a computer device can be provided, which can be a terminal, and an internal structure diagram of the computer device can be as shown in Figure 8 The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit, and an input device. The processor, the memory, and the input / output interface are connected through a system bus, and the communication interface, the display unit, and the input device are connected to the system bus through the input / output interface. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for running the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is configured to exchange information between the processor and external devices. The communication interface of the computer device is configured to perform wired or wireless communication with external terminals. The wireless communication can be achieved through WIFI, mobile cellular network, near field communication (NFC), or other technologies. The computer program is executed by the processor to implement a data protection method or a data decryption method. The display unit of the computer device is configured to form a visually visible picture, which can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen. The input device of the computer device can be a touch layer overlaid on the display screen, or can be a key, a trackball, or a touchpad arranged on the shell of the computer device. The input device can also be an external keyboard, a touchpad, or a mouse, etc.

[0144] Those skilled in the art can understand that Figure 8 the structure shown in the above description is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0145] In an example embodiment, a computer device is provided, comprising a memory and a processor, the memory storing a computer program, and the processor implementing the steps in the foregoing data protection method embodiments or the foregoing data decryption method embodiments when executing the computer program.

[0146] In an example embodiment, a computer readable storage medium is provided, storing a computer program, and the computer program implementing the steps in the foregoing data protection method embodiments or the foregoing data decryption method embodiments when executed by a processor.

[0147] In an example embodiment, a computer program product is provided, comprising a computer program, and the computer program implementing the steps in the foregoing data protection method embodiments or the foregoing data decryption method embodiments when executed by a processor.

[0148] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of related data need to comply with relevant regulations.

[0149] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when executed, can include the processes of the above-mentioned embodiment methods. Any reference to memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. The non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. The volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration but not limitation, the RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc. The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided in the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., without being limited thereto.

[0150] The technical features of the above embodiments can be combined in any manner. To make the description concise, all possible combinations of the technical features in the above embodiments are not described, but as long as the combinations of the technical features do not exist contradictions, they should be considered as the scope of the present application.

[0151] The above-described embodiments are merely illustrative of several embodiments of the present application, and the description is relatively specific and detailed, but should not be understood as a limitation on the scope of the patent. It should be noted that for those skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are all within the scope of the present application. Therefore, the scope of protection of the present application should be subject to the appended claims.

Claims

1. A data protection method, characterized by, The method comprises: acquiring to-be-protected data; performing block processing on the to-be-protected data to obtain a plurality of to-be-protected data blocks; performing chaotic processing on each to-be-protected data block to obtain a chaotic value of each to-be-protected data block; determining a protection identifier corresponding to each to-be-protected data block and an insertion position of the protection identifier according to the chaotic value; performing protection processing on each to-be-protected data block according to the protection identifier and the insertion position to obtain a protected data block corresponding to each to-be-protected data block.

2. The method of claim 1, wherein, The chaotic processing on each to-be-protected data block to obtain a chaotic value of each to-be-protected data block comprises: extracting a data feature of each to-be-protected data block; acquiring a device fingerprint of a first device sending the to-be-protected data and a current timestamp; performing chaotic processing on the data feature, the current timestamp and the device fingerprint to obtain the chaotic value of the to-be-protected data block.

3. The method of claim 1, wherein, The determination of the protection identifier corresponding to each to-be-protected data block and the insertion position of the protection identifier according to the chaotic value comprises: comparing the chaotic value with a preset chaotic value threshold to determine a protection type corresponding to the to-be-protected data block; calculating a data fingerprint of the to-be-protected data block according to the data feature of the to-be-protected data block; converting the chaotic value to obtain the insertion position; combining the data fingerprint, the insertion position and the protection type to obtain the protection identifier.

4. The method of claim 3, wherein, The comparison of the chaotic value with a preset chaotic value threshold to determine a protection type corresponding to the to-be-protected data block comprises: if the chaotic value is less than or equal to the chaotic value threshold, the protection type comprises obfuscation protection; if the chaotic value is greater than the chaotic value threshold, the protection type comprises encryption protection; key information adopted by the encryption protection is determined according to the chaotic value. The method further comprises: performing protection processing on the to-be-protected data block according to the protection type to obtain a processed data block; inserting the protection identifier into the processed data block according to the insertion position to obtain a protected data block corresponding to the to-be-protected data block.

5. The method of claim 1, wherein, The processing process of the to-be-protected data block further comprises: embedding a verification identifier into a target to-be-protected data block based on a target position; wherein the target position comprises at least one of a head data block and a tail data block of the to-be-protected data; and the verification identifier comprises at least one of a data integrity identifier and a data time limit identifier.

6. A data decryption method characterized by, The method comprises: receiving to-be-decrypted data; the to-be-decrypted data comprises a plurality of to-be-decrypted data blocks; for each to-be-decrypted data block, identifying a protection identifier from the to-be-decrypted data block; the protection identifier is obtained by performing chaotic processing on original data corresponding to the to-be-decrypted data in advance; performing decryption processing on the to-be-decrypted data according to the protection identifier to obtain a decrypted data block corresponding to the to-be-decrypted data block; combining the decrypted data blocks to obtain the original data corresponding to the to-be-decrypted data.

7. The method of claim 6, wherein, The decryption processing of the to-be-decrypted data according to the protection identifier obtains a decrypted data block corresponding to the to-be-decrypted data block, and the decryption processing comprises the following steps of: The protection identifier is parsed to obtain a protection type and a protection parameter corresponding to the to-be-decrypted data block; The to-be-decrypted data is subjected to data restoration processing according to the protection type to obtain to-be-verified data; The to-be-verified data is subjected to data restoration processing according to the protection type to obtain to-be-verified data; The to-be-verified data is compared with the original data feature to obtain an effectiveness verification result of the to-be-decrypted data.

8. The method of claim 7, wherein, The determination process of the effectiveness verification result further comprises the following steps of: The to-be-decrypted data block located at a target position in the to-be-decrypted data is subjected to verification identifier identification; the verification identifier comprises at least one of a data integrity identifier and a data time limit identifier; and the target position comprises at least one of a head position and a tail position. The at least one of the data integrity identifier and the data time limit identifier is subjected to verification to obtain the effectiveness verification result.

9. A data protection apparatus, characterized by comprising: The apparatus comprises: An acquisition module configured to acquire to-be-protected data; A first processing module configured to perform block processing on the to-be-protected data to obtain a plurality of to-be-protected data blocks; A second processing module configured to perform chaotic processing on each to-be-protected data block to obtain a chaotic value of each to-be-protected data block; A determination module configured to determine a protection identifier corresponding to each to-be-protected data block and an insertion position of the protection identifier according to the chaotic value; An insertion module configured to perform protection processing on each to-be-protected data block according to the protection identifier and the insertion position to obtain a protected data block corresponding to each to-be-protected data block.

10. A data decryption apparatus, characterized by comprising: The apparatus comprises: A receiving module configured to receive to-be-decrypted data; the to-be-decrypted data comprises a plurality of to-be-decrypted data blocks; An identification module configured to identify a protection identifier from each to-be-decrypted data block according to the to-be-decrypted data block; the protection identifier is obtained by chaotic processing on original data corresponding to the to-be-decrypted data; A decryption module configured to perform decryption processing on the to-be-decrypted data according to the protection identifier to obtain a decrypted data block corresponding to the to-be-decrypted data block; A combination module configured to combine the decrypted data blocks to obtain original data corresponding to the to-be-decrypted data. 11.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-10. The processor executes the computer program to implement the steps of the method of any one of claims 1 to 5 or 6 to 8.

12. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method of any one of claims 1 to 5 or 6 to 8.

13. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method of any one of claims 1 to 5 or 6 to 8.

Images