Data encryption method, electronic equipment and medium

Abstract

The invention discloses a data encryption method, electronic equipment and a medium, and relates to the technical field of computers, and the method comprises the steps: obtaining to-be-encrypted data, and format information, historical access information and source information corresponding to the to-be-encrypted data; extracting content information corresponding to the to-be-encrypted data; inputting the format information, the historical access information, the source information and the content information into a pre-constructed data type prediction model, and determining the data type of the to-be-encrypted data; determining an encryption algorithm of the to-be-encrypted data according to the data type and a preset mapping relationship between the data type and the encryption algorithm; and according to the encryption algorithm and a pre-configured key, encrypting the to-be-encrypted data to obtain encrypted data. According to the data encryption method and device, the accurate encryption algorithm is matched for the data based on the data type of the to-be-encrypted data, excessive encryption or insufficient encryption is avoided, and the data encryption efficiency is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a data encryption method, an electronic device and a medium. BACKGROUND

[0002] In the field of data storage and information security, with the wide application of storage devices, a large amount of sensitive data is stored centrally. Once these data are leaked, it may cause serious economic loss and security risk. Therefore, effective encryption protection of data in storage devices has become an important means to protect data security. How to dynamically select appropriate encryption strategy according to the characteristics of data, while ensuring security and improving encryption efficiency, has become a technical problem to be solved in the field of encryption of current storage devices. SUMMARY

[0003] The present application provides a data encryption method, an electronic device and a medium, to at least solve the problem of how to dynamically select an encryption strategy and improve encryption efficiency.

[0004] The present application provides a data encryption method applied to a controller in a storage device, which comprises: obtaining to-be-encrypted data, and format information, historical access information and source information corresponding to the to-be-encrypted data; extracting content information corresponding to the to-be-encrypted data; inputting the format information, the historical access information, the source information and the content information into a pre-constructed data type prediction model to determine a data type of the to-be-encrypted data; determining an encryption algorithm of the to-be-encrypted data according to the data type and a preset mapping relationship between data types and encryption algorithms; encrypting the to-be-encrypted data according to the encryption algorithm and a preconfigured key to obtain encrypted data.

[0005] The present application also provides a data encryption device, which comprises: an obtaining module configured to obtain to-be-encrypted data, and format information, historical access information and source information corresponding to the to-be-encrypted data; an extracting module configured to extract content information corresponding to the to-be-encrypted data; a first determining module configured to input the format information, the historical access information, the source information and the content information into a pre-constructed data type prediction model to determine a data type of the to-be-encrypted data; a second determining module configured to determine an encryption algorithm of the to-be-encrypted data according to the data type and a preset mapping relationship between data types and encryption algorithms; an encryption module configured to encrypt the to-be-encrypted data according to the encryption algorithm and a preconfigured key to obtain encrypted data.

[0006] The application further provides an electronic device, comprising a memory for storing a computer program, and a processor for executing the computer program to implement the steps of any of the data encryption methods.

[0007] The application further provides a computer readable storage medium, which stores a computer program, wherein the computer program is executed by a processor to implement the steps of any of the data encryption methods.

[0008] The application further provides a computer program product, which comprises a computer program, and the computer program is executed by a processor to implement the steps of any of the data encryption methods.

[0009] According to the application, the data type of the data to be encrypted is accurately determined based on the format information, historical access information, source information and content information of the data to be encrypted, in combination with a pre-constructed data type prediction model. Further, different encryption algorithms are selected for data of different data types according to a preset mapping relationship, for example, a complex encryption algorithm is used for data of high sensitivity, and a simple encryption algorithm is used for ordinary data. In this way, different encryption strategies are matched for data of different sensitivity levels, which not only ensures strong security protection of high-sensitive data, but also avoids resource waste caused by over-encryption of ordinary data, and prevents data leakage from the root. Under the premise of ensuring security, the consumption of computing resources is reduced, the data encryption efficiency is improved, and the encryption process is more intelligent and flexible. BRIEF DESCRIPTION OF DRAWINGS

[0010] In order to more clearly illustrate the embodiments of the application, the drawings needed in the embodiments will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative labor.

[0011] Figure 1 A flowchart of a data encryption method provided by an embodiment of the application; Figure 2 A schematic diagram of a data encryption system provided by an embodiment of the application; Figure 3 A scene schematic diagram of key generation provided by an embodiment of the application; Figure 4 A structure schematic diagram of a dynamic encryption module provided by an embodiment of the application; Figure 5 A structure schematic diagram of a data encryption device provided by an embodiment of the application; Figure 6 A structure schematic diagram of an electronic device provided by an embodiment of the application. DETAILED DESCRIPTION

[0012] The technical solutions in the embodiments of the present application will be described clearly and completely in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0013] It should be noted that, in the description of the present application, the terms “comprise”, “contain” or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device comprising a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device. The terms “first”, “second” and the like in the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence.

[0014] In order to enable a person skilled in the art to better understand the present application, the present application will be further described in detail below in combination with the drawings and specific embodiments.

[0015] First, the application scenario of the embodiments of the present application is exemplarily introduced.

[0016] In the field of data storage and information security, with the wide application of storage devices such as solid state drives (SSD) in the field of cloud computing, the security of data storage has become a focus of attention. In related technologies, the SSD encryption technology mainly relies on hardware encryption engine (such as self-encrypting drive (SED)) or general software encryption tool, and uses fixed encryption algorithm to uniformly process data. However, with the continuous growth of data volume and the diversification of application scenarios, this way gradually exposes the deficiencies in performance, key management and dynamic data protection. Therefore, how to improve encryption efficiency, simplify key management and realize fine protection of diversified data while ensuring data security has become an important issue to be solved in the encryption field.

[0017] Therefore, the embodiments of the present application provide a data encryption method to solve the problem of how to dynamically select an encryption strategy and improve encryption efficiency.

[0018] It should be noted that the execution subject of the data encryption method provided in the embodiments of the present application can be a data encryption device, which can be realized by software, hardware or a combination of software and hardware to become part or all of an electronic device, wherein the electronic device can be a server or a terminal, wherein the server in the embodiments of the present application can be a server or a server cluster composed of multiple servers, and the terminal in the embodiments of the present application can be a smart phone, a personal computer, a tablet computer, a wearable device, a smart robot and other smart hardware devices. In the following method embodiments, the execution subject is taken as an example to be an electronic device.

[0019] According to the embodiments of the present application, a data encryption method embodiment is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that here.

[0020] Figure 1 is a flowchart of a data encryption method provided according to the embodiments of the present application, which is executed by a controller in a storage device. As shown in Figure 1 , the flow includes: S101, obtaining to-be-encrypted data, and format information, historical access information and source information corresponding to the to-be-encrypted data.

[0021] Specifically, the format information corresponding to the to-be-encrypted data is used to describe the organization structure and encoding mode of the data. For example, the format information can be a file extension (such as a text file extension, a table file extension, an audio file extension, etc.), and can also be a data structure (such as JSON, XML format, etc.).

[0022] The historical access information refers to the relevant information of the to-be-encrypted data accessed in the past period of time, such as access time, access frequency, access source (such as which user, which IP address accesses the data).

[0023] The source information refers to the source or acquisition approach of the to-be-encrypted data. For example, the creator of the to-be-encrypted data (which can be determined by the user identity, process identification, etc. of the creator), the acquisition device of the to-be-encrypted data, such as sensor number, etc.

[0024] S102, extracting content information corresponding to the to-be-encrypted data.

[0025] Specifically, the content information refers to the semantic features or key contents in the to-be-encrypted data. For example, key words in a document, semantic information in a picture, semantic information in an audio file, key field values in structured data, etc.

[0026] For example, keywords in the document are extracted by a natural language processing (NLP) technique, semantic information in the picture is extracted by an image recognition model, and semantic information in the audio file is extracted by a voice recognition technique.

[0027] In S103, the format information, the historical access information, the source information, and the content information are input into a pre-constructed data type prediction model to determine the data type of the data to be encrypted.

[0028] Specifically, the data type prediction model can be a machine learning model or a deep learning model, which is used to automatically identify the data type. For example, the data type prediction can be a support vector machine, a convolutional neural network, a recurrent neural network, or the like. During training of the data type prediction model, the training data set includes the format information, the historical access information, the source information, the content information, and the data type corresponding to the above-mentioned data.

[0029] The data type can be sensitive data or non-sensitive data. More specifically, the data type can be high-sensitive data, medium-sensitive data, low-sensitive data, or the like.

[0030] In S104, an encryption algorithm of the data to be encrypted is determined according to the data type and a preset mapping relationship between the data type and the encryption algorithm.

[0031] For example, the encryption algorithm can be symmetric encryption (such as Advanced Encryption Standard 256-bit (AES-256)), asymmetric encryption (such as RSA), a hash algorithm (such as Secure Hash Algorithm (SHA)), or the like. For example, for sensitive data, the encryption algorithm can be AES-256, and for non-sensitive data, the encryption algorithm can be AES-128, or the like.

[0032] In S105, the data to be encrypted is encrypted according to the encryption algorithm and a pre-configured key to obtain encrypted data.

[0033] In the embodiments of the present application, the data type of the data to be encrypted is accurately determined based on the format information, the historical access information, the source information and the content information of the data to be encrypted, in combination with a pre-constructed data type prediction model. Further, different encryption algorithms are selected for data of different data types according to a preset mapping relationship, for example, a complex encryption algorithm is used for data of high sensitivity, and a simple encryption algorithm is used for non-sensitive data (also referred to as ordinary data). In this way, different encryption strategies are matched for data of different sensitivity levels, which not only ensures strong security protection for high-sensitive data, but also avoids resource waste caused by over-encryption of ordinary data, and prevents data leakage from the root.

[0034] In some embodiments, on the basis of the foregoing embodiments, the storage device further includes a plurality of storage areas.

[0035] Here, the plurality of storage areas are storage media of a plurality of areas divided physically or logically in the storage device. The physical storage areas can be a plurality of flash memories (NAND) in the SSD, and the logical plurality of storage areas can be a plurality of areas divided according to a plurality of logical addresses.

[0036] The historical access information includes a historical access frequency.

[0037] Specifically, the historical access frequency is a cumulative number of times that the data to be encrypted is accessed, and can be used to judge the access heat. For example, file A is accessed 100 times in the past week, and file B is accessed 2 times in the past week. Therefore, file A can be hot data, and file B can be cold data.

[0038] The method provided in the embodiments of the present application further includes the following steps: a1, obtaining a sequential degree, a preset storage duration and an encryption overhead corresponding to the data to be encrypted.

[0039] The sequential degree is used to indicate whether the address of the data to be encrypted is continuous when accessed, and the preset storage duration is determined based on the historical storage duration of the data to be encrypted.

[0040] Specifically, the sequential degree is an index for measuring whether the address is continuous when the data is accessed. For example, the sequential degree is 0, indicating that the address is completely random, and the sequential degree is 1, indicating that the address is completely sequential. For example, the sequential degree of a video file is relatively high, such as greater than 0.9, and the sequential degree of data in a database is relatively low, such as less than 0.3.

[0041] For example, the order of the data can be determined based on the data's format information. The order of the data to be encrypted can be determined based on a preset mapping relationship between format information and order. For instance, if the data is a video file or an image file, the order of the data is 1; if the data is a data structure file in the form of a set, the order is 0.

[0042] For example, the orderliness can be measured by the ratio of the number of consecutive accesses to the data's address within a preset historical time period to the total number of accesses. Specifically, the number of consecutive accesses to the storage address corresponding to the sub-data within the preset historical time period is the consecutive address access count for that data.

[0043] The preset storage duration refers to the predicted future storage time based on the historical storage duration of the data, used for lifecycle management. For example, if the data to be encrypted is stored for an average of 7 days within a preset historical time period, then the preset storage duration can be 7 days.

[0044] Encryption overhead refers to the computational resources required to encrypt the data, such as CPU time, power consumption, and latency. For example, AES-256 encryption of 1MB of data requires 0.5ms.

[0045] a2 determines the target storage area for the data to be encrypted in multiple storage areas based on historical access counts, order, preset storage duration, encryption overhead, and data type.

[0046] Specifically, the target storage area is the storage location selected from the storage devices after comprehensively considering the data characteristics of the data to be encrypted (i.e., historical access count, order, preset storage duration, encryption overhead, data type, etc.).

[0047] a3 stores the data to be encrypted in the target storage area.

[0048] In this embodiment of the application, the target storage device is determined in the storage device by the number of historical accesses, the order of access, the preset storage duration, the encryption overhead, and the data type. The data to be encrypted is placed in the storage device. While ensuring security, the storage location is flexibly selected according to the above data characteristics of the data to be encrypted.

[0049] In one possible implementation, in step a2 above, the target storage region for the data to be encrypted is determined from multiple storage regions based on historical access counts, ordering degree, preset storage duration, encryption overhead, and data type. This specifically includes the following steps: b1 determines the priority of the data to be encrypted based on historical access count, order, preset storage duration, and encryption overhead.

[0050] The priority is used to indicate the consumption of the storage device when the data to be encrypted is accessed. In this application, the more the data to be encrypted consumes the storage device when accessed, the higher the priority.

[0051] Specifically, the priority is a value or a level obtained according to the access characteristics, storage requirements and encryption costs of the data to be encrypted, and reflects the consumption of the data to be encrypted to the storage device performance, power consumption, delay and other resources when accessed. For example, the more the historical access times, the more frequent the access data, the higher the priority of the data to be encrypted. The higher the order degree, the more the storage device can reduce the additional delay and power consumption caused by random jump through continuous reading and writing, the higher the resource utilization efficiency, and the higher the priority of the data to be encrypted. The greater the encryption overhead, the more resources used by the storage device, the higher the priority, and the shorter the preset storage duration, the higher the priority of the data to be encrypted. For example, the historical access times are obtained through the input / output (Input / Output, I / O) log of the storage device; the order degree of the data to be encrypted is calculated from the access address sequence; the preset storage duration is predicted from the historical storage record; and the encryption overhead is determined by using the encryption algorithm and the mapping relationship between the encryption algorithm and the overhead.

[0052] Optionally, the priority of the data to be encrypted is determined according to the historical access times, the order degree, the preset storage duration and the encryption overhead, and specifically includes the following steps: First, a first quantization value corresponding to the historical access times is determined according to the historical access times and a first quantization rule; a second quantization value corresponding to the order degree is determined according to the order degree and a second quantization rule; a third quantization value corresponding to the preset storage duration is determined according to the preset storage duration and a third quantization rule; and a fourth quantization value corresponding to the encryption overhead is determined according to the encryption overhead and a fourth quantization rule.

[0053] For example, if the historical access times (within the preset historical duration) are greater than 100 times, the first quantization value is 10 points, if the historical access times (within the preset historical duration) are greater than 50 times and less than 100 times, the first quantization value is 5 points, and if the historical access times (within the preset historical duration) are less than 50 times, the first quantization value is 0 point.

[0054] For example, if the order degree is 1, the second quantization value is 10, and if the order degree is 0, the second quantization value is 0.

[0055] For example, if the preset storage duration is greater than 7 days, the third quantization value is 0, and if the preset storage duration is less than 7 days, the third quantization value is 10.

[0056] Taking the fourth quantization rule as an example, if the encryption overhead is greater than 60 seconds / GB, the fourth quantization value is 10, and if the encryption overhead is less than 10 seconds / GB, the fourth quantization value is 0.

[0057] Then, the priority is determined according to the first quantization value, the second quantization value, the third quantization value and the fourth quantization value.

[0058] For example, the first quantization value, the second quantization value, the third quantization value and the fourth quantization value are weighted and summed to obtain a comprehensive quantization value, and the priority is obtained according to the comprehensive quantization value and a preset mapping relationship between the comprehensive quantization value and the priority. The weights of the quantization values can be set according to actual conditions, which are not limited here.

[0059] b2, determines the target storage area according to the priority and the data type.

[0060] Optionally, the data type is sensitive data or non-sensitive data, and the storage device includes a first storage area and a second storage area. The data in the first storage area is written to the first storage area at a preset page level granularity, and the data in the second storage area is written to the second storage area at a preset block level granularity; when the data type is sensitive data and the priority is a first priority, the target storage area is the first storage area; or when the data type is non-sensitive data and the priority is a second priority, the target storage area is the second storage area.

[0061] Specifically, sensitive data refers to data that will cause serious security risks if leaked, such as user accounts, etc. Non-sensitive data refers to data that is public or has a small impact, such as promotional videos, public product manuals, etc.

[0062] The page level granularity is the smallest unit of data writing by the storage device. The first storage area is a high-performance storage area written at a page level granularity, suitable for data with frequent access and low latency requirements, and can be used to cope with scenarios that require frequent data updates. For example, the first storage area can be a single-level cell (SLC) area or a multi-level cell (MLC) cache area in an SSD. The first storage area writes data at a preset page level granularity, reducing the number of read and write times due to encryption, and has high read and write efficiency, so it can be used to store high-priority data.

[0063] The block-level granularity is a larger data unit composed of multiple pages. The second storage area is a mass storage area written at the block-level granularity, suitable for data with low access frequency and sequential writing, and suitable for scenarios of batch continuous writing data. For example, the second storage area can be a mass storage area of Quad-Level Cell (QLC) flash memory in the SSD. The overhead of writing a unit capacity in the second storage area is low, and the random write performance is lower than that of the first storage area.

[0064] The data of the first priority is high-priority data, which is usually data with high access frequency and high read-write performance requirement of the storage device, such as real-time analysis data. The data of the second priority is low-priority data, which is usually data with low access frequency and low read performance requirement of the storage device, such as historical backup data. Storing sensitive and high-priority data in the first storage area with page-level granularity for reading and writing helps to improve the random write performance, and storing non-sensitive and low-priority data in the second storage area with block-level granularity for reading and writing helps to reduce the performance waste of the storage device. In this way, by reasonably matching the data characteristics with the characteristics of the storage area, the resource utilization of the storage device is improved, unnecessary high-performance resource occupation is reduced, and the response speed of the storage device is improved.

[0065] For example, high-priority and high-sensitivity data to be encrypted can be placed in an SLC flash memory area with high performance and high encryption strength, medium-priority and medium-sensitivity data can be stored in an MLC area and use standard encryption, and low-priority and low-sensitivity data can be stored in a mass TLC area, and the encryption process can be simplified or omitted.

[0066] Here, for the data stored in the first storage area, the corresponding storage condition is that the data type is sensitive data, and the priority of the data is the first priority. For the data stored in the second storage area, the corresponding storage condition is that the data type is non-sensitive data, and the priority of the data is the second priority.

[0067] In addition, the storage device further includes a third storage area. The third storage area is used to store data that does not meet the storage condition of the first storage area and does not meet the storage condition of the second storage area. For example, the data in the third storage area can start variable rate encryption.

[0068] Specifically, the variable rate encryption is an encryption strategy that dynamically adjusts the encryption algorithm strength, key length or encryption mode according to the data characteristics (sensitivity, access frequency, performance requirements, etc.). High-strength encryption is used for high-sensitivity and high-priority data, and lightweight encryption or even no encryption is used for low-sensitivity and low-priority data, thereby reducing the impact of encryption on system performance while ensuring security. In this way, the hot data that is repeatedly moved is stored in the first storage area. The cold data is sequentially written to the second storage area and skips redundant encryption, significantly reducing the frequency and amount of garbage collection.

[0069] Optionally, the method provided by the embodiment of the application further includes the following content: When the target storage area is the first storage area, and the storage duration of the to-be-encrypted data reaches the preset storage duration, the to-be-encrypted data is migrated from the first storage area to the second storage area.

[0070] For example, in a certain transaction platform, the real-time order data of a user belongs to sensitive data and has a high priority, and therefore, the data is stored in the first storage area to ensure fast order processing and query. At the same time, the preset storage duration is set to one week, because the user usually queries the order status within one week, and after one week, the data is migrated from the first storage area to the second storage area.

[0071] In this way, the high-priority data can use the high-performance first storage area in the storage device during the active period, and after the preset storage duration is exceeded, the automatic migration of the data is realized, the high-performance resources of the storage device are avoided, and the space of the first storage area is released for new high-priority data.

[0072] In the embodiment of the application, the response speed of the storage device is improved by storing the high-priority data in the high-performance area, and the competition of the storage resources in the storage device by each to-be-encrypted data is reduced. At the same time, differential encryption is realized according to the data types, for example, high-sensitivity data is not stored in a low-security area, a high-performance area only stores high-priority data, and low-priority data can be stored in a large-capacity area with a lower cost. In this way, the storage resources in the storage device are reasonably allocated, the waste of the resources in the storage device is avoided, and the resource utilization rate of the storage device is improved.

[0073] In some embodiments, on the basis of any of the preceding embodiments, the method provided by the embodiment of the application further includes the following steps: c1, acquiring at least one signal value corresponding to at least one entropy source signal of the storage device within a preset historical time period based on the current time.

[0074] Specifically, the entropy source signal refers to a physical or logical signal inside or outside the storage device that can be used to extract randomness. These signals have unpredictability and can be used as a source of generating true random numbers.

[0075] For example, the entropy source signals can be thermal noise inside a storage chip, power voltage fluctuation, clock jitter, threshold voltage drift of a flash memory cell, etc. The above entropy source signals can be collected by a hardware sensor or read by a device driver interface to obtain the internal state of the device.

[0076] For example, when the entropy source signal is a power voltage signal, the at least one signal value can be 1.198V, 1.201V, 1.197V. When the entropy source signal is a disk seek time, the at least one signal value can be 1.2ms, 1.1ms, 1.3ms.

[0077] In the embodiments of the present application, five signals, i.e., RC Oscillator Jitter, write delay jitter, charge pump ripple, temperature, and a random signal generated by a hardware true random number generator, are used as entropy source signals.

[0078] c2, determining a preset number of target entropy source signals from all the entropy source signals according to the at least one signal value corresponding to each of the entropy source signals.

[0079] In a possible implementation, the preset number of target entropy source signals are determined from all the entropy source signals according to the at least one signal value corresponding to each of the entropy source signals, and specifically includes the following steps: First, the entropy rate of the first entropy source signal is determined according to the at least one signal value corresponding to the first entropy source signal.

[0080] The first entropy source signal is one of the at least one entropy source signal.

[0081] Specifically, the entropy rate is used to measure the average randomness (information entropy) that a certain entropy source signal can provide per unit time, and the unit is usually "bit / s". The higher the entropy rate, the stronger the randomness of the signal. For example, if 100 signal values of "power voltage fluctuation" are collected in 1 second, and it is calculated that each signal value can provide 0.8 bits of randomness, then the entropy rate is 80 bits / s.

[0082] For example, the entropy rate of the first entropy source signal is determined by the following method: extracting all the signal values of the first entropy source signal in a preset historical time period to form a data sequence; using an information theory algorithm (such as Shannon entropy calculation or approximate entropy algorithm) to calculate the total entropy value of the data sequence; and dividing the total entropy value by the length of the preset historical time period (such as 1 second) to obtain the entropy rate of the first entropy source signal.

[0083] Then, when the entropy rate corresponding to each of the entropy source signals is determined, the candidate entropy source signal is determined from the at least one entropy source signal according to the entropy rate corresponding to each of the entropy source signals and a preset entropy rate threshold.

[0084] Specifically, the candidate entropy source signals are a set of entropy source signals whose entropy rates reach or exceed a preset entropy rate threshold after entropy rate screening, and are a candidate pool for determining the target entropy source signals. For example, if the storage device has three entropy source signals with entropy rates of "power supply voltage fluctuation 80 bits / s, flash threshold voltage drift 60 bits / s, and I / O request interval 6 bits / s", and the preset threshold is 50 bits / s, then "power supply voltage fluctuation" and "flash threshold voltage drift" become candidate entropy source signals.

[0085] The preset entropy rate threshold can be set according to actual conditions. For example, according to the security requirements of the storage device, the preset entropy rate threshold is set to 50 bits / s, and only the entropy source signals with an entropy rate greater than or equal to 50 bits / s can enter the candidate stage.

[0086] Finally, the target entropy source signal is determined according to at least one signal value corresponding to each candidate entropy source signal.

[0087] Specifically, the target entropy source signal is a preset number of entropy source signals that are further selected from the candidate entropy source signals and are finally used to generate a key as an input for random number generation. Considering that there may be mutual correlation between entropy source signals, the embodiments of the present application further screen the entropy source signals to further improve the quality of the key.

[0088] Optionally, when there are multiple candidate entropy source signals, the correlation between each candidate entropy source signal is determined according to at least one signal value corresponding to each candidate entropy source signal, and the target entropy source signal is selected from each candidate entropy source signal according to the correlation between each candidate entropy source signal.

[0089] Specifically, the correlation between two entropy source signals refers to whether the change trend of the signal values of the two candidate entropy source signals is associated. High correlation indicates that the change of one entropy source signal can partially predict the change of another signal, thereby reducing the overall randomness of the key. The lower the correlation, the more complementary the randomness of the two entropy source signals, which helps to improve the overall quality of the key. In the embodiments of the present application, the candidate entropy source signals with high signal value correlation are further excluded by correlation to avoid reducing the randomness of the signal due to the correlation between the entropy source signals.

[0090] For example, the Pearson correlation coefficient, mutual information, and the like can be used to determine the correlation between two entropy source signals. One of the two entropy source signals with a correlation greater than a preset threshold is selected as the target entropy source signal.

[0091] For example, if the number of candidate entropy source signals is small, the candidate entropy source signal with the highest entropy rate can be selected as the basis, and then the candidate entropy source signals with a correlation less than or equal to a preset threshold with the signal are sequentially selected as the target entropy source signals until a preset number is reached.

[0092] For example, if there are more candidate entropy source signals, such as 10 or more, a genetic algorithm or a particle swarm optimization algorithm can be used to select a combination with the largest sum of entropy rates as the set of target entropy source signal processes, under the premise that the correlation between any two signals in the set is less than or equal to a preset threshold.

[0093] In yet another possible implementation, entropy values corresponding to each entropy source signal are determined according to at least one signal value corresponding to each entropy source signal, and the entropy values are sorted, and the first k signals with larger entropy values are selected as target entropy source signals.

[0094] c3, inputting at least one signal value corresponding to each target entropy source signal into a preset true random number generator to generate a key.

[0095] Specifically, the true random number generator (TRNG) is a device capable of generating unpredictable and non-repetitive random numbers.

[0096] In one possible implementation, the true random number generator includes a key derivation function (KDF), and the key derivation function includes a derivation round number.

[0097] Specifically, the derivation round number is the number of times that the core logic is executed in the key derivation function, and the more the round number, the greater the computational overhead of key generation and the stronger the anti-cracking ability.

[0098] The method provided by the embodiments of the present application further includes the following content: First, the derivation round number in the key derivation function is determined according to the data type of the data to be encrypted.

[0099] Then, input at least one signal value corresponding to each target entropy source signal and the derivation round number into the true random number generator to generate a key.

[0100] Taking the key derivation function based on the hash-based key derivation function HKDF+SHA-3 as an example, the number of types of sensitive data corresponds to a derivation round of 8192 rounds, and the number of types of non-sensitive data corresponds to a derivation round of 512 rounds. In this way, the sensitive data adopts a high round number derivation key, and even if part of the random signal is obtained, a large amount of loop logic is needed to obtain the key, and the anti-brute force cracking ability is strong, and the low sensitive data adopts a low round number, which meets the basic security while avoiding the waste of computing resources caused by a high round number. In addition, different data types correspond to different derivation rounds, so even if the key of a certain type of data is leaked (such as the 512 round key of low sensitive data), the attacker cannot crack other types of data (such as the 8192 round key of sensitive data), and "risk isolation" is achieved.

[0101] In addition, in the embodiments of the present application, for the to-be-encrypted data with a preset storage duration less than 24 hours, the key adopts a one-time strategy, and the corresponding derivation parameter is discarded after the key is used once, preventing backward cracking.

[0102] In the embodiments of the present application, the key is generated by multiple physical random sources, improving the anti-predictability of the key, so that even if part of the entropy source is attacked, other entropy sources can still ensure the quality of the key. In addition, the entropy rate is used to screen the entropy source signal, and the entropy source signal with low randomness is excluded to avoid the key being predictable due to insufficient randomness of the signal. Further, the candidate signals with high correlation are excluded during screening to avoid attackers deriving the overall randomness through a single signal vulnerability, thereby enhancing the security of the key.

[0103] In some embodiments, on the basis of any of the preceding embodiments, each storage area is connected to the controller through a channel corresponding thereto.

[0104] The storage device further includes a preset storage area, and the preset storage area includes at least one key slot, and the target key stored in the at least one key slot. The target storage area includes a plurality of physical blocks.

[0105] Specifically, in the storage device, each storage area communicates with the controller through an independent channel (such as a Peripheral Component Interconnect Express (PCIe) channel, a flash channel), and the channel serves as a dedicated path for data transmission. The preset storage area is an independent area for storing keys, and stores the keys through key slots.

[0106] The method provided in the embodiments of the present application further includes the following content: First, the logical block address of the to-be-encrypted data in the target storage area, the channel identifier corresponding to the target storage area, and the historical erase count of the target physical block within a preset historical time period are obtained.

[0107] wherein the channel identifier is used to indicate a channel corresponding to the target storage area, and the target physical block is a physical block in the plurality of physical blocks corresponding to the logical block address. Illustratively, the channel identifier corresponding to the target storage area can be obtained by querying a preset storage area-channel mapping table.

[0108] Specifically, the logical block address is a virtual address used by the storage device to locate data. The physical block is the smallest physical storage unit of the storage area (such as a flash block in an SSD), and is the basic unit of the erase operation. By the logical block address and the preset mapping relationship between the logical address and the physical block, the physical block where the data is actually stored can be determined.

[0109] The historical erase count refers to the total number of times the target physical block has been erased from the factory to the current time, which can be used to measure the life and stability of the physical block. The more the erase count of the physical block, the shorter the life. Illustratively, the erase count of each physical block can be obtained through a physical block erase count table of the storage device.

[0110] Then, according to the logical block address corresponding to the target storage area, the channel identifier, the historical erase count, and the preset storage duration, the target key slot corresponding to the key is determined.

[0111] Illustratively, the logical block address, the channel identifier, the historical erase count, and the preset storage duration are converted into binary data, and a feature value is calculated by a hash algorithm (such as SHA-256). Next, the feature value is taken modulo N (N is a positive integer) to obtain the slot number of the target key slot. For example, the feature value is 0xABCDEF12, and 0xABCDEF12%10=3.

[0112] Finally, the key is stored in the target key slot.

[0113] In the embodiments of the present application, the storage location of the key, i.e., the target key slot, is uniquely determined by the logical block address, channel identifier, and other information of the data, and the key cannot be obtained by "brute force traversal of key slots"; even if the key is obtained, it needs to be matched with the corresponding data location to be used, which greatly reduces the risk of key leakage and improves the attack resistance of the storage device.

[0114] In some embodiments, on the basis of the foregoing embodiments, the method provided by the embodiments of the present application further includes the following content: First, the historical encryption times corresponding to the target physical block in a preset historical time period are obtained with the current time as a reference.

[0115] Specifically, the historical encryption times refer to the total number of times that the target physical block is encrypted within a preset historical time period. The historical encryption times can reflect the data update frequency and the execution strength of the security policy. For example, a preset encryption-wear counter in the storage device is used to count the historical encryption times and the historical erase count of the physical block in the storage device.

[0116] Then, when it is determined according to the historical erase count and the historical encryption times that the target physical block does not meet the preset condition, the encrypted data is migrated to other physical blocks except the target physical block.

[0117] Optionally, when the historical erase count is greater than a preset erase times, and a ratio between the historical encryption times and the historical erase count is greater than a preset ratio, it is determined that the target physical block does not meet the preset condition.

[0118] Specifically, when the historical erase count is greater than the preset erase times, it indicates that the physical block has been used for a long time and is seriously worn, and it is easy to fail in advance if it continues to be used at a high frequency. When the ratio between the historical encryption times and the historical erase count is greater than the preset ratio, it indicates that the data in the physical block is frequently updated and each update involves encryption, and such a physical block often stores high-sensitivity and high-change-rate data, and if the hardware starts to be unstable, the risk of data loss or leakage is higher. The preset erase times and the preset ratio can be set according to actual conditions. For example, the preset erase times can be determined according to the maximum erase times that the physical block can withstand.

[0119] In this way, based on the historical erase count and the historical encryption times, the physical block that is about to reach the upper limit of the service life is identified in advance, so as to avoid the risk of data loss caused by hardware aging. At the same time, the use frequency of each physical block is balanced, wear balance is achieved, and the loss of a single physical block caused by frequent encryption / erase is reduced. In addition, migrating the encrypted data when it is determined according to the historical erase count and the historical encryption times that the target physical block does not meet the preset condition can avoid storing sensitive data on the physical block that is about to fail, and migrating the data in time can enhance the security of the data.

[0120] In some embodiments, on the basis of the foregoing embodiments, the method provided by the embodiments of the present application further includes the following content: First, environment data of the storage device and access data of the encrypted data are acquired.

[0121] Specifically, the environment data refers to real-time state data of the physical or running environment in which the storage device is located, and can reflect whether the device is in a safe running scenario. For example, the environment data includes, but is not limited to, temperature, vibration, voltage and other data of the storage device. The foregoing environment data is acquired through temperature sensors, vibration sensors and voltage sensors built in the storage device.

[0122] Access data records the access behavior of the encrypted data, such as access IP address, access mode, access frequency, and the like. Through the access data, whether the access to the encrypted data is compliant can be reflected. The access data can be obtained through the access log query of the storage device.

[0123] Then, when the environmental data does not satisfy the preset environmental condition, and / or, the access data of the encrypted data does not satisfy the preset access condition, the encrypted data is re-encrypted by using a new key.

[0124] For example, the preset environmental condition can be that the temperature is less than a preset temperature threshold, the vibration frequency is less than a preset vibration frequency, and the like. The preset access condition can check the access data from four dimensions of access IP, time, frequency, and permission. For example, the access IP 10.0.0.5 is not within the allowed range of “192.168.1.0 / 24”, or a single user attempts to access 5 times within 1 minute (exceeding the upper limit of 3 times), it is determined that the access data does not satisfy the preset condition. The preset environmental condition and the preset access condition can be set according to the actual application of the storage device, which is not limited here.

[0125] In the embodiments of the present application, when the environment of the storage device is abnormal, or the access is abnormal, there may be a cracking behavior. By triggering the re-encryption operation through real-time detection, the data protection level can be upgraded before the threat expands, and the data is decrypted after being stolen, so as to dynamically respond to security threats and improve the data risk resistance ability.

[0126] In some embodiments, the data encryption method provided by the embodiments of the present application is implemented by firmware (Firmware) in the SSD host chip. For example, a special microcontroller-oriented lightweight machine learning framework (TFLite-Micro) + a standard neural network library operator library (Cortex Microcontroller Software Interface Standard Neural Network, CMSIS-NN) runs a lightweight neural network, and the inference process is completely located in the disk, without occupying the central processing unit (Central Processing Unit, CPU) and dynamic random access memory (Dynamic Random Access Memory, DRAM) resources, thereby physically blocking “side channel sniffing” and solving the high delay problem caused by PCIe round trip of traditional host-side encryption software.

[0127] In some embodiments, a joint "encryption-wear" counter is added to the storage device: after each encrypted write operation, the controller first synchronously increments two 4-byte fields, "erase / write count" and "encryption count," in the spare area bits; the "encryption count" is only incremented when the data is determined to be "high-security" or "top-secret." The two counts are periodically reported to the controller with extended commands. Based on the ratio of "encryption count / erase / write count," the controller can accurately locate the trap block with both "high security and high erase / write" characteristics, and migrate or disable the trap block in advance. Subsequently, the migration results are obtained, and the sensitivity threshold for this type of scenario is automatically lowered, realizing a closed loop of "decision-wear recording-algorithm correction," which balances wear and maintains security strength.

[0128] In this way, by incorporating encryption behavior into the wear measurement dimension, a visual correlation between security strength and physical wear is formed, enabling the system to proactively identify and eliminate dual risk points of high security and high wear. The counter statistics are entirely completed by the on-disk controller hardware, without increasing the host's computing burden, filling the gap in related technologies where the impact of encryption load on flash memory lifespan cannot be quantified.

[0129] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method.

[0130] This application also provides an encryption system. For example... Figure 2 As shown, the system includes a data feature analysis module, an intelligent data caching module, an intelligent key management module, and a dynamic encryption module. The system is built into the solid-state drive and encrypts and decrypts data in memory through interaction with flash memory.

[0131] The data feature analysis module is a crucial component of the entire encryption system. It performs in-depth analysis of the data in the SSD, providing a scientific basis for subsequent encryption and caching strategies. This module can accurately classify data into sensitive and ordinary data based on its content, format, access frequency, and source. It can also identify frequently accessed data. This classification and identification process provides important support for subsequent encryption and caching strategies. For sensitive data, it is marked and then sent to the intelligent key management module to select the key corresponding to a high-strength encryption algorithm (such as AES-256). For ordinary data, it is marked and then sent to the intelligent key management module to select the key corresponding to a medium-strength encryption algorithm (such as AES-128), reducing computational resource consumption while ensuring a certain level of security. Simultaneously, frequently accessed data is marked and sent to the intelligent data caching module to avoid repeated encryption and decryption operations, thereby improving the overall system performance and response speed.

[0132] Further, the module first collects various types of data from the SSD, covering file content, file type, access frequency, file size, and data source, among other dimensions. Data sources are diverse, including metadata and file system logs of the SSD. The collected raw data undergoes a preprocessing stage to remove irrelevant information and fill in missing values, followed by normalization or standardization processing to ensure data format consistency. For example, file access frequency data is converted into standardized access frequency values for subsequent analysis. Based on preprocessing, the module further extracts meaningful features, including content features (such as file content keywords, text patterns), format features (such as file type), access features (such as file access frequency, access time interval), and source features (such as file generation source).

[0133] Further, the module uses statistical analysis, machine learning techniques, and professional field knowledge to carefully select features closely related to data sensitivity and access patterns from a large number of features, laying a foundation for subsequent model construction. With the help of accuracy, recall rate and other key evaluation indicators, as well as strict cross-validation procedures, the accuracy and reliability of the selected features are comprehensively evaluated to ensure that these features can accurately reflect the characteristics and needs of the data, providing strong support for the efficient operation of the entire encryption system.

[0134] The intelligent data caching module can significantly improve system performance through efficient data management strategies. First, the module relies on detailed analysis results provided by the data feature analysis module, including data access frequency, access patterns, data size, and other key features. Based on these analysis results, the intelligent data caching module can accurately determine which data is frequently accessed "hot data" and store it in the cache area. High-speed cache usually uses high-performance storage media to ensure fast data reading. When the system requests these data again, the intelligent data caching module can provide data directly from the cache, avoiding repeated encryption and decryption operations for the same data, thereby significantly reducing system computing overhead and improving data access response speed.

[0135] Further, to optimize the performance of the intelligent data caching module, various strategies can be adopted. First, the cache decision engine needs to have intelligent learning capabilities, capable of dynamically adjusting the caching strategy according to real-time data access patterns. For example, through machine learning algorithms to analyze the time series of data access, predict future frequent access data, and load it into the cache in advance. Second, the cache manager needs to implement an efficient cache eviction mechanism, such as the Least Recently Used (LRU) or First-In-First-Out (FIFO) algorithm, to ensure efficient use of cache space. In addition, the interface layer design considers seamless integration with other system modules to ensure efficient transmission of data requests and responses. Through these optimization strategies, the intelligent data caching module not only improves the overall performance of the system, but also adapts to different application scenarios and data access patterns.

[0136] The intelligent cache and security parallel processing adopts an in-page metadata reuse mechanism. In the 64B spare area of each NAND page, only the first 16B is used to store the "encryption metadata digest" output by the controller (sensitive level 1B, key slot identity 3B, and 12B integrity Media Access Control (MAC) address), and the remaining 48B is still left for ECC check code. Thus, the controller can perform MAC verification and decryption in parallel during the same channel period of Direct Memory Access (DMA) transmission to DRAM without additional NAND access, achieving zero-copy secure reading.

[0137] Meanwhile, considering the parallel characteristics of multiple channels and multiple Chip Enable (CE) in SSD, the system implements a "channel-key" binding strategy, maintaining an independent key tree branch for each channel. The controller intelligently allocates encryption tasks based on channel load, fully utilizes parallel bandwidth, avoids the risk of multiple channels sharing keys, and improves the overall performance and security of the system.

[0138] The intelligent key management module is the core component of the entire encryption system, responsible for key generation, update, recycling, and security management. This module integrates advanced encryption technology and automated management strategies to ensure the security and efficiency of the entire life cycle of the key. First, it uses a deep learning-based random number generation algorithm to generate high-entropy keys, ensuring unpredictability and high randomness, effectively resisting brute force attacks. It can also intelligently determine the timing of key updates and recycling based on data usage frequency, access patterns, and security requirements. At the same time, the module optimizes the key recycling mechanism to ensure safe destruction of obsolete keys, preventing illegal recovery and utilization of keys, etc.

[0139] Further, asFigure 3 As shown, the generation of the key is based on the combination of a deep learning-based random number generation algorithm and a true random number generator (TRNG), ensuring the unpredictability and high randomness of the key, thereby effectively resisting brute force attack. Specifically, the true random number generator receives an entropy source signal, and the deep learning model receives the random data output by the true random number generator for further optimization and enhancement to generate the final key. For example, the deep learning model can be used to post-process the output of the TRNG to remove possible biases or patterns, ensuring that the generated key has a higher entropy value and further improves randomness. This combination not only utilizes the physical randomness of the TRNG, but also improves the quality and security of the random number.

[0140] When the key is updated and recycled, the module can intelligently determine the timing of key update and recycling according to the frequency of data use, access mode and security requirements. By analyzing historical data and real-time data, the strength and security of the key are predicted, and possible risks are warned in advance, so as to realize dynamic key management. For example, when the key use environment changes or there is a security risk, the key update process can be automatically triggered to generate a new key and replace the old key. At the same time, the module also optimizes the key recycling mechanism, and the key is automatically generated and recycled, reducing human error and negligence, ensuring the safe destruction of abandoned keys, and preventing the key from being illegally recovered and used.

[0141] As shown, Figure 4 The dynamic encryption module can flexibly select encryption algorithms according to the classification results of the data, and simultaneously detect resource usage to intelligently schedule encryption tasks to improve efficiency. For "sensitive data", the module uses high-level encryption algorithms (such as AES-256) to ensure high security of the data; while for "ordinary data", it selects medium-strength encryption algorithms (such as AES-128), which balances performance and security. In addition, in the case where the controller includes multiple hardware encryption units / processor cores, the module will detect the resource usage (such as processor load, hardware state, etc.) of each hardware encryption unit / processor core in real time, and dynamically schedule the encryption tasks to the optimal hardware encryption unit / processor core according to the resource usage.

[0142] Further, real-time monitoring of system resources and optimizing encryption task scheduling strategy means that this module will continuously monitor the load of multi-core processors and the usage status of hardware encryption units, and dynamically adjust the allocation of encryption tasks according to the priority of tasks, resource requirements and current system state. For example, for computationally intensive encryption tasks, the module will preferentially allocate them to currently idle processor cores, fully utilizing the parallel processing capabilities of multi-core architecture to speed up task execution; while for tasks with high real-time requirements, the module will preferentially allocate them to hardware encryption units, using their dedicated acceleration functions to quickly complete encryption operations. In addition, the module will also dynamically adjust the priority of tasks according to the urgency of tasks and resource occupation, to ensure that critical tasks can have priority to obtain system resources. Through this fine-grained scheduling strategy, the dynamic encryption module can maximize encryption efficiency while ensuring the overall performance and resource utilization of the system.

[0143] In this system, machine learning algorithms are used to analyze and classify data in SSDs. It can automatically identify the sensitivity of data, for example, by analyzing the content, format, access frequency and source of data, it can classify data into two categories: sensitive data and ordinary data. For data marked as sensitive, the system will automatically select advanced encryption algorithms such as AES-256 to ensure absolute security. For ordinary data, considering its lower sensitivity, the system will select a medium-strength encryption algorithm such as AES-128, which greatly reduces the consumption of computing resources while ensuring a certain level of security, thereby improving the overall performance of the system. This dynamic encryption strategy not only improves the security of data, but also optimizes the use efficiency of resources, making the encryption process more intelligent and flexible, and automatically adjusting the encryption strength according to different data characteristics and usage scenarios, providing users with an efficient and secure data protection solution.

[0144] In the embodiments of the present application, a more intelligent and secure key management mechanism is provided, which comprehensively optimizes each link of key management. First, in the key generation stage, a random number generation algorithm based on deep learning is adopted. Compared with traditional random number generators, this algorithm can generate keys with higher entropy and randomness. Second, in terms of key storage, the system can also monitor the storage environment in real time, detect abnormal access behavior, and timely discover and prevent potential security threats. Finally, in the key update and recycling link, the present application realizes a fully automated process. The system can intelligently judge when to update the key according to the data usage frequency, access mode and security requirements. In addition, the system can also optimize the key recycling mechanism to ensure the safe destruction of abandoned keys and prevent keys from being illegally recovered and utilized. Through these innovative optimization measures, the present application not only improves the security and reliability of key management, but also greatly improves the efficiency of key management, reduces the need for manual intervention, and makes the management of the entire storage system more convenient and efficient.

[0145] In the embodiments of the present application, a series of intelligent technology optimization encryption and decryption process, significantly improve system performance. First, intelligent scheduling hardware acceleration resources, using hardware encryption unit efficient execution of encryption algorithms, significantly reduce the CPU burden and improve processing speed. Second, the use of parallel processing technology, intelligent distribution of tasks to multi-core processors, make full use of system resources, further improve the efficiency and reduce the delay. Finally, intelligent caching strategy accurately identifies frequently accessed data, avoid repeated encryption and decryption, significantly reduce the computational overhead and improve response speed, especially in handling a large number of repeated data when the effect is significant. These comprehensive optimization measures not only reduce the computational overhead in the encryption and decryption process, but also improve the overall performance of the system, so that the encryption system can run efficiently in resource-constrained embedded environments, providing a high-performance, low-overhead data encryption solution for users.

[0146] In addition, the system in the present application is not only suitable for solid state disks, but also can be widely applied to other storage devices and embedded systems that require high security, such as USB flash drives, smart cards, password chips, etc. These devices usually need efficient encryption and decryption implementation under limited hardware resources, and the present application can be quickly integrated into the above devices, significantly enhancing their data encryption, identity authentication and communication security performance, and having good portability and flexibility.

[0147] The encryption system provided by the embodiments of the present application significantly improves the security of data through intelligent data classification and dynamic encryption strategy. By automatically identifying the sensitivity of data and selecting the corresponding encryption algorithm according to the classification result of the data, it ensures that sensitive data is protected by high-level encryption, while ordinary data uses a medium-strength encryption algorithm. On the premise of ensuring a certain security, the consumption of computing resources is reduced. This dynamic encryption strategy not only optimizes the use efficiency of resources, but also makes the encryption process more intelligent and flexible, which can automatically adjust the encryption strength according to different data characteristics and use scenarios, providing an efficient and secure data protection scheme. Secondly, the security and reliability of key management are improved, reducing the need for manual intervention, making the management of the entire storage system more convenient and efficient. Finally, significant achievements have been made in performance optimization, especially in resource-constrained embedded systems. Combined with hardware acceleration technology, the dedicated hardware encryption unit efficiently executes encryption algorithms, significantly reducing CPU burden and improving processing speed. In addition, through parallel processing technology and intelligent caching strategy, the present application further improves the processing efficiency and reduces the delay of encryption and decryption, especially when processing a large amount of repetitive data. These comprehensive optimization measures not only reduce the computational overhead in the encryption and decryption process, but also improve the overall performance of the system, enabling the encryption system to run efficiently in resource-constrained embedded environments, providing a high-performance, low-overhead data encryption solution for users.

[0148] In the embodiments of the present application, a data encryption device is also provided, which is used to implement the above-mentioned embodiments and preferred embodiments, and will not be described again. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware implementation is also possible and contemplated.

[0149] The present embodiment provides a data encryption device, as shown in Figure 5 comprises: The acquisition module 501 is configured to acquire the data to be encrypted, and the format information, the historical access information and the source information corresponding to the data to be encrypted. The extraction module 502 is configured to extract the content information corresponding to the data to be encrypted. The first determination module 503 is configured to input the format information, the historical access information, the source information and the content information into a pre-constructed data type prediction model to determine the data type of the data to be encrypted. The second determination module 504 is configured to determine the encryption algorithm of the data to be encrypted according to the data type and a preset mapping relationship between the data type and the encryption algorithm. The encryption module 505 is configured to encrypt the to-be-encrypted data according to an encryption algorithm and a preconfigured key to obtain encrypted data.

[0150] In a possible implementation, the storage device further includes a plurality of storage areas, and the historical access information includes a historical access frequency; In a possible implementation, the obtaining module 501 is further configured to obtain an order degree corresponding to the to-be-encrypted data, a preset storage duration, and an encryption overhead, where the order degree is used to indicate whether the address of the to-be-encrypted data is continuous when the to-be-encrypted data is accessed, and the preset storage duration is determined based on a historical storage duration of the to-be-encrypted data; The apparatus further includes a storage module configured to determine a target storage area of the to-be-encrypted data in the plurality of storage areas according to the historical access frequency, the order degree, the preset storage duration, the encryption overhead, and a data type; The to-be-encrypted data is stored in the target storage area.

[0151] In a possible implementation, the storage module is specifically configured to determine a priority of the to-be-encrypted data according to the historical access frequency, the order degree, the preset storage duration, and the encryption overhead, where the priority is used to indicate a consumption of the storage device when the to-be-encrypted data is accessed; The target storage area is determined according to the priority and the data type.

[0152] In a possible implementation, in the apparatus, the data type is sensitive data or non-sensitive data, the storage device includes a first storage area and a second storage area, where data in the first storage area is written to the first storage area at a preset page-level granularity, and data in the second storage area is written to the second storage area at a preset block-level granularity; when the data type is sensitive data and the priority is a first priority, the target storage area is the first storage area; or when the data type is non-sensitive data and the priority is a second priority, the target storage area is the second storage area.

[0153] In a possible implementation, the storage module is further configured to, when the target storage area is the first storage area and the storage duration of the to-be-encrypted data reaches the preset storage duration, migrate the to-be-encrypted data from the first storage area to the second storage area.

[0154] In a possible implementation, the obtaining module 501 is further configured to obtain at least one signal value corresponding to at least one entropy source signal of the storage device within a preset historical time period in reverse from a current time point; The apparatus further includes a generation module configured to determine a preset number of target entropy source signals from all the entropy source signals according to the at least one signal value corresponding to each of all the entropy source signals; Input at least one signal value corresponding to each target entropy source signal into the preset true random number generator to generate the key.

[0155] In a possible implementation, the generating module is specifically configured to determine an entropy rate corresponding to the first entropy source signal according to at least one signal value corresponding to the first entropy source signal, where the first entropy source signal is one of the at least one entropy source signal. When the entropy rates corresponding to all the entropy source signals are determined, the candidate entropy source signal is determined from the at least one entropy source signal according to the entropy rates corresponding to all the entropy source signals and a preset entropy rate threshold. The target entropy source signal is determined according to at least one signal value corresponding to all the candidate entropy source signals.

[0156] In a possible implementation, the generating module is specifically configured to, when the candidate entropy source signal is multiple, determine the correlation between each candidate entropy source signal according to at least one signal value corresponding to all the candidate entropy source signals. The target entropy source signal is selected from each candidate entropy source signal according to the correlation between each candidate entropy source signal.

[0157] In a possible implementation, each storage area is connected to the controller through a channel corresponding to the storage area; the storage device further includes a preset storage area, the preset storage area includes at least one key slot, and a target key corresponding to the key is stored in a target key slot in the at least one key slot; and the target storage area includes a plurality of physical blocks. The obtaining module 501 is further configured to obtain a logical block address of the to-be-encrypted data in the target storage area, a channel identifier corresponding to the target storage area, and a historical erase count of a target physical block within a preset historical time period in time back from a current time, where the channel identifier is used to indicate a channel corresponding to the target storage area, and the target physical block is a physical block corresponding to the logical block address in the plurality of physical blocks. The storage module is further configured to determine a target key slot corresponding to the key according to the logical block address, the channel identifier, the historical erase count, and a preset storage duration of the target storage area. The key is stored in the target key slot.

[0158] In a possible implementation, the obtaining module 501 is further configured to obtain a historical encryption frequency corresponding to the target physical block within the preset historical time period in time back from the current time. The storage module is further configured to, when it is determined that the target physical block does not satisfy the preset condition according to the historical erase count and the historical encryption frequency, migrate the encrypted data to a physical block other than the target physical block in the plurality of physical blocks.

[0159] In a possible implementation, the storage module is further configured to determine that the target physical block does not satisfy the preset condition when the historical erase count is greater than the preset number of erases and a ratio between the historical encryption count and the historical erase count is greater than a preset ratio.

[0160] In a possible implementation, the obtaining module 501 is further configured to obtain environment data of the storage device and access data of the encrypted data. The encryption module 505 is further configured to re-encrypt the encrypted data using a new key when the environment data does not satisfy a preset environment condition and / or the access data of the encrypted data does not satisfy a preset access condition.

[0161] The features of the embodiments of the data encryption apparatus can be understood by referring to the related descriptions of the embodiments of the data encryption method, which will not be repeated here.

[0162] Embodiments of the present application further provide an electronic device, such as Figure 6 As shown in FIG. 10, the electronic device includes a memory 10 and a processor 20, the memory 10 stores a computer program, and the processor 20 is configured to run the computer program to perform the steps in any of the above-mentioned embodiments of the data encryption method.

[0163] Embodiments of the present application further provide a computer readable storage medium, which stores a computer program, wherein the computer program is configured to perform the steps in any of the above-mentioned embodiments of the data encryption method when executed.

[0164] In an example embodiment, the above-mentioned computer readable storage medium can include, but is not limited to, a U disk, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and various media that can store computer programs.

[0165] Embodiments of the present application further provide a computer program product, which includes a computer program, and the computer program is executed by a processor to implement the steps in any of the above-mentioned embodiments of the data encryption method.

[0166] Embodiments of the present application further provide another computer program product, which includes a non-volatile computer readable storage medium, and the non-volatile computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement the steps in any of the above-mentioned embodiments of the data encryption method.

[0167] Those skilled in the art will further realize that the mere concepts, teachings, and embodiments described herein are merely meant to provide an enabling description of the claimed application. Accordingly, modifications and / or additions, other than those explicitly described herein, can be obvious to those skilled in the art in the light of this disclosure. The claimed application is intended to embrace all such modifications and / or additions.

[0168] The above provides a data encryption method, an electronic device and a medium. The principles and implementation manners of the application are described by using specific examples. The above description of the embodiments is only applicable to helping understand the method and the core idea of the application. It should be pointed out that, for those skilled in the art, without departing from the principles of the application, some improvements and modifications can be made to the application, and these improvements and modifications also fall within the protection scope of the claims of the application.

Claims

1. A data encryption method characterized by, A method applied to a controller in a storage device, the method comprising: obtaining to-be-encrypted data, and format information, historical access information and source information corresponding to the to-be-encrypted data; extracting content information corresponding to the to-be-encrypted data; inputting the format information, the historical access information, the source information and the content information into a pre-constructed data type prediction model to determine a data type of the to-be-encrypted data; determining an encryption algorithm of the to-be-encrypted data according to the data type and a preset mapping relationship between data types and encryption algorithms; encrypting the to-be-encrypted data according to the encryption algorithm and a pre-configured key to obtain encrypted data.

2. The method of claim 1, wherein, The storage device further comprises a plurality of storage areas, and the historical access information comprises a historical access frequency; the method further comprises: obtaining a sequential degree, a preset storage time length and an encryption overhead corresponding to the to-be-encrypted data, wherein the sequential degree is used to indicate whether the address of the to-be-encrypted data is continuous when the to-be-encrypted data is accessed, and the preset storage time length is determined based on a historical storage time length of the to-be-encrypted data; determining a target storage area of the to-be-encrypted data in the plurality of storage areas according to the historical access frequency, the sequential degree, the preset storage time length, the encryption overhead and the data type; and storing the to-be-encrypted data to the target storage area.

3. The method of claim 2, wherein, The determining of the target storage area of the to-be-encrypted data in the plurality of storage areas according to the historical access frequency, the sequential degree, the preset storage time length, the encryption overhead and the data type comprises: determining a priority of the to-be-encrypted data according to the historical access frequency, the sequential degree, the preset storage time length and the encryption overhead, wherein the priority is used to indicate a consumption of the storage device when the to-be-encrypted data is accessed; and determining the target storage area according to the priority and the data type.

4. The method of claim 3, wherein, The data type is sensitive data or non-sensitive data, the storage device comprises a first storage area and a second storage area, wherein data in the first storage area is written to the first storage area at a preset page level granularity, and data in the second storage area is written to the second storage area at a preset block level granularity; when the data type is sensitive data and the priority is a first priority, the target storage area is the first storage area; or when the data type is non-sensitive data and the priority is a second priority, the target storage area is the second storage area.

5. The method of claim 4, wherein, The method further comprises: when the target storage area is the first storage area and the storage time length of the to-be-encrypted data reaches the preset storage time length, migrating the to-be-encrypted data from the first storage area to the second storage area.

6. The method according to any one of claims 2-5, characterized in that, The method further comprises: obtaining at least one signal value corresponding to at least one entropy source signal of the storage device within a preset historical time period back to a current time as a reference; determine a preset number of target entropy source signals from all the entropy source signals according to at least one signal value corresponding to each of the entropy source signals; input the at least one signal value corresponding to each of the target entropy source signals into a preset true random number generator to generate the key.

7. The method of claim 6, wherein, The determining of the target entropy source signals from all the entropy source signals according to the at least one signal value corresponding to each of the entropy source signals comprises: determine an entropy rate corresponding to a first entropy source signal according to at least one signal value corresponding to the first entropy source signal, wherein the first entropy source signal is one of the at least one entropy source signal; when the entropy rates corresponding to all the entropy source signals are determined, determine candidate entropy source signals from the at least one entropy source signal according to the entropy rates corresponding to all the entropy source signals and a preset entropy rate threshold; determine the target entropy source signals according to at least one signal value corresponding to each of the candidate entropy source signals.

8. The method of claim 7, wherein, The determining of the target entropy source signals according to the at least one signal value corresponding to each of the candidate entropy source signals comprises: when the candidate entropy source signals are multiple, determine the correlation between each of the candidate entropy source signals according to the at least one signal value corresponding to each of the candidate entropy source signals; select the target entropy source signals from the candidate entropy source signals according to the correlation between each of the candidate entropy source signals.

9. The method of claim 2, wherein, Each of the storage areas is connected to the controller through a channel corresponding to the storage area; the storage device further comprises a preset storage area, and the preset storage area comprises at least one key slot, and the key is stored in a target key slot of the at least one key slot; The target storage area comprises a plurality of physical blocks; the method further comprises: obtain a logical block address of the to-be-encrypted data in the target storage area, a channel identifier corresponding to the target storage area, and a historical erase count of a target physical block in a preset historical time period in time back from a current time, wherein the channel identifier is used to indicate a channel corresponding to the target storage area, and the target physical block is a physical block corresponding to the logical block address in the plurality of physical blocks; determine a target key slot corresponding to the key according to the logical block address of the target storage area, the channel identifier, the historical erase count and a preset storage duration; store the key into the target key slot.

10. The method of claim 9, wherein, The method further comprises: obtain a historical encryption frequency corresponding to the target physical block in the preset historical time period in time back from the current time; when it is determined that the target physical block does not satisfy a preset condition according to the historical erase count and the historical encryption frequency, migrate the encrypted data to a physical block other than the target physical block in the plurality of physical blocks.

11. The method of claim 10, wherein, The method further comprises: when the historical erase count is greater than a preset erase frequency and a ratio between the historical encryption frequency and the historical erase count is greater than a preset ratio, it is determined that the target physical block does not satisfy the preset condition.

12. The method of any one of claims 1-4, wherein, The method further comprises: obtaining environment data of the storage device and access data of the encrypted data; re-encrypting the encrypted data with a new key when the environment data does not satisfy a preset environment condition and / or the access data of the encrypted data does not satisfy a preset access condition.

13. An electronic device, comprising: The method comprises the steps of: a memory for storing a computer program; a processor for executing the computer program to implement the steps of the data encryption method according to any one of claims 1-12.

14. A computer-readable storage medium, characterized in that, The computer program is stored in the computer readable storage medium, and the computer program is executed by the processor to implement the steps of the data encryption method according to any one of claims 1-12.

15. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the data encryption method according to any one of claims 1-12.

Images