A data encryption method, electronic equipment and medium

Abstract

The application discloses a data encryption method, an electronic device and a medium, and relates to the technical field of computers.The method comprises the following steps: obtaining to-be-encrypted data, and format information, historical access information and source information corresponding to the to-be-encrypted data; extracting content information corresponding to the to-be-encrypted data; inputting the format information, the historical access information, the source information and the content information into a pre-constructed data type prediction model to determine the data type of the to-be-encrypted data; determining an encryption algorithm of the to-be-encrypted data according to the data type and a preset mapping relationship between data types and encryption algorithms; and encrypting the to-be-encrypted data according to the encryption algorithm and a pre-configured key to obtain encrypted data. According to the application, a precise encryption algorithm is matched for data based on the data type of to-be-encrypted data, over-encryption or insufficient encryption is avoided, and the data encryption efficiency is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computers, and in particular to a data encryption method, an electronic device, and a medium. BACKGROUND

[0002] In the field of data storage and information security, with the wide application of storage devices, a large amount of sensitive data is stored centrally. Once these data are leaked, serious economic losses and security risks may be caused. Therefore, effective encryption protection of the data in the storage device becomes an important means to protect data security. How to dynamically select a suitable encryption strategy according to the characteristics of the data, while ensuring security and improving encryption efficiency, has become a technical problem to be solved in the current storage device encryption field. SUMMARY

[0003] The present application provides a data encryption method, an electronic device, and a medium, to at least solve the problem of how to dynamically select an encryption strategy and improve encryption efficiency.

[0004] The present application provides a data encryption method applied to a controller in a storage device. The method comprises:

[0005] obtaining to-be-encrypted data, and format information, historical access information, and source information corresponding to the to-be-encrypted data;

[0006] extracting content information corresponding to the to-be-encrypted data;

[0007] inputting the format information, the historical access information, the source information, and the content information into a pre-constructed data type prediction model to determine a data type of the to-be-encrypted data;

[0008] determining an encryption algorithm of the to-be-encrypted data according to the data type and a preset mapping relationship between data types and encryption algorithms;

[0009] encrypting the to-be-encrypted data according to the encryption algorithm and a pre-configured key to obtain encrypted data.

[0010] The present application also provides a data encryption device, comprising:

[0011] an obtaining module configured to obtain to-be-encrypted data, and format information, historical access information, and source information corresponding to the to-be-encrypted data;

[0012] an extracting module configured to extract content information corresponding to the to-be-encrypted data;

[0013] a first determining module configured to input the format information, the historical access information, the source information, and the content information into a pre-constructed data type prediction model to determine a data type of the to-be-encrypted data;

[0014] The second determining module is configured to determine the encryption algorithm of the data to be encrypted according to the data type and a preset mapping relationship between the data type and the encryption algorithm.

[0015] The encryption module is configured to encrypt the data to be encrypted according to the encryption algorithm and a preconfigured key to obtain encrypted data.

[0016] The present application also provides an electronic device, comprising a memory configured to store a computer program and a processor configured to execute the computer program to implement the steps of any of the data encryption methods.

[0017] The present application also provides a computer readable storage medium, wherein the computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement the steps of any of the data encryption methods.

[0018] The present application also provides a computer program product comprising a computer program, and the computer program is executed by a processor to implement the steps of any of the data encryption methods.

[0019] According to the present application, the data type of the data to be encrypted is accurately determined based on the format information, historical access information, source information and content information of the data to be encrypted, in combination with a pre-constructed data type prediction model. Furthermore, different encryption algorithms are selected for data of different data types according to a preset mapping relationship, for example, a complex encryption algorithm is used for data with high sensitivity, and a simple encryption algorithm is used for ordinary data. In this way, different encryption strategies are matched for data of different sensitivity levels, which not only ensures strong security protection for high-sensitive data, but also avoids resource waste caused by excessive encryption of ordinary data, and prevents data leakage from the root. Under the premise of ensuring security, the consumption of computing resources is reduced, the data encryption efficiency is improved, and the encryption process is more intelligent and flexible. BRIEF DESCRIPTION OF DRAWINGS

[0020] In order to more clearly illustrate the embodiments of the present application, the drawings needed in the embodiments will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0021] Figure 1 A flowchart of a data encryption method provided by an embodiment of the present application;

[0022] Figure 2 A schematic diagram of a data encryption system provided by an embodiment of the present application;

[0023] Figure 3 A scene diagram of key generation provided by an embodiment of the present application;

[0024] Figure 4 A structural schematic diagram of a dynamic encryption module provided for an embodiment of the present application is shown in FIG. 1.

[0025] Figure 5 A structural schematic diagram of a data encryption device provided for an embodiment of the present application is shown in FIG. 2.

[0026] Figure 6 A structural schematic diagram of an electronic device provided for an embodiment of the present application is shown in FIG. 3. DETAILED DESCRIPTION

[0027] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments of the present application. Based on the embodiments in the present application, any other embodiments obtained by those skilled in the art without creative work fall within the protection scope of the present application.

[0028] It should be noted that, in the description of the present application, the terms “comprise”, “contain” or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device comprising a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device. The terms “first”, “second” and the like in the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence.

[0029] In order for those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the drawings and specific embodiments.

[0030] First, the application scenarios of the embodiments of the present application are exemplarily introduced.

[0031] In the field of data storage and information security, with the wide application of storage devices such as solid state drives (SSD) in the field of cloud computing, the security of data storage has increasingly become the focus of attention. In related technologies, the SSD encryption technology mainly relies on hardware encryption engines (such as self-encrypting drives (SED)) or general software encryption tools, and uses a fixed encryption algorithm to uniformly process data. However, with the continuous growth of data volume and the diversification of application scenarios, this approach gradually exposes deficiencies in performance, key management and dynamic data protection. Therefore, how to improve encryption efficiency, simplify key management and achieve fine-grained protection of diversified data while ensuring data security has become an important issue that needs to be solved in the encryption field.

[0032] Therefore, the data encryption method provided in the embodiments of the present application can dynamically select an encryption strategy, thereby improving encryption efficiency.

[0033] It should be noted that the data encryption method provided in the embodiments of the present application can be executed by a data encryption device, which can be implemented by software, hardware or a combination of software and hardware to become part or all of an electronic device, where the electronic device can be a server or a terminal, where the server in the embodiments of the present application can be a single server or a server cluster composed of multiple servers, and the terminal in the embodiments of the present application can be a smart phone, a personal computer, a tablet computer, a wearable device, a smart robot or other smart hardware devices. In the following method embodiments, the execution subject is taken as an example of an electronic device.

[0034] According to the embodiments of the present application, a data encryption method is provided. It should be noted that the steps shown in the flowchart can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described herein can be executed in a different order.

[0035] Figure 1 is a flowchart of a data encryption method according to the embodiments of the present application, which is executed by a controller in a storage device. As shown in Figure 1 , the flowchart includes the following steps:

[0036] S101, obtaining to-be-encrypted data, and format information, historical access information and source information corresponding to the to-be-encrypted data.

[0037] Specifically, the format information corresponding to the to-be-encrypted data is used to describe the organization structure and encoding mode of the data. For example, the format information can be a file extension (such as a text file extension, a table file extension, an audio file extension, etc.), and can also be a data structure (such as JSON, XML format, etc.).

[0038] The historical access information refers to the relevant information of the to-be-encrypted data accessed in the past period of time, such as access time, access frequency, access source (such as which user, which IP address accessed the data).

[0039] The source information refers to the source or acquisition approach of the to-be-encrypted data. For example, the creator of the to-be-encrypted data (which can be determined by the user identity of the creator, the process identifier, etc.), the collection device of the to-be-encrypted data, such as the sensor number, etc.

[0040] S102, extract content information corresponding to the data to be encrypted.

[0041] Specifically, the content information refers to semantic features or key content in the data to be encrypted. For example, keywords in a document, semantic information in a picture, semantic information in an audio file, key field values in structured data, etc.

[0042] For example, keywords in a document are extracted by natural language processing (NLP) technology, semantic information in a picture is extracted by an image recognition model, semantic information in an audio file is extracted by voice recognition technology, etc.

[0043] S103, input the format information, historical access information, source information, and content information into a pre-built data type prediction model to determine the data type of the data to be encrypted.

[0044] Specifically, the data type prediction model can be a machine learning model or a deep learning model, which is used to automatically identify the data type. For example, the data type prediction can be a support vector machine, a convolutional neural network, a recurrent neural network, etc. During training, the data type prediction model includes format information, historical access information, source information, content information, and the corresponding data type in the training data set.

[0045] The data type can be sensitive data, non-sensitive data, more specifically, the data type can be high-sensitive data, medium-sensitive data, low-sensitive data, etc.

[0046] S104, determine the encryption algorithm of the data to be encrypted according to the data type and the preset mapping relationship between the data type and the encryption algorithm.

[0047] For example, the encryption algorithm can be symmetric encryption (such as Advanced Encryption Standard 256-bit (AES-256)), asymmetric encryption (such as RSA, hash algorithm (such as Secure Hash Algorithm (SHA))), etc. For example, for sensitive data, the encryption algorithm can be AES-256, and for non-sensitive data, the encryption algorithm can be AES-128, etc.

[0048] S105, encrypt the data to be encrypted according to the encryption algorithm and the preconfigured key to obtain encrypted data.

[0049] In the embodiments of the present application, the data type of the data to be encrypted is accurately determined based on the format information, the historical access information, the source information and the content information of the data to be encrypted, in combination with a pre-constructed data type prediction model. Further, different encryption algorithms are selected for data of different data types according to a preset mapping relationship, for example, a complex encryption algorithm is used for data of high sensitivity, and a simple encryption algorithm is used for non-sensitive data (also referred to as ordinary data). In this way, different encryption strategies are matched for data of different sensitivity levels, which not only ensures strong security protection for high-sensitive data, but also avoids resource waste caused by over-encryption of ordinary data, and prevents data leakage from the root.

[0050] In some embodiments, on the basis of the foregoing embodiments, the storage device further includes a plurality of storage areas.

[0051] Here, the plurality of storage areas are storage media of a plurality of areas divided physically or logically in the storage device. The physically divided storage areas can be a plurality of flash memories (NAND) in the SSD, and the logically divided storage areas can be a plurality of areas divided according to a plurality of logical addresses.

[0052] The historical access information includes a historical access frequency.

[0053] Specifically, the historical access frequency is a cumulative number of times that the data to be encrypted is accessed, and can be used to judge the access frequency. For example, file A is accessed 100 times in the past week, and file B is accessed 2 times in the past week. Therefore, file A can be hot data, and file B can be cold data.

[0054] The method provided in the embodiments of the present application further includes the following steps:

[0055] a1, obtaining a sequential degree, a preset storage duration and an encryption overhead corresponding to the data to be encrypted.

[0056] The sequential degree is used to indicate whether the address of the data to be encrypted is continuous when accessed, and the preset storage duration is determined based on the historical storage duration of the data to be encrypted.

[0057] Specifically, the sequential degree is an index for measuring whether the address is continuous when the data is accessed. For example, the sequential degree is 0, indicating that the address is completely random, and the sequential degree is 1, indicating that the address is completely sequential. For example, the sequential degree of a video file is relatively high, such as greater than 0.9, and the sequential degree of data in a database is relatively low, such as less than 0.3.

[0058] For example, the order degree can be determined according to format information of the data. The order degree of the data to be encrypted can be determined based on a preset mapping relationship between the format information and the order degree. For example, if the data is a video file or a picture file, the order degree of the data is 1, and if the data is a data structure file in a set form, the order degree is 0.

[0059] For example, the order degree can be determined by a ratio between a continuous address access frequency of the data and a total access frequency of the data in a preset historical time period. The continuous address access frequency of the data in the preset historical time period is a frequency at which sub-data corresponding to the storage addresses of the data are continuously accessed.

[0060] The preset storage duration refers to a future time period that needs to be saved, which is predicted according to a historical storage duration of the data, and is used for lifecycle management. For example, if the data to be encrypted is saved for an average of 7 days in a preset historical time period, the preset storage duration can be 7 days.

[0061] The encryption overhead is a calculation resource required for encrypting the data to be encrypted, such as CPU time, power consumption, delay, and the like. For example, AES-256 encrypts 1 MB of data in 0.5 ms.

[0062] a2, determining a target storage area of the data to be encrypted in the plurality of storage areas according to the historical access frequency, the order degree, the preset storage duration, the encryption overhead, and the data type.

[0063] Specifically, the target storage area is a storage location selected in the storage device by comprehensively considering the data characteristics (i.e., the historical access frequency, the order degree, the preset storage duration, the encryption overhead, and the data type) of the data to be encrypted.

[0064] a3, storing the data to be encrypted to the target storage area.

[0065] In the embodiments of the present application, the target storage area is determined in the storage device according to the historical access frequency, the order degree, the preset storage duration, the encryption overhead, and the data type, and the data to be encrypted is placed in the storage device, so that the storage location is flexibly selected according to the above data characteristics of the data to be encrypted while ensuring security.

[0066] In a possible implementation, in the a2, the target storage area of the data to be encrypted in the plurality of storage areas is determined according to the historical access frequency, the order degree, the preset storage duration, the encryption overhead, and the data type, and specifically includes the following steps:

[0067] b1, determining a priority of the data to be encrypted according to the historical access frequency, the order degree, the preset storage duration, and the encryption overhead.

[0068] The priority is used to indicate the consumption of the storage device when the data to be encrypted is accessed. In this application, the more the data to be encrypted consumes the storage device when accessed, the higher the priority.

[0069] Specifically, the priority is a value or a level obtained according to the access characteristics, storage requirements and encryption costs of the data to be encrypted, and reflects the consumption of the data to be encrypted to the storage device performance, power consumption, delay and other resources when accessed. For example, the more the historical access times, the more frequent the access data, the higher the priority of the data to be encrypted. The higher the order degree, the more the storage device can reduce the additional delay and power consumption caused by random jump through continuous reading and writing, the higher the resource utilization efficiency, and the higher the priority of the data to be encrypted. The greater the encryption overhead, the more resources used by the storage device, the higher the priority, and the shorter the preset storage duration, the higher the priority of the data to be encrypted. For example, the historical access times are obtained through the input / output (Input / Output, I / O) log of the storage device; the order degree of the data to be encrypted is calculated from the access address sequence; the preset storage duration is predicted from the historical storage record; and the encryption overhead is determined by using the encryption algorithm and the mapping relationship between the encryption algorithm and the overhead.

[0070] Optionally, the priority of the data to be encrypted is determined according to the historical access times, the order degree, the preset storage duration and the encryption overhead, and specifically includes the following steps:

[0071] First, a first quantization value corresponding to the historical access times is determined according to the historical access times and a first quantization rule; a second quantization value corresponding to the order degree is determined according to the order degree and a second quantization rule; a third quantization value corresponding to the preset storage duration is determined according to the preset storage duration and a third quantization rule; and a fourth quantization value corresponding to the encryption overhead is determined according to the encryption overhead and a fourth quantization rule.

[0072] For example, if the historical access times (within the preset historical duration) are greater than 100 times, the first quantization value is 10 points, if the historical access times (within the preset historical duration) are greater than 50 times and less than 100 times, the first quantization value is 5 points, and if the historical access times (within the preset historical duration) are less than 50 times, the first quantization value is 0 point.

[0073] For example, if the order degree is 1, the second quantization value is 10, and if the order degree is 0, the second quantization value is 0.

[0074] For example, if the preset storage duration is greater than 7 days, the third quantization value is 0, and if the preset storage duration is less than 7 days, the third quantization value is 10.

[0075] Taking the fourth quantization rule as an example, if the encryption overhead is greater than 60 seconds / GB, the fourth quantization value is 10, and if the encryption overhead is less than 10 seconds / GB, the fourth quantization value is 0.

[0076] Then, the priority is determined according to the first quantization value, the second quantization value, the third quantization value and the fourth quantization value.

[0077] For example, the first quantization value, the second quantization value, the third quantization value and the fourth quantization value are weighted and summed to obtain a comprehensive quantization value, and the priority is obtained according to the comprehensive quantization value and a preset mapping relationship between the comprehensive quantization value and the priority. The weights of the quantization values can be set according to actual conditions, which are not limited here.

[0078] b2, determines the target storage area according to the priority and the data type.

[0079] Optionally, the data type is sensitive data or non-sensitive data, and the storage device includes a first storage area and a second storage area. The data in the first storage area is written to the first storage area at a preset page level granularity, and the data in the second storage area is written to the second storage area at a preset block level granularity; when the data type is sensitive data and the priority is a first priority, the target storage area is the first storage area; or when the data type is non-sensitive data and the priority is a second priority, the target storage area is the second storage area.

[0080] Specifically, sensitive data refers to data that will cause serious security risks if leaked, such as user accounts, etc. Non-sensitive data refers to data that is public or has a small impact, such as promotional videos, public product manuals, etc.

[0081] The page level granularity is the smallest unit of data writing by the storage device. The first storage area is a high-performance storage area written at a page level granularity, suitable for data with frequent access and low latency requirements, and can be used to cope with scenarios that require frequent data updates. For example, the first storage area can be a single-level cell (SLC) area or a multi-level cell (MLC) cache area in an SSD. The first storage area writes data at a preset page level granularity, reducing the number of read and write operations due to encryption, and has high read and write efficiency, so it can be used to store high-priority data.

[0082] The block-level granularity is a larger data unit composed of multiple pages. The second storage area is a mass storage area written at the block-level granularity, suitable for data with low access frequency and sequential writing, and suitable for scenarios of batch continuous writing data. For example, the second storage area can be a mass storage area of Quad-Level Cell (QLC) flash memory in the SSD. The overhead of writing a unit capacity in the second storage area is low, and the random write performance is lower than that of the first storage area.

[0083] The data of the first priority is high-priority data, which is usually data with high access frequency and high read-write performance requirement of the storage device, such as real-time analysis data. The data of the second priority is low-priority data, which is usually data with low access frequency and low read performance requirement of the storage device, such as historical backup data. Storing sensitive and high-priority data in the first storage area with page-level granularity for reading and writing helps to improve the random write performance. Storing non-sensitive and low-priority data in the second storage area with block-level granularity for reading and writing helps to reduce the performance waste of the storage device. In this way, by reasonably matching the data characteristics with the characteristics of the storage area, the resource utilization of the storage device is improved, unnecessary high-performance resource occupation is reduced, and the response speed of the storage device is improved.

[0084] For example, high-priority and high-sensitivity data to be encrypted can be placed in an SLC flash memory area with high performance and high encryption strength, medium-priority and medium-sensitivity data can be stored in an MLC area and use standard encryption, and low-priority and low-sensitivity data can be stored in a mass TLC area, and the encryption process can be simplified or omitted.

[0085] Here, for the data stored in the first storage area, the corresponding storage condition is that the data type is sensitive data, and the priority of the data is the first priority. For the data stored in the second storage area, the corresponding storage condition is that the data type is non-sensitive data, and the priority of the data is the second priority.

[0086] In addition, the storage device further includes a third storage area. The third storage area is used to store data that does not meet the storage condition of the first storage area and does not meet the storage condition of the second storage area. For example, the data in the third storage area can start variable rate encryption.

[0087] Specifically, the variable rate encryption is an encryption strategy that dynamically adjusts the encryption algorithm strength, key length or encryption mode according to the data characteristics (sensitivity, access frequency, performance requirements, etc.). High-strength encryption is used for high-sensitivity and high-priority data, and lightweight encryption or even no encryption is used for low-sensitivity and low-priority data, thereby reducing the impact of encryption on system performance while ensuring security. In this way, the hot data that is repeatedly moved is stored in the first storage area. The cold data is sequentially written to the second storage area and skips redundant encryption, significantly reducing the frequency of garbage collection and the amount of migration.

[0088] Optionally, the method provided by the embodiment of the application further includes the following content:

[0089] When the target storage area is the first storage area and the storage duration of the to-be-encrypted data reaches the preset storage duration, the to-be-encrypted data is migrated from the first storage area to the second storage area.

[0090] For example, in a certain transaction platform, the real-time order data of a user belongs to sensitive data and has a high priority, and therefore the data is stored in the first storage area to ensure fast order processing and query. At the same time, the preset storage duration is set to one week, because the user usually queries the order status within one week, and after one week, the data is migrated from the first storage area to the second storage area.

[0091] In this way, the high-priority data can use the high-performance first storage area in the storage device during the active period, and after the preset storage duration is exceeded, the automatic migration of the data is realized, the high-performance resources of the storage device are avoided, and the space of the first storage area is released for new high-priority data.

[0092] In the embodiment of the application, the response speed of the storage device is improved by storing the high-priority data in the high-performance area, and the competition of the storage resources in the storage device by each to-be-encrypted data is reduced. At the same time, differential encryption is realized according to the data type, such as high-sensitivity data is not stored in a low-security area, a high-performance area only stores high-priority data, and low-priority data can be stored in a large-capacity area with lower cost. In this way, the storage resources in the storage device are reasonably allocated, the waste of resources in the storage device is avoided, and the resource utilization rate of the storage device is improved.

[0093] In some embodiments, on the basis of any of the preceding embodiments, the method provided by the embodiment of the application further includes the following steps:

[0094] c1, acquiring at least one signal value corresponding to at least one entropy source signal of the storage device within a preset historical time period based on the current time.

[0095] Specifically, entropy source signals refer to physical or logical signals, either inside or outside the storage device, that can be used to extract randomness. These signals are unpredictable and can serve as a source for generating truly random numbers.

[0096] For example, entropy source signals can be thermal noise inside the memory chip, power supply voltage fluctuations, clock jitter, threshold voltage drift of flash memory cells, etc. These entropy source signals can be acquired by hardware sensors or by reading the internal state of the device through a driver interface.

[0097] For example, when the entropy source signal is a power supply voltage signal, at least one corresponding signal value can be 1.198V, 1.201V, or 1.197V. When the entropy source signal is disk seek time, at least one corresponding signal value can be 1.2ms, 1.1ms, or 1.3ms.

[0098] In this embodiment, the five signals—RC oscillator jitter, write delay jitter, charge pump ripple, temperature, and random signal generated by a hardware true random number generator—are used as entropy source signals.

[0099] c2, based on at least one signal value corresponding to each of the entropy source signals, determine a preset number of target entropy source signals among all entropy source signals.

[0100] In one possible implementation, a predetermined number of target entropy source signals are determined from all entropy source signals based on at least one signal value corresponding to each of the entropy source signals. This specifically includes the following steps:

[0101] First, the entropy rate corresponding to the first entropy source signal is determined based on at least one signal value corresponding to the first entropy source signal.

[0102] Among them, the first entropy source signal is one of at least one entropy source signal.

[0103] Specifically, entropy rate measures the average randomness (information entropy) that a signal from an entropy source can provide per unit time. The unit is usually "bits per second". The higher the entropy rate, the stronger the randomness of the signal. For example, if 100 signal values ​​are collected for "power supply voltage fluctuation" in 1 second, and it is calculated that each signal value can provide an average of 0.8 bits of randomness, then its entropy rate is 80 bits per second.

[0104] For example, the entropy rate corresponding to the first entropy source signal is determined as follows: extract all signal values ​​of the first entropy source signal within a preset historical time period to form a data sequence; use information theory algorithms (such as Shannon entropy calculation or approximate entropy algorithm) to calculate the total entropy value of the data sequence; divide the total entropy value by the duration of the preset historical time period (such as 1 second) to obtain the entropy rate of the first entropy source signal.

[0105] Then, when determining that all entropy source signals respectively correspond to the entropy rates, according to all entropy source signals respectively corresponding to the entropy rates, and the preset entropy rate threshold, a candidate entropy source signal is determined from the at least one entropy source signal.

[0106] Specifically, the candidate entropy source signal is a set of entropy source signals whose entropy rates reach or exceed the preset entropy rate threshold after the entropy rate screening, and is a candidate pool for determining the target entropy source signal subsequently. For example, if the storage device has three entropy source signals, the entropy rates are "power supply voltage fluctuation 80 bits / s, flash threshold voltage drift 60 bits / s, and I / O request interval 6 bits / s", and the preset threshold is 50 bits / s, then "power supply voltage fluctuation" and "flash threshold voltage drift" become the candidate entropy source signals.

[0107] The preset entropy rate threshold can be set according to actual conditions. For example, according to the security requirements of the storage device, the preset entropy rate threshold is set to 50 bits / s, and only the entropy source signals with an entropy rate greater than or equal to 50 bits / s can enter the candidate stage.

[0108] Finally, according to at least one signal value corresponding to all candidate entropy source signals respectively, a target entropy source signal is determined.

[0109] Specifically, the target entropy source signal is a preset number of entropy source signals that are further screened from the candidate entropy source signals and are finally used to generate a key as an input of random number generation. Considering that there may be mutual correlation between the entropy source signals, the application embodiments further screen the entropy source signals to further improve the quality of the key.

[0110] Optionally, when the candidate entropy source signals are multiple, according to at least one signal value corresponding to all candidate entropy source signals respectively, the correlation between the candidate entropy source signals is determined; and according to the correlation between the candidate entropy source signals, a target entropy source signal is screened from the candidate entropy source signals.

[0111] Specifically, the correlation between two entropy source signals refers to whether the change trend of the signal values of the two candidate entropy source signals is associated. High correlation indicates that the change of one entropy source signal can partially predict the change of the other signal, thereby reducing the overall randomness of the key. The lower the correlation, the more complementary the randomness of the two entropy source signals, which helps to improve the overall quality of the key. In the embodiments of the application, the correlation further excludes candidate entropy source signals with high signal value correlation to avoid reducing the randomness of the signal due to the correlation between the entropy source signals.

[0112] For example, the Pearson correlation coefficient, mutual information, and the like can be used to determine the correlation between two entropy source signals. One of the two entropy source signals with a correlation greater than a preset threshold is taken as the target entropy source signal.

[0113] For example, if the number of candidate entropy source signals is small, the candidate entropy source signal with the highest entropy rate can be selected as the basis, and then candidate entropy source signals with a correlation less than or equal to a preset threshold with the signal are sequentially selected as target entropy source signals until a preset number is reached.

[0114] For example, if the number of candidate entropy source signals is large, such as more than 10, a genetic algorithm or a talk heart optimization algorithm can be used to select a combination with the largest sum of entropy rates as the set of target entropy source signal processes under the premise that the correlation between all signals is less than or equal to a preset threshold.

[0115] In another possible implementation, entropy values corresponding to each entropy source signal are determined according to at least one signal value corresponding to each entropy source signal, and the entropy values are sorted, and the first k signals with larger entropy values are selected as target entropy source signals.

[0116] c3, inputting at least one signal value corresponding to each target entropy source signal into a preset true random number generator to generate a key.

[0117] Specifically, the true random number generator (TRNG) is a device capable of generating unpredictable and non-repetitive random numbers.

[0118] In a possible implementation, the true random number generator includes a key derivation function (KDF), and the key derivation function includes a derivation round number.

[0119] Specifically, the derivation round number is the number of times that the core logic is executed in the key derivation function, and the more the round number, the greater the calculation overhead of key generation and the stronger the anti-cracking ability.

[0120] The method provided by the embodiment of the present application further includes the following content:

[0121] First, the derivation round number in the key derivation function is determined according to the data type of the data to be encrypted.

[0122] Then, input at least one signal value corresponding to each target entropy source signal and the derivation round number into the true random number generator to generate a key.

[0123] Taking the key derivation function based on the hash-based key derivation function HKDF+SHA-3 as an example, the number of types of sensitive data corresponds to a derivation round of 8192 rounds, and the number of types of non-sensitive data corresponds to a derivation round of 512 rounds. In this way, the sensitive data adopts a high round number derivation key, and even if part of the random signal is obtained, a large amount of loop logic is needed to obtain the key, and the anti-brute force cracking ability is strong, and the low sensitive data adopts a low round number, which meets the basic security while avoiding the waste of computing resources caused by a high round number. In addition, different data types correspond to different derivation rounds, so even if the key of a certain type of data is leaked (such as the 512 round key of low sensitive data), the attacker cannot crack other types of data (such as the 8192 round key of sensitive data), and "risk isolation" is achieved.

[0124] In addition, in the embodiments of the present application, for the to-be-encrypted data with a preset storage duration less than 24 hours, the key adopts a one-time strategy, and the corresponding derivation parameter is discarded after the key is used once, preventing backward cracking.

[0125] In the embodiments of the present application, the key is generated by multiple physical random sources to improve the anti-predictability of the key, so that even if part of the entropy source is attacked, other entropy sources can still ensure the quality of the key. In addition, the entropy rate is used to screen the entropy source signals to exclude low randomness entropy source signals and avoid key predictability due to insufficient signal randomness. Further, the candidate signals with high correlation are excluded during screening to avoid attackers deriving the overall randomness through a single signal vulnerability, thereby enhancing the security of the key.

[0126] In some embodiments, on the basis of any of the preceding embodiments, each storage area is connected to the controller through a channel corresponding thereto.

[0127] The storage device further includes a preset storage area, and the preset storage area includes at least one key slot, and the target key stored in the at least one key slot. The target storage area includes a plurality of physical blocks.

[0128] Specifically, in the storage device, each storage area communicates with the controller through an independent channel (such as a Peripheral Component Interconnect Express (PCIe) channel, a flash channel), and the channel serves as a dedicated path for data transmission. The preset storage area is an independent area for storing keys, and stores the keys through key slots.

[0129] The method provided in the embodiments of the present application further includes the following content:

[0130] First, the logical block address of the to-be-encrypted data in the target storage area, the channel identifier corresponding to the target storage area, and the historical erase count of the target physical block within a preset historical time period are obtained.

[0131] wherein the channel identifier is used to indicate a channel corresponding to the target storage area, and the target physical block is a physical block corresponding to the logical block address in the plurality of physical blocks. Illustratively, the channel identifier corresponding to the target storage area can be obtained by querying a preset storage area-channel mapping table.

[0132] Specifically, the logical block address is a virtual address used by the storage device to locate data. The physical block is the smallest physical storage unit of the storage area (such as a flash block in an SSD), and is the basic unit of the erase operation. By the logical block address and the preset mapping relationship between the logical address and the physical block, the physical block where the data is actually stored can be determined.

[0133] The historical erase count refers to the total number of times the target physical block has been erased from the factory to the current time, and can be used to measure the life and stability of the physical block. The more the erase count of the physical block, the shorter the life. Illustratively, the erase count of each physical block can be obtained through a physical block erase count table of the storage device.

[0134] Then, according to the logical block address corresponding to the target storage area, the channel identifier, the historical erase count, and the preset storage duration, the target key slot corresponding to the key is determined.

[0135] Illustratively, the logical block address, the channel identifier, the historical erase count, and the preset storage duration are converted into binary data, and a feature value is calculated through a hash algorithm (such as SHA-256). Then, the feature value is taken modulo N (N is a positive integer) to obtain the slot number of the target key slot. For example, the feature value is 0xABCDEF12, and 0xABCDEF12%10=3.

[0136] Finally, the key is stored in the target key slot.

[0137] In the embodiments of the present application, the storage location of the key, i.e., the target key slot, is uniquely determined by the logical block address, the channel identifier, and other information of the data, and the key cannot be obtained by "brute force traversal of the key slot"; even if the key is obtained, it needs to be matched with the corresponding data location to be used, which greatly reduces the risk of key leakage and improves the attack resistance of the storage device.

[0138] In some embodiments, on the basis of the foregoing embodiments, the method provided by the embodiments of the present application further includes the following content:

[0139] First, the historical encryption times corresponding to the target physical block in a preset historical time period are obtained with the current time as a reference.

[0140] Specifically, the historical encryption times refer to the total number of times that the target physical block is encrypted within a preset historical time period. The historical encryption times can reflect the data update frequency and the execution strength of the security policy. For example, a preset encryption-wear counter in the storage device is used to count the historical encryption times and the historical erase count of the physical block in the storage device.

[0141] Then, when it is determined according to the historical erase count and the historical encryption times that the target physical block does not meet the preset condition, the encrypted data is migrated to other physical blocks except the target physical block.

[0142] Optionally, when the historical erase count is greater than a preset erase times, and a ratio between the historical encryption times and the historical erase count is greater than a preset ratio, it is determined that the target physical block does not meet the preset condition.

[0143] Specifically, when the historical erase count is greater than the preset erase times, it indicates that the physical block has been used for a long time and is seriously worn, and it is easy to fail in advance if it continues to be used at a high frequency. When the ratio between the historical encryption times and the historical erase count is greater than the preset ratio, it indicates that the data in the physical block is frequently updated and each update involves encryption, and such a physical block often stores high-sensitivity and high-change-rate data, and if the hardware starts to be unstable, the risk of data loss or leakage is higher. The preset erase times and the preset ratio can be set according to actual conditions. For example, the preset erase times can be determined according to the maximum erase times that the physical block can withstand.

[0144] In this way, based on the historical erase count and the historical encryption times, the physical block that is about to reach the upper limit of the service life is identified in advance, so as to avoid the risk of data loss caused by hardware aging. At the same time, the use frequency of each physical block is balanced, wear balance is achieved, and the loss of a single physical block caused by frequent encryption / erase is reduced. In addition, migrating the encrypted data when it is determined according to the historical erase count and the historical encryption times that the target physical block does not meet the preset condition can avoid storing sensitive data on the physical block that is about to fail, and migrating the data in time can enhance the security of the data.

[0145] In some embodiments, on the basis of the foregoing embodiments, the method provided by the embodiments of the present application further includes the following content:

[0146] First, the environment data of the storage device and the access data of the encrypted data are acquired.

[0147] Specifically, the environment data refers to the real-time state data of the physical or running environment in which the storage device is located, and can reflect whether the device is in a safe running scenario. For example, the environment data includes but is not limited to the temperature, vibration, voltage and the like of the storage device. The foregoing environment data is acquired through temperature sensors, vibration sensors and voltage sensors built in the storage device.

[0148] Access data records the access behavior of the encrypted data, such as access IP address, access mode, access frequency, etc. Through the access data, it can be reflected whether the access to the encrypted data is compliant. The access data can be obtained by querying the access log of the storage device.

[0149] Then, when the environmental data does not meet the preset environmental condition, and / or, the access data of the encrypted data does not meet the preset access condition, the encrypted data is re-encrypted using a new key.

[0150] For example, the preset environmental condition can be that the temperature is less than a preset temperature threshold, the vibration frequency is less than a preset vibration frequency, etc. The preset access condition can check the access data from four dimensions of access IP, time, frequency, and permission. For example, the access IP 10.0.0.5 is not within the allowed range of “192.168.1.0 / 24”, or a single user attempts to access 5 times within 1 minute (exceeding the upper limit of 3 times), it is determined that the access data does not meet the preset condition. The preset environmental condition and the preset access condition can be set according to the actual application of the storage device, which is not limited here.

[0151] In the embodiments of the present application, when the environment of the storage device is abnormal, or the access is abnormal, there may be a cracking behavior. By triggering the re-encryption operation in real time, the data protection level can be upgraded before the threat expands, and the data can be decrypted after being stolen, so as to dynamically respond to security threats and improve the data risk resistance ability.

[0152] In some embodiments, the data encryption method provided by the embodiments of the present application is implemented by firmware (Firmware) in the SSD host chip. For example, a special microcontroller-oriented lightweight machine learning framework (TFLite-Micro) + a standard neural network library operator library (Cortex Microcontroller Software Interface Standard Neural Network, CMSIS-NN) runs a lightweight neural network, and the inference process is completely located in the disk, without occupying the central processing unit (Central Processing Unit, CPU) and dynamic random access memory (Dynamic Random Access Memory, DRAM) resources, thereby physically blocking “side channel sniffing” while solving the high delay problem caused by PCIe round trip of traditional host-side encryption software.

[0153] In some embodiments, in the storage device, a "encryption-wear" combined counter is added: after each encryption write operation is completed, the controller first synchronously increments the "erase count" and "encryption count" two 4-byte fields in the spare area bit; wherein the "encryption count" is only accumulated when it is determined that the data is "high security" or "top secret". The two counts are reported to the controller in timing with the extension command, and the controller can accurately locate the "high security-high erase" double high trap block based on the "encryption count / erase count" ratio, and migrate or disable the trap block in advance, and subsequently obtain the migration result, automatically down-regulate the sensitivity threshold of this type of scene, realize the closed loop of "decision-wear record-algorithm correction", and balance the wear and maintain the security strength.

[0154] In this way, the encryption behavior is included in the wear measurement dimension, forming a visual correlation between security strength and physical wear, so that the system can actively identify and eliminate high security-high wear double risk points; the counter statistics are completely completed by the in-disk controller hardware, without increasing the host computing burden, filling the gap in related technologies that cannot quantify the impact of encryption load on flash memory life.

[0155] Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiments can be realized by means of software on a general hardware platform as necessary, and of course can also be realized by hardware, but in many cases the former is a better embodiment.

[0156] The embodiments of the present application also provide an encryption system. As shown in the figure, the system includes a data feature analysis module, an intelligent data cache module, an intelligent key management module, and a dynamic encryption module. The system is built into a solid state disk, and realizes encryption and decryption of data in the memory through interaction with the flash memory. Figure 2

[0157] The data feature analysis module is a key component of the entire encryption system, and deeply analyzes the data in the SSD to provide a scientific basis for subsequent encryption and cache strategies. This module can not only accurately classify data into sensitive data and ordinary data according to the characteristics of data content, format, access frequency, and data source, but also can identify frequently accessed data. This classification and identification process provides an important basis for subsequent encryption and cache strategies. For sensitive data, the marked data is transmitted to the intelligent key management module to select a high-strength encryption algorithm (such as AES-256) corresponding key; and for ordinary data, the marked data is transmitted to the intelligent key management module to select a medium-strength encryption algorithm (such as AES-128) corresponding key, which reduces the consumption of computing resources while ensuring a certain security. At the same time, the identified frequently accessed data is marked and transmitted to the intelligent data cache module, avoiding repeated encryption and decryption operations, thereby improving the overall performance and response speed of the system.

[0158] ​Further, the module first collects various types of data from the SSD, covering file content, file type, access frequency, file size, and data source, among other dimensions. Data sources are diverse, including metadata and file system logs of the SSD. The collected raw data undergoes a preprocessing stage to remove irrelevant information and fill in missing values, followed by normalization or standardization processing to ensure data format consistency. For example, file access frequency data is converted into standardized access frequency values for subsequent analysis. Based on preprocessing, the module further extracts meaningful features, including content features (such as file content keywords, text patterns), format features (such as file type), access features (such as file access frequency, access time interval), and source features (such as file generation source).

[0159] Further, the module uses statistical analysis, machine learning techniques, and professional field knowledge to carefully select features closely related to data sensitivity and access patterns from a large number of features, laying a foundation for subsequent model construction. With the help of accuracy, recall rate and other key evaluation indicators, as well as strict cross-validation procedures, the accuracy and reliability of the selected features are comprehensively evaluated to ensure that these features can accurately reflect the characteristics and needs of the data, providing strong support for the efficient operation of the entire encryption system.

[0160] The intelligent data caching module can significantly improve system performance through efficient data management strategies. First, the module relies on detailed analysis results provided by the data feature analysis module, including data access frequency, access patterns, data size, and other key features. Based on these analysis results, the intelligent data caching module can accurately determine which data is frequently accessed "hot data" and store it in the cache area. High-speed cache usually uses high-performance storage media to ensure fast data reading. When the system requests these data again, the intelligent data caching module can provide data directly from the cache, avoiding repeated encryption and decryption operations for the same data, thereby significantly reducing system computing overhead and improving data access response speed.

[0161] Further, to optimize the performance of the intelligent data caching module, various strategies can be adopted. First, the cache decision engine needs to have intelligent learning capabilities, capable of dynamically adjusting the caching strategy according to real-time data access patterns. For example, through machine learning algorithms to analyze the time series of data access, predict future frequent access data, and load it into the cache in advance. Second, the cache manager needs to implement an efficient cache eviction mechanism, such as the Least Recently Used (LRU) or First-In-First-Out (FIFO) algorithm, to ensure efficient use of cache space. In addition, the interface layer design considers seamless integration with other system modules to ensure efficient transmission of data requests and responses. Through these optimization strategies, the intelligent data caching module not only improves the overall performance of the system, but also adapts to different application scenarios and data access patterns.

[0162] The intelligent cache and security parallel processing adopts an in-page metadata reuse mechanism. In the 64B spare area of each NAND page, only the first 16B is used to store the "encryption metadata digest" output by the controller (sensitive level 1B, key slot identity 3B, and 12B integrity Media Access Control (MAC) address), and the remaining 48B is still left for ECC check code. Thus, the controller can perform MAC check and decryption in parallel during the same channel period of Direct Memory Access (DMA) transmission to DRAM without additional NAND access, realizing zero-copy secure reading.

[0163] At the same time, in view of the parallel characteristics of the internal multi-channel and multi-chip enable (Chip Enable, CE) of the SSD, the system implements a "channel-key" binding strategy, maintaining an independent key tree branch for each channel. The controller intelligently allocates encryption tasks based on channel load conditions, fully utilizes parallel bandwidth, and avoids the risk of multiple channels sharing keys, thereby improving the overall performance and security of the system.

[0164] The intelligent key management module is the core component of the entire encryption system, responsible for key generation, update, recycling, and security management. This module integrates advanced encryption technology and automated management strategies to ensure the security and efficiency of the entire life cycle of the key. First, it uses a deep learning-based random number generation algorithm to generate high-entropy keys, ensuring unpredictability and high randomness, thereby effectively resisting brute force attacks. It can also intelligently determine the timing of key updates and recycling based on data usage frequency, access patterns, and security requirements. At the same time, the module optimizes the key recycling mechanism to ensure safe destruction of obsolete keys, preventing illegal recovery and use of keys, etc.

[0165] Further, asFigure 3 As shown, the generation of the key is based on the combination of a deep learning-based random number generation algorithm and a true random number generator (TRNG), ensuring the unpredictability and high randomness of the key, thereby effectively resisting brute force attack. Specifically, the true random number generator receives an entropy source signal, and the deep learning model receives the random data output by the true random number generator for further optimization and enhancement to generate the final key. For example, the deep learning model can be used to post-process the output of the TRNG to remove possible biases or patterns, ensuring that the generated key has a higher entropy value and further improves randomness. This combination not only utilizes the physical randomness of the TRNG, but also improves the quality and security of the random number.

[0166] When the key is updated and recycled, the module can intelligently determine the timing of key update and recycling according to the frequency of data use, access mode and security requirements. By analyzing historical data and real-time data, the strength and security of the key are predicted, and possible risks are warned in advance, so as to realize dynamic key management. For example, when the key use environment changes or there is a security risk, the key update process can be automatically triggered to generate a new key and replace the old key. At the same time, the module also optimizes the key recycling mechanism, and the key is automatically generated and recycled, reducing human error and negligence, ensuring the safe destruction of abandoned keys, and preventing the key from being illegally recovered and used.

[0167] As shown, Figure 4 The dynamic encryption module can flexibly select encryption algorithms according to the classification results of the data, and simultaneously detect resource usage to intelligently schedule encryption tasks to improve efficiency. For "sensitive data", the module uses high-level encryption algorithms (such as AES-256) to ensure high security of the data; while for "ordinary data", it selects medium-strength encryption algorithms (such as AES-128), which balances performance and security. In addition, in the case where the controller includes multiple hardware encryption units / processor cores, the module will detect the resource usage (such as processor load, hardware state, etc.) of each hardware encryption unit / processor core in real time, and dynamically schedule the encryption tasks to the optimal hardware encryption unit / processor core according to the resource usage.

[0168] Further, real-time monitoring of system resources and optimizing encryption task scheduling strategy means that this module will continuously monitor the load of multi-core processors and the usage status of hardware encryption units, and dynamically adjust the allocation of encryption tasks according to the priority of tasks, resource requirements and current system state. For example, for computationally intensive encryption tasks, the module will preferentially allocate them to currently idle processor cores, fully utilizing the parallel processing capabilities of multi-core architecture to speed up task execution; while for tasks with high real-time requirements, the module will preferentially allocate them to hardware encryption units, using their dedicated acceleration functions to quickly complete encryption operations. In addition, the module will also dynamically adjust the priority of tasks according to the urgency of tasks and resource occupation, to ensure that critical tasks can have priority to obtain system resources. Through this fine-grained scheduling strategy, the dynamic encryption module can maximize encryption efficiency while ensuring the overall performance and resource utilization of the system.

[0169] In this system, machine learning algorithms are used to analyze and classify data in SSDs. It can automatically identify the sensitivity of data, for example, by analyzing the content, format, access frequency and source of data, it can classify data into two categories: sensitive data and ordinary data. For data marked as sensitive, the system will automatically select advanced encryption algorithms such as AES-256 to ensure absolute security. For ordinary data, considering its lower sensitivity, the system will select a medium-strength encryption algorithm such as AES-128, which greatly reduces the consumption of computing resources while ensuring a certain level of security, thereby improving the overall performance of the system. This dynamic encryption strategy not only improves the security of data, but also optimizes the use efficiency of resources, making the encryption process more intelligent and flexible, and automatically adjusting the encryption strength according to different data characteristics and usage scenarios, providing users with an efficient and secure data protection solution.

[0170] In the embodiments of the present application, a more intelligent and secure key management mechanism is provided, which comprehensively optimizes each link of key management. First, in the key generation stage, a random number generation algorithm based on deep learning is adopted. Compared with traditional random number generators, this algorithm can generate keys with higher entropy and randomness. Second, in terms of key storage, the system can also monitor the storage environment in real time, detect abnormal access behavior, and timely discover and prevent potential security threats. Finally, in the key update and recycling link, the present application realizes a fully automated process. The system can intelligently judge when to update the key according to the data usage frequency, access mode and security requirements. In addition, the system can also optimize the key recycling mechanism to ensure the safe destruction of abandoned keys and prevent keys from being illegally recovered and utilized. Through these innovative optimization measures, the present application not only improves the security and reliability of key management, but also greatly improves the efficiency of key management, reduces the need for manual intervention, and makes the management of the entire storage system more convenient and efficient.

[0171] In the embodiments of the present application, a series of intelligent technology optimization encryption and decryption process, significantly improve system performance. First, intelligent scheduling hardware acceleration resources, using hardware encryption unit efficient execution of encryption algorithms, significantly reduce the CPU burden and improve processing speed. Second, the use of parallel processing technology, intelligent distribution of tasks to multi-core processors, make full use of system resources, further improve the efficiency and reduce the delay. Finally, intelligent caching strategy accurately identifies frequently accessed data, avoid repeated encryption and decryption, significantly reduce the computational overhead and improve response speed, especially in handling a large number of repeated data when the effect is significant. These comprehensive optimization measures not only reduce the computational overhead in the encryption and decryption process, but also improve the overall performance of the system, so that the encryption system can run efficiently in resource-constrained embedded environments, providing a high-performance, low-overhead data encryption solution for users.

[0172] In addition, the system in the present application is not only suitable for solid state disks, but also can be widely applied to other storage devices and embedded systems that require high security, such as USB flash drives, smart cards, password chips, etc. These devices usually need efficient encryption and decryption implementation under limited hardware resources, and the present application can be quickly integrated into the above devices, significantly enhancing their data encryption, identity authentication and communication security performance, with good portability and flexibility.

[0173] The encryption system provided by the embodiments of the present application significantly improves the security of data through intelligent data classification and dynamic encryption strategy. By automatically identifying the sensitivity of data and selecting the corresponding encryption algorithm according to the classification result of the data, it ensures that sensitive data is protected by high-level encryption, while ordinary data uses a medium-strength encryption algorithm. On the premise of ensuring a certain security, the consumption of computing resources is reduced. This dynamic encryption strategy not only optimizes the use efficiency of resources, but also makes the encryption process more intelligent and flexible, which can automatically adjust the encryption strength according to different data characteristics and usage scenarios, providing an efficient and secure data protection scheme. Secondly, the security and reliability of key management are improved, reducing the need for manual intervention, making the management of the entire storage system more convenient and efficient. Finally, significant achievements have been made in performance optimization, especially in resource-constrained embedded systems. Combined with hardware acceleration technology, the dedicated hardware encryption unit efficiently executes encryption algorithms, significantly reducing CPU burden and improving processing speed. In addition, through parallel processing technology and intelligent caching strategy, the present application further improves the processing efficiency and reduces the delay of encryption and decryption, especially when processing a large amount of repetitive data. These comprehensive optimization measures not only reduce the computational overhead in the encryption and decryption process, but also improve the overall performance of the system, enabling the encryption system to run efficiently in resource-constrained embedded environments, providing a high-performance, low-overhead data encryption solution for users.

[0174] In the embodiments of the present application, a data encryption device is also provided, which is used to implement the above-mentioned embodiments and preferred embodiments, and will not be described again. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware implementation is also possible and contemplated.

[0175] The present embodiment provides a data encryption device, as shown in Figure 5 comprises:

[0176] The acquisition module 501 is configured to acquire the data to be encrypted, and the format information, the historical access information and the source information corresponding to the data to be encrypted;

[0177] The extraction module 502 is configured to extract the content information corresponding to the data to be encrypted;

[0178] The first determination module 503 is configured to input the format information, the historical access information, the source information and the content information into a pre-constructed data type prediction model to determine the data type of the data to be encrypted;

[0179] The second determining module 504 is configured to determine an encryption algorithm of the data to be encrypted according to the data type and a preset mapping relationship between the data type and the encryption algorithm.

[0180] The encryption module 505 is configured to encrypt the data to be encrypted according to the encryption algorithm and a preconfigured key to obtain encrypted data.

[0181] In a possible implementation, the storage device further includes a plurality of storage areas, and the historical access information includes a historical access frequency;

[0182] In a possible implementation, the obtaining module 501 is further configured to obtain an order degree corresponding to the data to be encrypted, a preset storage duration, and an encryption overhead, where the order degree is used to indicate whether an address of the data to be encrypted is continuous when the data to be encrypted is accessed, and the preset storage duration is determined based on a historical storage duration of the data to be encrypted.

[0183] The apparatus further includes a storage module configured to determine a target storage area of the data to be encrypted in the plurality of storage areas according to the historical access frequency, the order degree, the preset storage duration, the encryption overhead, and the data type.

[0184] The data to be encrypted is stored in the target storage area.

[0185] In a possible implementation, the storage module is specifically configured to determine a priority of the data to be encrypted according to the historical access frequency, the order degree, the preset storage duration, and the encryption overhead, where the priority is used to indicate a consumption of the storage device when the data to be encrypted is accessed.

[0186] The target storage area is determined according to the priority and the data type.

[0187] In a possible implementation, in the apparatus, the data type is sensitive data or non-sensitive data, and the storage device includes a first storage area and a second storage area, where data in the first storage area is written to the first storage area at a preset page level granularity, and data in the second storage area is written to the second storage area at a preset block level granularity; when the data type is sensitive data and the priority is a first priority, the target storage area is the first storage area; or when the data type is non-sensitive data and the priority is a second priority, the target storage area is the second storage area.

[0188] In a possible implementation, the storage module is further configured to, when the target storage area is the first storage area and a storage duration of the data to be encrypted reaches the preset storage duration, migrate the data to be encrypted from the first storage area to the second storage area.

[0189] In a possible implementation, the obtaining module 501 is further configured to obtain at least one signal value corresponding to each of the at least one entropy source signal of the storage device within a preset historical time period in reverse from the current time point;

[0190] The apparatus further includes a generating module configured to determine, from the at least one signal value corresponding to each of all the entropy source signals, a preset number of target entropy source signals from all the entropy source signals;

[0191] The at least one signal value corresponding to each of all the target entropy source signals is input to a preset true random number generator to generate the key.

[0192] In a possible implementation, the generating module is specifically configured to determine, from the at least one signal value corresponding to the first entropy source signal, an entropy rate corresponding to the first entropy source signal, where the first entropy source signal is one of the at least one entropy source signal.

[0193] When the entropy rate corresponding to each of all the entropy source signals is determined, the candidate entropy source signal is determined from the at least one entropy source signal according to the entropy rate corresponding to each of all the entropy source signals and a preset entropy rate threshold.

[0194] The target entropy source signal is determined according to the at least one signal value corresponding to each of all the candidate entropy source signals.

[0195] In a possible implementation, the generating module is specifically configured to, when the candidate entropy source signal is a plurality, determine the correlation between each of the candidate entropy source signals according to the at least one signal value corresponding to each of the candidate entropy source signals.

[0196] The target entropy source signal is selected from each of the candidate entropy source signals according to the correlation between each of the candidate entropy source signals.

[0197] In a possible implementation, each of the storage areas is connected to the controller through a channel corresponding thereto; the storage device further includes a preset storage area, the preset storage area includes at least one key slot, and the target key is stored in a target key slot in the at least one key slot; the target storage area includes a plurality of physical blocks.

[0198] The obtaining module 501 is further configured to obtain a logical block address of the to-be-encrypted data in the target storage area, a channel identifier corresponding to the target storage area, and a historical erase count of a target physical block within a preset historical time period in reverse from the current time point, where the channel identifier is used to indicate the channel corresponding to the target storage area, and the target physical block is a physical block corresponding to the logical block address in the plurality of physical blocks.

[0199] The storage module is further configured to determine the target key slot corresponding to the key according to the logical block address, the channel identifier, the historical erase count, and a preset storage time length of the target storage area.

[0200] storing the key into the target key slot.

[0201] In a possible implementation, the obtaining module 501 is further configured to obtain a historical encryption times corresponding to the target physical block within a preset historical time period in a time period before the current time.

[0202] The storage module is further configured to migrate the encrypted data to other physical blocks except the target physical block in the plurality of physical blocks when it is determined that the target physical block does not satisfy the preset condition according to the historical erase count and the historical encryption times.

[0203] In a possible implementation, the storage module is further configured to determine that the target physical block does not satisfy the preset condition when the historical erase count is greater than the preset erase times, and a ratio between the historical encryption times and the historical erase count is greater than a preset ratio.

[0204] In a possible implementation, the obtaining module 501 is further configured to obtain environment data of the storage device and access data of the encrypted data.

[0205] The encryption module 505 is further configured to re-encrypt the encrypted data by using a new key when the environment data does not satisfy a preset environment condition, and / or the access data of the encrypted data does not satisfy a preset access condition.

[0206] The features of the embodiments of the data encryption apparatus can be referred to the related descriptions of the embodiments of the data encryption method, which will not be repeated here.

[0207] Embodiments of the present application further provide an electronic device, as shown in the accompanying drawings, comprising a memory 10 and a processor 20, the memory 10 stores a computer program, and the processor 20 is configured to run the computer program to perform the steps in any of the above-mentioned data encryption method embodiments. Figure 6

[0208] Embodiments of the present application further provide a computer readable storage medium, which stores a computer program, wherein the computer program is configured to perform the steps in any of the above-mentioned data encryption method embodiments when running.

[0209] In an example embodiment, the above-mentioned computer readable storage medium can include, but is not limited to, a U disk, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and various media that can store computer programs.

[0210] ​The embodiment of the present application further provides a computer program product, which comprises a computer program, and the computer program realizes the steps in any of the data encryption method embodiments when executed by a processor.

[0211] The embodiment of the present application further provides another computer program product, which comprises a nonvolatile computer readable storage medium, and the nonvolatile computer readable storage medium stores a computer program, and the computer program realizes the steps in any of the data encryption method embodiments when executed by a processor.

[0212] Those skilled in the art can further realize that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be realized in electronic hardware, computer software or a combination of both. In order to clearly illustrate the interchangeability of hardware and software, the components and steps of the examples have been described in the above description in general terms. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0213] The above provides a data encryption method, an electronic device and a medium. The principles and implementation modes of the present application are described by applying specific examples. The above description of the examples is only applicable to help understand the method and core idea of the present application. It should be pointed out that, for those skilled in the art, without departing from the principles of the present application, some improvements and modifications can be made to the present application, and these improvements and modifications also fall within the protection scope of the claims of the present application.

Claims

1. A data encryption method, characterized in that, The method, applied to a controller in a storage device, includes: Obtain the data to be encrypted, as well as the format information, historical access information, and source information corresponding to the data to be encrypted; Extract the content information corresponding to the data to be encrypted; The format information, the historical access information, the source information, and the content information are input into a pre-built data type prediction model to determine the data type of the data to be encrypted. Based on the data type and the preset mapping relationship between data types and encryption algorithms, the encryption algorithm for the data to be encrypted is determined. The data to be encrypted is encrypted according to the encryption algorithm and the pre-configured key to obtain encrypted data; The storage device further includes multiple storage areas, and the historical access information includes the number of historical accesses; the method further includes: Obtain the order degree, preset storage duration, and encryption overhead corresponding to the data to be encrypted, wherein the order degree is used to indicate whether the addresses of the data to be encrypted are consecutive when it is accessed, and the preset storage duration is determined based on the historical storage duration of the data to be encrypted; Based on the historical access count, the ordering degree, the preset storage duration, the encryption overhead, and the data type, the target storage area of ​​the data to be encrypted in the multiple storage areas is determined; The data to be encrypted is stored in the target storage area; The step of determining the target storage area of ​​the data to be encrypted in the multiple storage areas based on the historical access count, the ordering degree, the preset storage duration, the encryption overhead, and the data type includes: The priority of the data to be encrypted is determined based on the historical access count, the ordering degree, the preset storage duration, and the encryption overhead, wherein the priority is used to indicate the consumption of the storage device when the data to be encrypted is accessed; The target storage area is determined based on the priority and the data type.

2. The method according to claim 1, characterized in that, The data type is either sensitive data or non-sensitive data. The storage device includes a first storage area and a second storage area. Data in the first storage area is written to the first storage area at a preset page-level granularity, and data in the second storage area is written to the second storage area at a preset block-level granularity. When the data type is sensitive data and the priority is a first priority, the target storage area is the first storage area. Alternatively, when the data type is non-sensitive data and the priority is a second priority, the target storage area is the second storage area.

3. The method according to claim 2, characterized in that, The method further includes: When the target storage area is the first storage area, and the storage duration of the data to be encrypted reaches the preset storage duration, the data to be encrypted is migrated from the first storage area to the second storage area.

4. The method according to any one of claims 1-3, characterized in that, The method further includes: Obtain at least one signal value corresponding to at least one entropy source signal of the storage device within a preset historical time period based on the current time. Based on at least one signal value corresponding to each of the entropy source signals, a preset number of target entropy source signals are determined from all the entropy source signals. The key is generated by inputting at least one of the signal values ​​corresponding to each of the target entropy source signals into a preset true random number generator.

5. The method according to claim 4, characterized in that, The step of determining a preset number of target entropy source signals from all the entropy source signals based on at least one signal value corresponding to each of the entropy source signals includes: Based on at least one of the signal values ​​corresponding to the first entropy source signal, the entropy rate corresponding to the first entropy source signal is determined, wherein the first entropy source signal is one of at least one of the entropy source signals; When the entropy rate corresponding to all the entropy source signals is determined, a candidate entropy source signal is determined from at least one of the entropy source signals based on the entropy rate corresponding to all the entropy source signals and a preset entropy rate threshold. The target entropy source signal is determined based on at least one signal value corresponding to each of the candidate entropy source signals.

6. The method according to claim 5, characterized in that, Determining the target entropy source signal based on at least one signal value corresponding to each of the candidate entropy source signals includes: When there are multiple candidate entropy source signals, the correlation between each candidate entropy source signal is determined based on at least one signal value corresponding to each of the candidate entropy source signals. The target entropy source signal is selected from the candidate entropy source signals based on the correlation between them.

7. The method according to claim 1, characterized in that, Each of the storage areas is connected to the controller via a corresponding channel; the storage device also includes a preset storage area, which includes at least one key slot, and the key is stored in a target key slot in at least one of the key slots; The target storage area comprises multiple physical blocks; the method further includes: Obtain the logical block address of the data to be encrypted in the target storage area, the channel identifier corresponding to the target storage area, and the historical erase / write count of the target physical block within a preset historical time period based on the current time. The channel identifier is used to indicate the channel corresponding to the target storage area, and the target physical block is the physical block corresponding to the logical block address among a plurality of physical blocks. The target key slot corresponding to the key is determined based on the logical block address corresponding to the target storage area, the channel identifier, the historical erase / write count, and the preset storage duration. The key is stored in the target key slot.

8. The method according to claim 7, characterized in that, The method further includes: Obtain the historical encryption count corresponding to the target physical block within the preset historical time period based on the current time. When it is determined, based on the historical erase / write count and the historical encryption count, that the target physical block does not meet the preset conditions, the encrypted data is migrated to other physical blocks among the multiple physical blocks, excluding the target physical block.

9. The method according to claim 8, characterized in that, The method further includes: When the historical erase / write count is greater than the preset erase / write count, and the ratio between the historical encryption count and the historical erase / write count is greater than the preset ratio, it is determined that the target physical block does not meet the preset condition.

10. The method according to claim 1 or 2, characterized in that, The method further includes: Obtain environmental data of the storage device, as well as access data of the encrypted data; When the environmental data does not meet the preset environmental conditions, and / or the access data of the encrypted data does not meet the preset access conditions, the encrypted data is re-encrypted using a new key.

11. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the data encryption method as described in any one of claims 1-10 when executing the computer program.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein the computer program, when executed by a processor, implements the steps of the data encryption method as described in any one of claims 1-10.

13. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the data encryption method as described in any one of claims 1-10.

Images