Data encryption method and device, electronic equipment, storage medium and program product

Abstract

The application provides a data encryption method, device, electronic equipment, storage medium and program product, and belongs to the technical field of data security. The method comprises the following steps: obtaining a key code based on a data encryption request sent by a user; the key code is determined based on a preset assignment rule; the preset assignment rule is used to determine the key code according to the identity code of the user and the key number corresponding to the key code; generating an encryption key based on the key code; and encrypting the to-be-encrypted data of the user by using the encryption key to obtain data ciphertext. According to the application, the encryption key is generated in real time based on the key code of the user during data encryption, the cloud platform only needs to store the preset assignment rule of the key code during the whole process of key generation and data encryption, the data encryption scene demand of a large number of users and large data volume can be met, a large number of encryption keys do not need to be stored, and a large amount of key storage overhead and key management cost are saved.

Description

Technical Field

[0001] This invention relates to the field of data security technology, and in particular to a data encryption method, apparatus, electronic device, storage medium, and program product. Background Technology

[0002] With the development of cloud computing, more and more enterprises (also known as tenants) are deploying their information systems on cloud platforms. In order to ensure the security of enterprise information system data, cloud platforms need to encrypt the data to protect its confidentiality.

[0003] Currently, cloud platforms provide confidentiality protection for tenant data by storing all tenants' key information on the cloud platform. When a tenant needs to encrypt their data, the cloud platform determines the tenant's key information from all the key information and uses that key information to encrypt the data, thereby providing data confidentiality protection.

[0004] However, the aforementioned data encryption methods require cloud platforms to provide a large amount of storage space to manage a huge number of keys. For example, if a cloud platform has 1,000 tenants, and each tenant has 1,000 data entries, then each data entry needs to be encrypted with a different key to ensure its confidentiality. In this case, the cloud platform would need to generate 1,000 × 1,000 (i.e., 1 million) keys for each tenant and store these 1 million keys on the cloud platform, which consumes a large amount of storage space and is very complex to manage. Summary of the Invention

[0005] This invention provides a data encryption method, device, electronic device, storage medium, and program product to address the shortcomings of existing cloud platforms that require a large amount of storage space to store and manage a huge number of keys, and to achieve a data encryption scheme that does not consume a lot of storage overhead and has simple key management.

[0006] This invention provides a data encryption method, comprising: Based on the data encryption request sent by the user, a key encoding is obtained; the key encoding is determined based on a preset assignment rule; the preset assignment rule is used to determine the key encoding according to the user's identity code and the key sequence number corresponding to the key encoding; Based on the key encoding, an encryption key is generated; The user's data to be encrypted is encrypted using the encryption key to obtain ciphertext.

[0007] According to a data encryption method provided by the present invention, the data encryption request is a first data encryption request carrying the key encoding; obtaining the key encoding based on the data encryption request sent by the user includes: parsing the first data encryption request sent by the user to obtain the key encoding.

[0008] According to a data encryption method provided by the present invention, before parsing the first data encryption request sent by the user to obtain the key code, the method further includes: parsing the key application request sent by the user to obtain the user's identity code; generating the key code based on the identity code and the current key sequence number; and sending the key code to the user.

[0009] According to a data encryption method provided by the present invention, the data encryption request is a second data encryption request carrying the identity code; obtaining the key code based on the data encryption request sent by the user includes: parsing the second data encryption request sent by the user to obtain the user's identity code; and generating the key code based on the identity code and the current key sequence number.

[0010] According to a data encryption method provided by the present invention, the preset assignment rule is a preset matrix element assignment rule; the step of generating the key code based on the identity code and the current key sequence number includes: determining the matrix row number and matrix column number according to the current key sequence number; generating the key code according to the matrix row number, the matrix column number, the identity code and the preset matrix element assignment rule.

[0011] According to a data encryption method provided by the present invention, the step of generating an encryption key based on the key encoding includes: generating the encryption key based on a master key, an encryption algorithm, and the key encoding; the master key is stored in a cloud platform cryptographic machine.

[0012] According to a data encryption method provided by the present invention, the step of generating the encryption key based on the master key, the encryption algorithm, and the key encoding includes: obtaining a string to be processed by the cloud platform cryptographic machine based on the key encoding and the master key; encrypting the string to be processed by the cloud platform cryptographic machine using a first encryption algorithm to obtain an intermediate encrypted value; and encrypting the intermediate encrypted value by the cloud platform cryptographic machine using a second encryption algorithm to obtain the encryption key; wherein the first encryption algorithm is different from the second encryption algorithm.

[0013] The present invention also provides a data encryption device, comprising: The key encoding acquisition module is used to obtain a key encoding based on the data encryption request sent by the user; the key encoding is determined based on a preset assignment rule; the preset assignment rule is used to determine the key encoding according to the user's identity code and the key sequence number corresponding to the key encoding; An encryption key acquisition module is used to generate an encryption key based on the key encoding; The data ciphertext acquisition module is used to encrypt the user's data to be encrypted using the encryption key to obtain the data ciphertext.

[0014] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the processor executes the computer program to implement any of the data encryption methods described above.

[0015] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the data encryption method described above.

[0016] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements any of the data encryption methods described above.

[0017] The data encryption method, device, electronic device, storage medium, and program product provided by this invention generate encryption keys in real time based on the user's key code during data encryption, and then use the real-time generated encryption keys to encrypt the data. This allows the cloud platform to only store preset assignment rules for generating key codes based on key serial numbers and user identity codes throughout the key generation and data encryption process. This ensures that different data from different users can be encrypted based on different key codes, thus meeting the needs of data encryption scenarios with many users and large data volumes. It eliminates the need to store a huge number of encryption keys, saving a significant amount of key storage overhead and key management costs. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0019] Figure 1 This is a flowchart illustrating the data encryption method provided by the present invention.

[0020] Figure 2 This is one of the timing diagrams of the data encryption method provided by the present invention.

[0021] Figure 3 This is the second timing diagram of the data encryption method provided by the present invention.

[0022] Figure 4 This is the third timing diagram of the data encryption algorithm provided by this invention.

[0023] Figure 5 This is a schematic diagram of the data encryption device provided by the present invention.

[0024] Figure 6This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0026] It should be noted that in the description of this invention, the term "comprising," or any other variation thereof, is intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Those skilled in the art will understand the specific meaning of the above terms in this invention according to the specific circumstances. Furthermore, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0027] The following is combined with Figures 1-6 This invention describes a data encryption scheme that does not consume a large amount of storage overhead and has simple key management.

[0028] With the development of cloud computing, more and more enterprises (also known as tenants) are deploying their information systems on cloud platforms. To ensure the security of enterprise information system data, cloud platforms need to encrypt the data to guarantee its confidentiality. Data encryption requires the use of keys, which involves issues such as the cloud platform generating keys for tenants, storing keys, and how tenants use the keys.

[0029] Currently, cloud platforms provide confidentiality protection for tenant data, which commonly involves generating, storing, and using keys for tenants, as follows: (1) The cloud platform generates a master key MK and stores it securely, and generates a random number as the tenant key; (2) The cloud platform uses the master key MK to encrypt the tenant key key to obtain the ciphertext mw_key of the tenant key key, and stores the ciphertext mw_key in the cloud platform's database; (3) When a tenant needs to use a key, for example, when a tenant needs to protect the confidentiality of the tenant data, the cloud platform uses the master key MK to decrypt the ciphertext mw_key of the tenant key key to obtain the plaintext key of the tenant key key. Finally, the plaintext key is used to encrypt the tenant data data to obtain the ciphertext data.

[0030] However, the aforementioned data encryption methods require cloud platforms to provide substantial storage space to manage a massive number of keys. For example, if a cloud platform has 1,000 tenants, and each tenant has 1,000 data entries, then each data entry needs to be encrypted using a different key to ensure its confidentiality. Therefore, the cloud platform would need to generate 1,000 × 1,000 (i.e., 1 million) keys for each tenant and store these 1 million keys on the cloud platform. With more tenants and more data, the number of keys would be even greater. Clearly, a massive number of keys would consume a significant amount of storage space for the cloud platform and be extremely complex to manage.

[0031] In view of this, it is necessary to provide a data encryption method, device, electronic device, storage medium and program product that does not consume a lot of storage overhead and has simple key management.

[0032] Figure 1 This is a flowchart illustrating the data encryption method provided by the present invention, as shown below. Figure 1 As shown, the data encryption method includes, but is not limited to, steps 101 to 103.

[0033] It should be noted that the execution subject of the data encryption method provided by the present invention is a data encryption device that provides data encryption and storage services. Specifically, it can be a server, computer equipment, cloud server, cloud platform, etc., such as mobile phone, tablet computer, laptop computer, handheld computer, vehicle electronic equipment, wearable device, ultra-mobile personal computer (UMPC), netbook or personal digital assistant (PDA), etc.

[0034] Step 101: Obtain the key encoding based on the data encryption request sent by the user; the key encoding is determined based on a preset assignment rule; the preset assignment rule is used to determine the key encoding according to the user's identity code and the key sequence number corresponding to the key encoding.

[0035] Users are devices that receive data storage and encryption services from other devices such as cloud platforms and servers. Specifically, they may be tenants of the cloud platform.

[0036] The key sequence number is a number that indicates the order in which the key code and its corresponding encryption key were generated or the order in which they were first generated. In other words, the key sequence number is determined based on the order in which the key code and its corresponding encryption key were generated or the order in which they were first generated.

[0037] The preset assignment rules are predefined assignment rules used to determine the key code based on the user's identity code and key serial number.

[0038] To better illustrate the data encryption method provided by the present invention, the following embodiments are illustrated using a cloud platform as the execution subject.

[0039] In a cloud platform, the relationship between the cloud platform and users (i.e., tenants) is one-to-many. For example, a cloud platform can simultaneously correspond to tenant A, tenant B, tenant C, and so on. At the same time, different tenants can request encryption of different data stored on the cloud platform at different times, meaning that the relationship between tenants and the data to be encrypted is also one-to-many.

[0040] Specifically, the cloud platform receives data encryption requests sent by users, obtains the key code specified by the user for data encryption processing directly by parsing the data encryption request, or obtains the user's identity code required to generate the user-specified key code by parsing the data encryption request, and generates the key code in real time using the identity code, key serial number and preset assignment rules, thereby obtaining the key code required to generate the encryption key.

[0041] It is understandable that if the cloud platform can directly obtain the key code specified by the user for data encryption processing by parsing the data encryption request, it indicates that before the user sends the data encryption request, the cloud platform has already responded to the user's key application request, generated the key code based on the user's identity code, key serial number and preset assignment rules, and sent the key code to the user.

[0042] Step 102: Generate an encryption key based on the key encoding.

[0043] Specifically, after obtaining the key encoding, the cloud platform processes the key encoding using pre-defined key generation rules to generate the encryption key required for encrypting the data.

[0044] Step 103: Encrypt the user's data to be encrypted using the encryption key to obtain the encrypted data.

[0045] Optionally, the data to be encrypted is at least one of the following: business data, user identity data, backup data, etc., stored by the user on the cloud platform.

[0046] Specifically, the cloud platform uses an encryption key to encrypt the user's data to be encrypted, obtains ciphertext, and saves the ciphertext locally on the cloud platform, thereby achieving confidentiality protection of tenant data by the cloud platform.

[0047] The data encryption method provided by this invention generates an encryption key in real time based on the user's key code during data encryption, and then uses the real-time generated encryption key to encrypt the data. This allows the cloud platform to store only the preset assignment rules for generating key codes based on the key sequence number and the user's identity code throughout the key generation and data encryption process. This ensures that different data from different users can be encrypted based on different key codes, thus meeting the needs of data encryption scenarios with many users and large data volumes. It eliminates the need to store a huge number of encryption keys, saving a significant amount of key storage overhead and key management costs.

[0048] Based on the above embodiments, as an optional embodiment, the data encryption request is a first data encryption request carrying the key encoding; obtaining the key encoding based on the data encryption request sent by the user includes: The first data encryption request sent by the user is parsed to obtain the key encoding.

[0049] The first data encryption request is a request that carries the key encoding of the user-specified encrypted data and requests data encryption.

[0050] Specifically, Figure 2 This is one of the timing diagrams of the data encryption method provided by the present invention, such as... Figure 2 As shown, if a user has already received one or more key codes from the cloud platform, and the user needs to protect the confidentiality of some or all of their data stored on the cloud platform (i.e., the data to be encrypted), the user sends a first data encryption request to the cloud platform, specifying that the encryption key corresponding to the key code carried in the first data encryption request should be used to encrypt the data. The cloud platform receives and parses the first data encryption request sent by the user, directly obtaining the key code.

[0051] The cloud platform further processes the key encoding using predefined key generation rules to generate the encryption key required for encrypting data, which is the encryption key specified by the user for encrypting data. The encryption key is then used to encrypt the user's data to be encrypted, resulting in ciphertext data, which is then saved locally on the cloud platform, thereby achieving confidentiality protection of tenant data by the cloud platform.

[0052] The data encryption method provided by this invention sends a key code to the user in advance. When encrypting data, it only needs to parse the data encryption request to directly obtain the key code corresponding to the encryption key specified by the user for encrypting the data carried in the data encryption request. This saves the overhead of encryption key storage, key code storage, key management costs, and key code management costs. It also saves the time of generating key codes and allows users to choose the encryption key for encrypting data, thereby improving the efficiency and flexibility of data encryption.

[0053] Based on the above embodiments, as an optional embodiment, before parsing the first data encryption request sent by the user to obtain the key encoding, the method further includes: Parse the key request sent by the user to obtain the user's identity code; The key code is generated based on the identity code and the current key sequence number; The key encoding is sent to the user.

[0054] A key request is a request that carries the user's identity code and requests the generation of a key.

[0055] Specifically, in combination Figure 2 As shown, before the cloud platform receives the user's first data encryption request, the cloud platform responds to the key request sent by the user, parses the key request to obtain the user's identity code carried in it, combines the current key sequence number determined by the request generation order or the first generation order of the encryption key corresponding to the key request, and the preset assignment rules to generate a key code, and finally sends the key code to the user, who stores the key code.

[0056] It should be noted that users can send multiple key request requests to the cloud platform, which will then generate multiple key codes and return them to the user's storage. Therefore, when a user requests confidentiality protection for data on the cloud platform, they can select one key code from the multiple key codes stored locally, encapsulate it into a first data encryption request, and then send the first data encryption request to the cloud platform.

[0057] Users can send multiple key request requests, each carrying an identity code and data category, to the cloud platform based on the data's business category, storage time, and importance. Different key request requests will carry different data categories. The cloud platform will then return different key codes for each data category to the user. This allows the user to send the key code corresponding to a specific data category as part of a first data encryption request when they need to encrypt data of a particular category stored on the cloud platform. The data category can be determined based on at least one of the following factors: business category, storage time, and data importance.

[0058] For example, if a user's business data stored on the cloud platform includes four types: business A, B, C, and D, then four key request requests can be sent in advance to obtain key codes a, b, c, and d for each of the four types of business data. When it is necessary to encrypt the business data for business A, a first data encryption request carrying key code a is sent to the cloud platform.

[0059] Optionally, if the user needs to possess an encryption key, after generating the key code based on the identity code and the current key sequence number, the method further includes: generating the encryption key based on the key code; Sending the key encoding to the user further includes sending the key encoding and the encryption key to the user.

[0060] Understandably, when the user does not need to hold the encryption key themselves, the cloud platform only sends the key code to the user; when the user needs to hold the encryption key themselves, the cloud platform sends both the key code and the encryption key to the user.

[0061] The data encryption method provided by this invention obtains the user's identity code by parsing the user's key request request, generates a key code based on the user's identity code and the current key sequence number, and returns the key code to the user, who can store the key code themselves. This saves key code storage overhead and management costs, saves time in generating key codes during data encryption, and allows users to choose the encryption key for encrypting data, thus improving the efficiency and flexibility of data encryption.

[0062] Based on the above embodiments, as an optional embodiment, the data encryption request is a second data encryption request carrying the identity code; obtaining the key code based on the data encryption request sent by the user includes: Parse the second data encryption request sent by the user to obtain the user's identity code; The key code is generated based on the identity code and the current key sequence number.

[0063] The second data encryption request carries the user's identity code and simultaneously requests key generation and data encryption.

[0064] Specifically, Figure 3 This is the second timing diagram of the data encryption method provided by the present invention, as shown below. Figure 3 As shown, when a user needs to protect the confidentiality of some or all of their data stored on the cloud platform (i.e., the data to be encrypted), if the user has not received the key encoding sent by the cloud platform beforehand or believes that the locally stored key encoding is unsuitable for the data encryption task, the user sends a second data encryption request carrying the user's identity code to the cloud platform. The cloud platform receives and parses the second data encryption request sent by the user to obtain the user's identity code.

[0065] The cloud platform uses the parsed identity code, combined with the current key sequence number determined by the application generation order or the first generation order of the encryption key corresponding to the second data encryption request, and the preset assignment rules, to generate a key code.

[0066] Next, on the one hand, the cloud platform further processes the key encoding using the pre-defined key generation rules to generate the encryption key required for encrypting the data, and uses the encryption key to encrypt the user's data to be encrypted to obtain the data ciphertext, and saves the data ciphertext locally on the cloud platform, thereby realizing the confidentiality protection of tenant data by the cloud platform.

[0067] On the other hand, the cloud platform will also send the generated key encoding to the user, who will then store the key encoding. Similarly, if the user does not need to hold the encryption key themselves, the cloud platform will only send the key encoding to the user; if the user needs to hold the encryption key themselves, the cloud platform will send both the key encoding and the encryption key to the user.

[0068] The data encryption method provided by this invention obtains the user's identity code by parsing the user's second data encryption request, and then generates a key code in real time based on the user's identity code and the current key sequence number. The key code is then used to generate an encryption key and to directly encrypt data. This saves on the storage overhead and management costs of the key code and encryption key, and improves the efficiency and flexibility of data encryption.

[0069] Based on the above embodiments, as an optional embodiment, the preset assignment rule is a preset matrix element assignment rule; the step of generating the key code based on the identity code and the current key sequence number includes: Based on the current key sequence number, determine the matrix row number and matrix column number; The key code is generated based on the matrix row number, the matrix column number, the identity code, and the preset matrix element assignment rules.

[0070] The preset matrix element assignment rules are predefined rules used to determine the key code based on the user's identity code, matrix row number, and matrix column number.

[0071] Specifically, before the key generation stage, the cloud platform will pre-construct an m-row, n-column matrix K. mn Matrix K mn The expression is as follows: .

[0072] For example, if m=1000 and n=1000, then matrix K mn It is a matrix with 1000 rows and 1000 columns, and has a total of 1 million matrix elements.

[0073] For example, if m=10000 and n=10000, then matrix K mn It is a matrix with 10,000 rows and 10,000 columns, and has a total of 100 million matrix elements.

[0074] It is understandable that matrix K mn The number of users and the amount of data stored on the cloud platform service can be determined based on factors such as the number of users and the amount of data stored, and this application does not impose any restrictions on this.

[0075] Furthermore, for matrix K mn Each matrix element K in ij The cloud platform pre-sets the matrix element assignment rules according to the matrix row number, matrix column number, and identity code.

[0076] For example, the default matrix element assignment rule is specified as "K". ij =XXX-ij", where "XXX" is the identity code, "i" is the matrix row number, and "j" is the matrix column number. Then, based on the preset matrix element assignment rule "K ij The matrix K of the expression =XXX-ij” mn The expression is as follows: .

[0077] During the key generation or data encryption phase, the cloud platform parses the key application request or the second data encryption request to obtain the user's identity code. On the other hand, the cloud platform determines the application generation order or the first generation order of the corresponding encryption key based on the key application request or the second data encryption request, and then determines the current key sequence number.

[0078] The cloud platform determines the matrix row number and matrix column number based on the current key sequence number, and then generates a key code based on the matrix row number, matrix column number, identity code, and preset matrix element assignment rules.

[0079] For example, if the cloud platform determines, based on a key request from a user named ChinaMobile, that the encryption key corresponding to that request is the first encryption key the cloud platform will generate, then the current key sequence number is 1, meaning it's the first key generation. Starting from the first row and first column of the matrix, both the matrix row number and column number are set to 1. Combined with the user's identification code "ChinaMobile" and the aforementioned preset matrix element assignment rule, which is "K",... ij =XXX-ij”, which means the key code is determined to be “ChinaMobile-1-1”.

[0080] For example, when generating a key again, it starts from the 1st row and 2nd column of the matrix, and so on. If the cloud platform determines, based on a second data encryption request from user ChinaTelecom, that the encryption key corresponding to this key request is the 1003rd encryption key that the cloud platform will generate, then the current key sequence number is 1003. Consequently, the matrix row number is determined to be 2, and the matrix column number is 3. Combined with the user's identity code "ChinaTelecom" and the aforementioned preset matrix element assignment rule, "K",... ij =XXX-ij”, which means the key encoding is determined to be “ChinaTelecom-2-3”.

[0081] It is understood that the preset matrix element assignment rules are not limited to "K" in the aforementioned embodiments. ij =XXX-ij”, but can be set according to actual needs. If the preset matrix element assignment rules can determine a unique key code based on different matrix row numbers, matrix column numbers, and identity codes, this application does not impose any restrictions on it.

[0082] The data encryption method provided by this invention generates key codes by using a matrix derivation approach combined with predefined matrix element assignment rules. This ensures a clear correspondence and regularity between the key codes and matrix elements, avoiding the irregularity of determining key codes solely based on identity codes. It effectively distinguishes different users, and the cloud platform only needs to store the predefined matrix element assignment rules (such as "K"). ij =XXX-ij”, further optimizing the data encryption method without incurring key storage overhead and management costs.

[0083] In another embodiment, the preset assignment rule is a preset array element assignment rule; the step of generating the key code based on the identity code and the current key sequence number includes: Based on the current key sequence number, determine the array element sequence number; The key code is generated based on the array element sequence number, the identity code, and the preset array element assignment rules.

[0084] For example, the default array element assignment rule is specified as "K". l =XXX-l", where "XXX" is the identity code and "l" is the array element index. Therefore, based on the preset array element assignment rule "Kl=XXX-l", the array K... l The expression is K l =[XXX-1,XXX-2,XXX-1000000].

[0085] During the key generation or data encryption phase, the cloud platform parses the key application request or the second data encryption request to obtain the user's identity code. On the other hand, the cloud platform determines the application generation order or the first generation order of the corresponding encryption key based on the key application request or the second data encryption request, and then determines the current key sequence number.

[0086] The cloud platform determines the array element sequence number based on the current key sequence number, and then generates a key code based on the array element sequence number, identity code, and preset array element assignment rules.

[0087] For example, if the cloud platform determines, based on a key request from a user named ChinaMobile, that the encryption key corresponding to that request is the first encryption key the cloud platform will generate, then the current key sequence number is 1, meaning it's the first key generation. Starting from the first element of the array, the array element sequence number is determined to be 1. This is combined with the user's identification code "ChinaMobile" and the aforementioned preset array element assignment rule, which is "K". l =XXX-l”, which means the key code is determined to be “ChinaMobile-1”.

[0088] For example, when generating a key again, it starts from the second element of the array, and so on. If the cloud platform determines, based on a second data encryption request from user ChinaTelecom, that the encryption key corresponding to this key request is the 1002nd encryption key that the cloud platform will generate, then the current key sequence number is 1003, and thus the array element sequence number is determined to be 1003. Combining this with the user's identity code "ChinaTelecom" and the aforementioned preset array element assignment rule, which is "K",... l =XXX-l”, which means the key code is determined to be “ChinaTelecom-1003”.

[0089] It is understood that the preset array element assignment rules are not limited to "K" in the aforementioned embodiments. l Instead of using "=XXX-l", it can be set according to actual needs. This application does not restrict the key code if the preset array element assignment rules can determine a unique key code based on different array element serial numbers and identity codes.

[0090] Based on the above embodiments, as an optional embodiment, generating an encryption key based on the key encoding includes: The encryption key is generated based on the master key, the encryption algorithm, and the key encoding; the master key is stored in the cloud platform cryptographic machine.

[0091] Among them, the cloud platform cryptographic machine is a cryptographic machine set up in the server of the cloud platform.

[0092] Specifically, the cloud platform cryptographic machine generates a master key MK in advance using random numbers and stores the master key MK directly in the cloud platform cryptographic machine.

[0093] K is encoded with a key ij For example, the cloud platform obtains the key encoding K. ij Then, the key is encoded as K. ij The data to be encrypted is sent to the cloud platform cryptographic machine, based on the key encoding K. ij The master key MK stored in the cloud platform cryptographic machine and a pre-determined encryption algorithm are used to generate an encryption key Key for encrypting the data to be encrypted. ij And the cloud platform cryptographic machine uses the encryption key Key ij The data to be encrypted is encrypted to obtain the ciphertext, which is then returned to the cloud platform for storage, thus completing the confidentiality protection of user data.

[0094] The data encryption method provided by this invention utilizes the non-disclosure characteristic of cryptographic machines by storing the master key in a cloud platform cryptographic machine and adding the master key to participate in the generation of encryption keys. The cloud platform cryptographic machine generates encryption keys based on key encoding, master key, and encryption algorithm, thus ensuring the unpredictability of the generated encryption keys.

[0095] Based on the above embodiments, as an optional embodiment, generating the encryption key based on the master key, the encryption algorithm, and the key encoding includes: The cloud platform cryptographic machine obtains the string to be processed based on the key encoding and the master key; The cloud platform cryptographic machine uses the first encryption algorithm to encrypt the string to be processed to obtain an intermediate encrypted value; The intermediate encrypted value is encrypted by the cloud platform cryptographic machine using the second encryption algorithm to obtain the encryption key; The first encryption algorithm is different from the second encryption algorithm.

[0096] Where the first encryption algorithm is different from the second encryption algorithm, the first encryption algorithm and the second encryption algorithm can be any of the hash algorithms such as SHA256 hash algorithm, SM3 hash algorithm, SHA-3 algorithm, etc.

[0097] Specifically, Figure 4 This is the third timing diagram of the data encryption algorithm provided by this invention, as shown below. Figure 4 As shown, K is encoded with a key. ij For example, the cloud platform obtains the key encoding K. ij Then, the key is encoded as K. ij The data to be encrypted is sent to the cloud platform's cryptographic machine, which encodes the key K. ijThe string to be processed is obtained by performing operations such as summation and concatenation with the master key MK stored in the cryptographic machine on the cloud platform.

[0098] For example, the string to be processed is MK||K ij , where || is the character concatenation symbol.

[0099] The cloud platform cryptographic machine first encrypts the string to be processed using the first encryption algorithm to obtain an intermediate encrypted value, then encrypts the intermediate encrypted value using the second encryption algorithm, finally obtaining the encryption key. ij .

[0100] Taking the first encryption algorithm as SHA256 hash algorithm and the second encryption algorithm as SM3 hash algorithm as an example, the encryption key Key ij =sm3(sha256(MK||K ij )), where sha256() is the sha256 hash algorithm and sm3() is the sm3 hash algorithm.

[0101] The cloud platform cryptographic machine further uses the encryption key. ij The data to be encrypted is encrypted to obtain the ciphertext, and then the ciphertext is sent to the cloud platform for storage space to store the ciphertext, thus completing the confidentiality protection of user data.

[0102] The data encryption method provided by this invention utilizes the non-disclosure characteristic of cryptographic machines, stores the master key in a cloud platform cryptographic machine, adds the master key to the generation of encryption keys, and encrypts the string composed of the master key and the key encoding twice to generate the encryption key, thus ensuring the unpredictability of the generated encryption key.

[0103] Table 1 is a table of numerical examples related to data encryption provided by this invention, with the preset assignment rule being "K". i,j Taking the following as an example: Given the preset matrix element assignment rules of "=XXX-ij", a matrix size of 1000×1000, the user's identity code as "ChinaMobile", the first encryption algorithm as SHA256 hash, and the second encryption algorithm as SM3 hash, with key number 1, the matrix elements are... The key encoding and matrix element values ​​are both "ChinaMobile-1-1", and the encryption key is sm3(sha256(MK||ChinaMobile-1-1)); when the key sequence number is 4009, the matrix elements are... The key encoding and matrix element values ​​are both "ChinaMobile-5-9", and the encryption key is sm3(sha256(MK||ChinaMobile-5-9)); when the key sequence number is 370635, the matrix elements are... The key encoding and matrix element values ​​are both "ChinaMobile-371-635", and the encryption key is sm3(sha256(MK||ChinaMobile-371-635)); when the key sequence number is 1000000, the matrix elements are... The key encoding and matrix element values ​​are both "ChinaMobile-1000-1000", and the encryption key is sm3(sha256(MK||ChinaMobile-1000-1000)).

[0104] Table 1

[0105] Figure 5 This is a schematic diagram of the data encryption device provided by the present invention, as shown below. Figure 5 As shown, the data encryption device includes, but is not limited to, a key encoding acquisition module 501, an encryption key acquisition module 502, and a data ciphertext acquisition module 503.

[0106] The key encoding acquisition module 501 is used to obtain a key encoding based on the data encryption request sent by the user; the key encoding is determined based on a preset assignment rule; the preset assignment rule is used to determine the key encoding according to the user's identity code and the key sequence number corresponding to the key encoding.

[0107] The encryption key acquisition module 502 is used to generate an encryption key based on the key encoding.

[0108] The data ciphertext acquisition module 503 is used to encrypt the user's data to be encrypted using the encryption key to obtain data ciphertext.

[0109] It should be noted that the data encryption device provided by the present invention can execute the data encryption method described in any of the above embodiments during specific operation, which will not be elaborated in this embodiment.

[0110] The data encryption device provided by this invention generates an encryption key in real time based on the user's key code during data encryption, and then uses the real-time generated encryption key to encrypt the data. This allows the cloud platform to only store the preset assignment rules for generating key codes based on the key sequence number and the user's identity code throughout the key generation and data encryption process. This ensures that different data from different users can be encrypted based on different key codes, thus meeting the needs of data encryption scenarios with many users and large data volumes. It eliminates the need to store a huge number of encryption keys, saving a significant amount of key storage overhead and key management costs.

[0111] Figure 6 This is a schematic diagram of the structure of the electronic device provided by the present invention, such as... Figure 6As shown, the electronic device may include a processor 610, a communications interface 620, a memory 630, and a communication bus 640, wherein the processor 610, the communications interface 620, and the memory 630 communicate with each other via the communication bus 640. The processor 610 can call logical instructions in the memory 630 to execute the data encryption method provided in any of the above embodiments. The data encryption method includes, but is not limited to, the following steps: obtaining a key encoding based on a data encryption request sent by a user; the key encoding being determined based on a preset assignment rule; the preset assignment rule being used to determine the key encoding according to the user's identity code and the key sequence number corresponding to the key encoding; generating an encryption key based on the key encoding; and encrypting the user's data to be encrypted using the encryption key to obtain ciphertext.

[0112] Furthermore, the logical instructions in the aforementioned memory 630 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0113] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the data encryption method provided in any of the above embodiments. The data encryption method includes, but is not limited to, the following steps: obtaining a key encoding based on a data encryption request sent by a user; the key encoding being determined based on a preset assignment rule; the preset assignment rule being used to determine the key encoding according to the user's identity code and the key sequence number corresponding to the key encoding; generating an encryption key based on the key encoding; and encrypting the user's data to be encrypted using the encryption key to obtain ciphertext.

[0114] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements the data encryption method provided in any of the above embodiments. The data encryption method includes, but is not limited to, the following steps: obtaining a key encoding based on a data encryption request sent by a user; the key encoding being determined based on a preset assignment rule; the preset assignment rule being used to determine the key encoding according to the user's identity code and the key sequence number corresponding to the key encoding; generating an encryption key based on the key encoding; and encrypting the user's data to be encrypted using the encryption key to obtain ciphertext.

[0115] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0116] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0117] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A data encryption method, characterized in that, include: Based on the data encryption request sent by the user, the key encoding is obtained; The key encoding is determined based on a preset assignment rule; The preset assignment rule is used to determine the key code based on the user's identity code and the key sequence number corresponding to the key code; Based on the key encoding, an encryption key is generated; The user's data to be encrypted is encrypted using the encryption key to obtain ciphertext. The preset assignment rule is a preset matrix element assignment rule; the identity code is obtained after parsing the data encryption request; and the key code is obtained based on the following method: Determine the matrix row number and matrix column number based on the current key sequence number; The key code is generated based on the matrix row number, the matrix column number, the identity code, and the preset matrix element assignment rules.

2. The data encryption method according to claim 1, characterized in that, The data encryption request is a first data encryption request carrying the key encoding; obtaining the key encoding based on the data encryption request sent by the user includes: The first data encryption request sent by the user is parsed to obtain the key encoding.

3. The data encryption method according to claim 2, characterized in that, Before parsing the first data encryption request sent by the user to obtain the key encoding, the method further includes: Parse the key request sent by the user to obtain the user's identity code; The key code is generated based on the identity code and the current key sequence number; The key encoding is sent to the user.

4. The data encryption method according to claim 1, characterized in that, The data encryption request is a second data encryption request carrying the identity code; obtaining the key code based on the data encryption request sent by the user includes: Parse the second data encryption request sent by the user to obtain the user's identity code; The key code is generated based on the identity code and the current key sequence number.

5. The data encryption method according to claim 1, characterized in that, The step of generating an encryption key based on the key encoding includes: The encryption key is generated based on the master key, the encryption algorithm, and the key encoding; the master key is stored in the cloud platform cryptographic machine.

6. The data encryption method according to claim 5, characterized in that, The process of generating the encryption key based on the master key, the encryption algorithm, and the key encoding includes: The cloud platform cryptographic machine obtains the string to be processed based on the key encoding and the master key; The cloud platform cryptographic machine uses the first encryption algorithm to encrypt the string to be processed to obtain an intermediate encrypted value; The intermediate encrypted value is encrypted by the cloud platform cryptographic machine using the second encryption algorithm to obtain the encryption key; The first encryption algorithm is different from the second encryption algorithm.

7. A data encryption device, characterized in that, include: The key encoding acquisition module is used to obtain the key encoding based on the data encryption request sent by the user. The key encoding is determined based on a preset assignment rule; The preset assignment rule is used to determine the key code based on the user's identity code and the key sequence number corresponding to the key code; An encryption key acquisition module is used to generate an encryption key based on the key encoding; The data ciphertext acquisition module is used to encrypt the user's data to be encrypted using the encryption key to obtain data ciphertext; The preset assignment rule is a preset matrix element assignment rule; the identity code is obtained after parsing the data encryption request; and the key code is obtained based on the following method: Determine the matrix row number and matrix column number based on the current key sequence number; The key code is generated based on the matrix row number, the matrix column number, the identity code, and the preset matrix element assignment rules.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the data encryption method as described in any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the data encryption method as described in any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the data encryption method as described in any one of claims 1 to 6.

Images