Data transmission method, data encryption method, data decryption method, equipment, storage medium and program product

Abstract

The embodiment of the invention provides a data transmission method, a data encryption method, a data decryption method, equipment, a storage medium and a program product, and is applied to the field of data processing under a heterogeneous memory architecture, a first memory and a mask pool are both located in a trusted environment, at least one offset is generated for target data acquired from the first memory, and the offset is used for processing the target data. And based on the at least one offset, obtaining at least one bit character string consistent with the target data in size from a mask pool, so as to perform mask operation on the target data by using the at least one bit character string, generate encrypted data and send the encrypted data to a second memory located in a non-trusted environment, and secure transmission of data among different types of memories is realized. According to the scheme provided by the embodiment of the invention, the security of data transmission and storage among different types of memories is improved.

Description

Technical Field

[0001] This application relates to the field of data processing, and more particularly to a data transmission method, a data encryption method, a data decryption method, an apparatus, a storage medium, and a program product. Background Technology

[0002] With the explosive growth of data volume, memory requirements have also increased. To meet the data processing needs of memory-intensive applications such as cloud computing and big data analytics, heterogeneous memory architectures have emerged. A heterogeneous memory architecture integrates and uses multiple memory technologies with different characteristics to fully leverage the advantages of each memory type in terms of performance, cost, capacity, and power consumption. In a heterogeneous memory architecture, data can be transferred between different types of memory. Some of these memories may reside in trusted environments, such as the computer system's local memory, while others may reside in untrusted environments, such as remote memory outside the computer system. Therefore, data transfer from trusted memory to untrusted memory may be involved.

[0003] Ensuring data security during the aforementioned data transmission process is a pressing issue that needs to be addressed. Summary of the Invention

[0004] This application provides a data transmission method, a data encryption method, a data decryption method, a device, a storage medium, and a program product to improve the security of data transmission and storage between different types of memory.

[0005] In a first aspect, embodiments of this application provide a data transmission method, including:

[0006] Retrieve the target data from the first memory location;

[0007] Determine the bit sequence to fill the mask pool;

[0008] Generate at least one offset, and based on the at least one offset, obtain at least one bit string from the mask pool that has the same data size as the target data;

[0009] The target data is masked using at least one bit string to generate encrypted data;

[0010] The encrypted data is sent to a second memory; wherein the first memory and the mask pool are located in a trusted environment, and the second memory is located in an untrusted environment.

[0011] Secondly, embodiments of this application provide a data transmission method, including:

[0012] Encrypted data is obtained from the second memory; the encrypted data is generated by masking target data in the first memory using at least one bit string, and the at least one bit string is obtained from a mask pool based on at least one offset;

[0013] Determine the at least one offset corresponding to the encrypted data, and based on the at least one offset, obtain the corresponding at least one bit string from the mask pool;

[0014] The encrypted data is decrypted using at least one bit string to obtain the target data;

[0015] The first memory and the mask pool are located in a trusted environment, while the second memory is located in an untrusted environment.

[0016] Thirdly, embodiments of this application provide a data encryption method, including:

[0017] In response to the first data transmission command, the target data is determined;

[0018] Generate at least one offset;

[0019] Based on the at least one offset, at least one bit string with the same data size as the target data is obtained from the mask pool; the mask pool stores bit sequences.

[0020] The target data is masked using at least one bit string to generate encrypted data.

[0021] Fourthly, embodiments of this application provide a data decryption method, including:

[0022] In response to a second data transmission instruction, encrypted data is determined; the encrypted data is generated by masking the target data using at least one bit string, the at least one bit string being obtained from a mask pool based on at least one offset;

[0023] Determine the at least one offset corresponding to the encrypted data, and based on the at least one offset, obtain at least one corresponding bit string from the mask pool;

[0024] The encrypted data is decrypted using at least one bit string to obtain the target data.

[0025] Fifthly, embodiments of this application provide a computing device, including a storage component and a processing component; the storage component stores one or more computer program instructions, the computer program instructions are invoked and executed by the processing component, and the processing component executes the one or more computer program instructions to implement the data transmission method as described in the first or second aspect, or the data encryption method as described in the third aspect, or the data decryption method as described in the fourth aspect.

[0026] In a sixth aspect, embodiments of this application provide a computer-readable storage medium storing a computer program that is executed by a computer to implement the data transmission method as described in the first or second aspect, the data encryption method as described in the third aspect, or the data decryption method as described in the fourth aspect.

[0027] In a seventh aspect, embodiments of this application provide a computer program product storing a computer program, which, when executed by a computer, implements the data transmission method as described in the first or second aspect, the data encryption method as described in the third aspect, or the data decryption method as described in the fourth aspect.

[0028] In this embodiment, before transferring target data from a first memory located in a trusted environment to a second memory located in an untrusted environment, encrypted data is generated by masking it using at least one bit string obtained from a mask pool located in the trusted environment. This encrypted data is then transferred to the second memory, improving the security of data transfer and storage between different types of memory in a heterogeneous memory architecture. Furthermore, the mask pool is filled with bit sequences, and the bit string obtained from the mask pool for masking is at least one bit string with the same size as the target data. Therefore, masking operations on target data of any size can be achieved, meeting the processing requirements for small-sized data in a heterogeneous memory architecture and improving the flexibility of data encryption.

[0029] These or other aspects of this application will become more apparent in the following description of the embodiments. Attached Figure Description

[0030] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0031] Figure 1 A flowchart of one embodiment of a data transmission method provided in this application is shown;

[0032] Figure 2 A flowchart of another embodiment of a data transmission method provided in this application is shown;

[0033] Figure 3 A flowchart of one embodiment of a data encryption method provided in this application is shown;

[0034] Figure 4 A flowchart of one embodiment of the data decryption method provided in this application is shown;

[0035] Figure 5 This invention provides a schematic diagram of the structure of one embodiment of a data transmission apparatus.

[0036] Figure 6 A schematic diagram of another embodiment of a data transmission apparatus provided in this application is shown;

[0037] Figure 7 This illustration shows a scenario interaction diagram of data transmission under a heterogeneous memory architecture in a practical application, according to an embodiment of this application.

[0038] Figure 8 A schematic diagram of one embodiment of a computing device provided in this application is shown. Detailed Implementation

[0039] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings.

[0040] In some of the processes described in the specification, claims, and accompanying drawings of this application, multiple operations appearing in a specific order are included. However, it should be clearly understood that these operations may not be executed in the order they appear herein, or may be executed in parallel. The operation numbers, such as 101, 102, etc., are merely used to distinguish different operations and do not themselves represent any execution order. Furthermore, these processes may include more or fewer operations, and these operations may be executed sequentially or in parallel. It should be noted that the descriptions such as "first," "second," etc., in this document are used to distinguish different messages, devices, modules, etc., and do not represent a chronological order, nor do they limit "first" and "second" to different types.

[0041] The technical solutions of this application are applicable to data transmission scenarios, especially data transmission scenarios under heterogeneous memory architectures. A heterogeneous memory architecture refers to a memory system architecture composed of different types of memory, aiming to integrate and utilize various memory technologies with different characteristics to fully leverage the advantages of each memory type in terms of performance, cost, capacity, and power consumption. Under a heterogeneous memory architecture, data can be transferred between different memory types, for example, from memory in a trusted environment to memory in an untrusted environment. Ensuring data security during this process is a crucial issue that needs to be addressed.

[0042] In developing this application, the inventors discovered that while traditional standard encryption protocols such as AES (Advanced Encryption Standard) are suitable for encrypting larger data units like files or data blocks, they are insufficient for processing small data objects in heterogeneous memory architectures. While TLS (Transport Layer Security) provides encryption protection for data transmission, ensuring data security during transmission, it fails to guarantee security during storage and processing after transmission, and cannot guarantee protection against threats such as direct access or manipulation of storage devices. Similarly, while TDE (Transparent Data Encryption) provides encryption protection for data persistence to disk, protecting data stored on physical media from unauthorized access, it cannot guarantee the security of runtime memory data. While hardware memory security technologies such as Intel TME (total memory encryption) and SGX (Software Guard Extensions) can enhance the security of local memory, they are not readily applicable to memory data security across physical and logical boundaries and cannot meet the confidentiality requirements of heterogeneous memory architectures.

[0043] Based on this, the inventors, after a series of studies, proposed the technical solution of this application. In the embodiments of this application, before transferring the target data from the first memory located in a trusted environment to the second memory located in an untrusted environment, encrypted data is generated by performing a masking operation on it using at least one bit string obtained from the mask pool located in the trusted environment. The encrypted data is then transferred to the second memory, improving the security of data transfer and storage between different types of memory in a heterogeneous memory architecture. Furthermore, the mask pool is filled with bit sequences, and the bit string obtained from the mask pool for masking operations is at least one bit string with the same size as the target data. Therefore, masking operations on target data of any size can be achieved, meeting the processing needs of small-sized data in a heterogeneous memory architecture and improving the flexibility of data encryption. Furthermore, during the encryption process, at least one offset corresponding to the target data in the mask pool can be randomly generated. The bit string used for masking is obtained based on the offset. This ensures that the bit string used for masking the target data is one-time use. Each time the target data is encrypted, the offset is regenerated, and the bit string is obtained based on the regenerated offset to perform masking operations to generate encrypted data. This ensures that comparison information of multiple encrypted data cannot be obtained, avoids guessing the original target data based on comparison information, and further improves the security of data transmission and storage.

[0044] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0045] The technical solutions of this application can be applied to heterogeneous memory system architectures. Heterogeneous memory refers to a memory system composed of different types of memory, aiming to integrate and use multiple memory technologies with different characteristics in a single computing system to fully leverage the advantages of each memory in terms of performance, cost, capacity, and power consumption. These systems integrate multiple storage modes, forming large-scale memory systems that support transparent memory access operations, including decoupled memory and non-volatile memory, which have significant advantages in performance and cost balance, resource allocation flexibility, and utilization optimization.

[0046] Different types of memory can include memory located in a trusted environment and memory located in an untrusted environment. In one implementation, memory located in a trusted environment can include local memory, while memory located in an untrusted environment can include remote memory, such as memory in an external device.

[0047] Different types of memory can establish connections via a network. The network can include various connection types, such as wired or wireless communication links, or fiber optic cables. One memory module can interact with another via the network to receive or send data. In one implementation, the trusted environment may include a device manager to manage externally linked memory devices, which can interact with these devices using various methods such as network connections or wired connections to receive or send data.

[0048] It should be noted that the embodiments of this application may involve the use of user data. In practical applications, user-specific personal data may be used in the scheme described herein within the scope permitted by applicable laws and regulations, provided that it complies with the applicable laws and regulations of the country (e.g., with the user's explicit consent, with the user being properly notified, etc.).

[0049] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation portals are provided for users to choose to authorize or refuse.

[0050] It should be noted that the technical solutions of this application embodiment are applicable to the network virtual environment, and the described users generally refer to "virtual users". Real users can register user accounts on the server through registration to obtain user identity in the network environment.

[0051] like Figure 1 The diagram shown is a flowchart of an embodiment of a data transmission method provided in this application. The method may include the following steps.

[0052] 101: Retrieve target data from the first memory location.

[0053] The solution in this application is applicable to data transfer scenarios between different types of memory in a heterogeneous memory architecture. This embodiment involves a scenario where data is transferred from memory in a trusted environment to memory in an untrusted environment.

[0054] In this embodiment, the first memory resides in a trusted environment, while the second memory, discussed below, resides in an untrusted environment. In one implementation, the first memory can be local memory, and the second memory can be remote memory. In this case, the technical solution of this embodiment can be executed by the target application, which runs on a local processor. Both the local processor and local memory are in a trusted environment. When the target application performs corresponding processing operations, it may involve data exchange between the first and second memories, such as transferring data stored in the first memory to the second memory. For ease of description, the data to be transferred can be referred to as target data.

[0055] Therefore, optionally, the target data to be transmitted may be retrieved from the first memory in response to a data transmission instruction from the target application in the trusted environment.

[0056] 102: Determine the bit sequence to fill the mask pool.

[0057] In the binary number system, a bit is the symbol representing an integer less than 2. It is also called a binary digit and is the smallest unit of data storage in a computer. A binary digit can be represented as either 0 or 1. Multiple binary digits combined into a whole can represent more information. Generally speaking, eight adjacent binary digits can form a byte. A byte is a unit of measurement used in computer information to describe storage and transmission capacity and is the basic unit of computer storage.

[0058] A mask pool is a memory region located in a trusted environment. In one implementation, the mask pool can be local memory. The size of the mask pool is configurable, and it can be pre-filled with a bit sequence formed by multiple bits. Specific implementation details will be described in subsequent embodiments.

[0059] 103: Generate at least one offset, and based on at least one offset, obtain at least one bit string from the mask pool that has the same data size as the target data.

[0060] In this embodiment, the offset can refer to a specific position in the mask pool or a position relative to the base address of the mask pool. In this case, the offset can be used to calculate the actual position.

[0061] A bit string is composed of multiple consecutive binary bits. A bit string has a length, which is the number of bits in the string.

[0062] Specifically, the generated offset can refer to the position of the bit string in the mask pool used for masking the target data. The offset can be generated randomly, for example, at least one random number can be generated from 0 to s-1, where s represents the size of the mask pool. Of course, there are other ways to generate the offset, which will be described in subsequent embodiments.

[0063] Based on at least one generated offset, at least one bit string with the same size as the target data can be obtained from the mask pool. The length of the bit string can be determined based on the target data size, following the conversion relationship of 1k = 1024 bytes = 8192 bits. Specifically, for any offset generated from the target data, the bit at the corresponding position in the mask pool is used as the first bit of the bit string, and starting from this first bit, a bit string of length corresponding to the target data size is selected. For example, if the target data size is 64 bytes and the generated offset is 100, a bit string of length 512 can be selected starting from the 100th bit in the mask pool.

[0064] In practical applications, the number of bit strings obtained from the mask pool is consistent with the number of generated offsets, and each bit string has the same length, corresponding to the size of the target data. For example, if the target data size is 32 bytes, and the generated offsets are 27, 58, and 140, then a bit string of length 256 can be selected starting from the 27th bit, starting from the 58th bit, and starting from the 140th bit. When obtaining multiple bit strings, some bits may overlap.

[0065] 104: Mask the target data using at least one bit string to generate encrypted data.

[0066] Masking refers to performing bitwise operations on one piece of data with another to prevent the original data from being exposed during processing, transmission, and storage. It is a technique used to protect data privacy and security. For example, encrypted data can be generated by performing a bitwise XOR operation on the target data using a bit string. Alternatively, other implementation methods can be used, which will be described in subsequent embodiments.

[0067] 105: Send the encrypted data to the second memory.

[0068] In this embodiment, before transferring the target data from the first memory located in the trusted environment to the second memory located in the untrusted environment, encrypted data is generated by performing a masking operation on it using at least one bit string obtained from the mask pool located in the trusted environment. The encrypted data is then transferred to the second memory, improving the security of data transfer and storage between different types of memory in a heterogeneous memory architecture. Furthermore, the mask pool is filled with bit sequences, and the bit string obtained from the mask pool for masking operations is at least one bit string with the same size as the target data. Therefore, masking operations can be performed on target data of any size, meeting the processing requirements for small-sized data in a heterogeneous memory architecture and improving the flexibility of data encryption.

[0069] In one implementation, the first memory and the mask pool can be local memory, and the second memory can be remote memory. In this case, the technical solution of this embodiment can be executed by the target application, which runs on a local processor, and both the local processor and the local memory are trusted environments. In response to the processing request of the target application, the target data to be transmitted can be obtained from the local first memory, the bit sequence filled in the mask pool can be determined, at least one offset can be generated, and based on the at least one offset, at least one bit string of the same size as the target data can be obtained from the mask pool. The target data is then masked using the at least one bit string to generate encrypted data. Afterwards, the encrypted data can be sent to the remote memory using the local device manager.

[0070] Encrypted data is generated by masking the target data using at least one bit string obtained from a local mask pool. This encrypted data is then transmitted to remote memory, improving the security of data transfer and storage between local and remote memory in heterogeneous memory architectures. Furthermore, the local mask pool is filled with bit sequences, and the bit string obtained from the mask pool for masking is at least one bit string of the same size as the target data. Therefore, masking operations can be performed on target data of any size, meeting the processing needs of small-sized data in heterogeneous memory architectures and improving the flexibility of data encryption.

[0071] In practical applications, the encrypted data in the second memory may also be read back to a trusted environment, where it can be decrypted and then processed accordingly, such as being stored in the first memory. To enable decryption after the encrypted data is transmitted back to the trusted environment, the offset corresponding to the bit string used for encryption can also be recorded and stored. Therefore, in some embodiments, the above method may further include:

[0072] A first mapping relationship between encrypted data and at least one offset is maintained. This first mapping relationship can be used to determine at least one offset corresponding to the encrypted data when the encrypted data is retrieved from a second memory; the at least one offset can be used to retrieve at least one corresponding bit string from a mask pool, and the at least one bit string can be used to decrypt the encrypted data to obtain the target data.

[0073] Specifically, it can be a first mapping relationship between the address (or identifier) ​​of encrypted data in the second memory and at least one offset, such as storing it in the form of an array, and this application does not limit it in this way.

[0074] The first mapping relationship can be stored in the first memory or in the third memory located in the trusted execution environment. The third memory is different from the first memory and the mask pool, and this application does not impose any restrictions on it.

[0075] By storing a first mapping relationship between encrypted data and at least one offset, it is possible to determine at least one corresponding offset based on the first mapping relationship after obtaining encryption from the second memory, and then search for at least one bit string used by the mask in the mask pool according to the at least one offset, thereby decrypting the encrypted data and obtaining the target data, which improves the integrity of data transmission and storage between different types of memory in heterogeneous memory architecture.

[0076] In practical applications, if the target data is transferred to memory in an untrusted environment again, the process can return to the step of generating at least one offset and continue execution. That is, in this embodiment, at least one offset is dynamically generated during encryption, and the bit string used for masking the target data is a one-time operation. When the encrypted data is transferred back to the trusted environment, decrypted, and stored back in the first memory, if the target data needs to be transferred to memory in an untrusted environment again, the process will continue according to the step of generating at least one offset. That is, at least one offset is regenerated, and the bit string is obtained based on the regenerated offset for masking to generate encrypted data. This ensures that comparison information from multiple encrypted data transfers cannot be obtained, avoiding guessing the original target data based on comparison information and further improving data transmission security.

[0077] In practical applications, to reduce the memory footprint of mapping relationships, there are other methods for generating offsets and storing mapping relationships. These are explained below.

[0078] In some embodiments, a method for generating at least one offset may include:

[0079] Based on the size of the target data, determine the target category size corresponding to the target data; find the target group corresponding to the target category size; select unassigned target index identifiers from multiple index identifiers corresponding to the target group and assign them to the target data; wherein, multiple index identifiers are generated according to a predetermined size threshold and the target category size; based on the target index identifier, at least one starting offset of the target group in the mask pool, and the target category size, determine at least one offset corresponding to the target data in the mask pool;

[0080] The above methods may also include:

[0081] The system stores a second mapping relationship between encrypted data and target block identifiers and target index identifiers, and a third mapping relationship between the target block identifier and at least one starting offset. The second mapping relationship can be used to determine the target block corresponding to the encrypted data and the target index identifier allocated within the target block when encrypted data is retrieved from the second memory. The third mapping relationship can be used to determine at least one offset corresponding to the target data in the mask pool based on at least one starting offset corresponding to the target block in the mask pool, the target index identifier corresponding to the target data, and the target category size of the target block. At least one offset can be used to retrieve at least one corresponding bit string from the mask pool, and this bit string can be used to decrypt the encrypted data to obtain the target data.

[0082] In this embodiment, target data of the same size category can be grouped together. The offset of the target data can be determined according to its index identifier in the group. Thus, the mapping relationship between the target data and the group and the index identifier in the group can be saved to realize the lookup of offset and bit string, without having to save the mapping relationship between the target data and the offset for a single target data.

[0083] Specifically, the size of the target category corresponding to the target data can be the same as or larger than the size of the target data. For example, if the size of the target data is 1k, the size of the corresponding target category is also 1k, or if the size of the target data is 0.9k, the size of the corresponding target category is also 1k. This can be set according to actual needs.

[0084] Based on the target category size, the corresponding target group can be found. Each target group can include multiple index identifiers to assign to multiple target data belonging to that target category size. These multiple index identifiers are generated when the target group is created, based on a predetermined size threshold for the target group and the target category size. Specifically, the product of the predetermined size threshold and the target category size can be used as the number of index identifiers, for example, denoted by 't'. 't' consecutive values ​​can be selected as index identifiers, such as 0, 1, 2, ..., t-1. For instance, if the predetermined size threshold is 10k and the target category size is 1k, then 10 index identifiers can be generated, namely 0, 1, 2, ..., 9.

[0085] After locating the corresponding target group, unassigned target index identifiers can be selected from the target group and assigned to the target data. Specifically, the unassigned target index identifiers can be determined based on the mapping relationship between the assigned index identifiers and the data. For example, if index identifiers 0 and 1 have already been assigned to other data, index identifier 2 can be used as the target index identifier and assigned to the target data.

[0086] Based on the assigned target index identifier, at least one starting offset of the target group in the mask pool, and the target category size, at least one offset corresponding to the target data in the mask pool can be determined. The starting offset can refer to the offset corresponding to the first index identifier in the target group within the mask pool. The starting offset can be randomly generated when the target group is created. For example, if the randomly generated starting offsets during target group creation are 20, 87, and 130, then the offsets corresponding to the first index identifier in the target group in the mask pool are 20, 87, and 130, respectively. In other words, the data in the target group assigned with the first index identifier will have offsets of 20, 87, and 130 in the mask pool.

[0087] For target data assigned a target index identifier, its offset can be calculated based on the starting offset, target category size, and target index identifier. There are multiple implementation methods, which will be described in subsequent embodiments. Based on at least one determined offset, at least one bit string with the same data size as the target data can be obtained from the mask pool. Masking operations are then performed using this at least one bit string to generate encrypted data, which will not be elaborated further.

[0088] It can also store a second mapping relationship between the address (or identifier) ​​of the encrypted data in the second memory and the target group identifier and the target index identifier, and a third mapping relationship between the target group identifier and at least one starting offset. This mapping can also be stored in array form without restriction. For example, the second mapping relationship can be (address, group_id, group_index), where address represents the address of the encrypted data in the second memory, group_id represents the target group identifier, and group_index represents the target index identifier. The third mapping relationship can be (group_id, k1, k2, ..., kj), where k1, k2, ..., kj represent j starting offsets.

[0089] The second and third mapping relationships can be stored in the first memory, or in the third or fourth memory within a trusted execution environment. The third and fourth memory differ from the first memory and the mask pool, and this application does not impose any restrictions on them.

[0090] By employing a grouping approach, the target category size corresponding to the target data size is determined, and the target group corresponding to the target category size is located. Unassigned target index identifiers within the target group are assigned to the target data. Based on this target index identifier, at least one starting offset of the target group in the mask pool, and the target category size, at least one offset corresponding to the target data is determined. This implementation ensures that at least one bit string can be retrieved from the mask pool for masking based on the offset, improving the security of data transfer and storage between different types of memory in heterogeneous memory architectures. Furthermore, the bit string retrieved from the mask pool for masking operations still enables masking operations on target data of any size, meeting the processing needs of small-sized data in heterogeneous memory architectures and improving the flexibility of data encryption. Furthermore, since the starting offset of the target group corresponding to the target data is randomly generated, and the target index identifier within the target group is also dynamically determined during the encryption process, the offset of the target data is also dynamically determined during encryption. This ensures that the bit string used for masking the target data is a one-time operation. Each time the target data is encrypted, the offset is redefined, and the bit string is obtained based on the redefined offset to perform masking operations and generate encrypted data. This ensures that comparison information from multiple encrypted data sessions cannot be obtained, avoiding guessing the original target data based on comparison information, and further improving the security of data transmission and storage. Based on this, by storing only the second mapping relationship between the encrypted data and the target group identifier and the target index identifier for a single encrypted data session, and the third mapping relationship between the target group identifier and at least one starting offset for each target group, it is possible to find the offset corresponding to the encrypted data and the bit string used for the mask during decryption. This eliminates the need to store the mapping relationship between a single encrypted data session and at least one offset, reducing the memory occupied by the mapping relationship and lowering memory resource overhead.

[0091] To further reduce the memory occupied by the mapping relationship, in some embodiments, the method for storing the second mapping relationship between encrypted data, target block identifier, and target index identifier may include:

[0092] The second mapping relationship between the encrypted data and the target packet identifier and the target index identifier is sent to the second memory.

[0093] The second mapping relationship can be used as metadata for the encrypted data and appended to the encrypted data, for example, by adding it to a preset field of the encrypted data and sending it to the second memory along with the encrypted data.

[0094] The third mapping relationship is still stored in the first memory, or in the third or fourth memory of a trusted environment. Since the second mapping relationship does not record the offset information corresponding to the encrypted data, even if it is transmitted to an untrusted environment, there is no risk of offset leakage, thus ensuring data security.

[0095] By sending the second mapping relationship to the second memory for storage, the memory occupied by the mapping relationship can be further reduced, thus lowering memory resource overhead, while ensuring the security of data transmission and storage.

[0096] In practical applications, besides the method for determining the target category size described in the above embodiments, other implementation methods are also possible. In some embodiments, the method for determining the target category size corresponding to the target data based on the data size of the target data may include:

[0097] Determine the range of values ​​defined by the two consecutive powers of 2 as endpoints; use the right endpoint of the range of values ​​corresponding to the size of the target data as the target category size.

[0098] The numerical range can be (2) n ,2 n+1 ), where n is an integer. For example, the target data size is 500 bytes, the corresponding numerical range is (256, 512), and the corresponding target category size is 512 bytes.

[0099] By defining a numerical range consisting of two consecutive integer powers of 2 as endpoints, and taking the right endpoint of the numerical range corresponding to the size of the target data as the size of the target category, the size of the target category corresponding to the target data can be accurately determined.

[0100] In some embodiments, when searching for the target group corresponding to the target category size, the method may include:

[0101] If there is no target group corresponding to the target category size, or if there is no unassigned index identifier in the target group, create a target group corresponding to the target category size and determine at least one starting offset corresponding to the target group in the mask pool; generate multiple index identifiers corresponding to the target group according to the target category size and a predetermined size threshold; use the index identifier of at least one starting offset as the target index identifier for the target data, and use at least one starting offset as at least one offset corresponding to the target data in the mask pool.

[0102] In this embodiment, after determining the target category size corresponding to the target data, it is possible to first check whether a corresponding group has been created and whether there are unassigned index identifiers in the group. If so, the group can be directly used as the target group, and the unassigned index identifiers can be selected and assigned to the target data.

[0103] If no target group exists, a target group with the same size as the target category needs to be created. Specifically, at least one starting offset corresponding to the target group in the mask pool can be randomly generated, and a predetermined size threshold for the target group can be determined. The number of starting offsets and the predetermined size threshold can be set according to actual needs. Based on the predetermined size threshold and the target category size, multiple index identifiers corresponding to the target group can be generated. Specifically, the product of the predetermined size threshold and the target category size is used as the number of index identifiers, and this number of consecutive values ​​are selected as index identifiers. Furthermore, the first index identifier, i.e., the index identifier of the starting offset of the target group, can be used as the target index identifier for the target data allocation, and at least one starting offset can be used as at least one offset corresponding to the target data in the mask pool.

[0104] By first checking whether a group corresponding to the target category size has already been created and whether there is an unassigned index identifier in the group, if it exists, the group is directly used as the target group and the target index identifier is assigned. If it does not exist, the target group is created and the target index identifier is assigned, thereby improving the efficiency of determining the target group and thus improving the efficiency of determining the offset.

[0105] After assigning the target index identifier to the target data, at least one offset of the target data in the mask pool can be calculated, which can be done in various ways.

[0106] As an optional implementation, for any starting offset of the target group in the mask pool, the difference between the target index identifier and the first index identifier can be multiplied by the target category size to obtain the product value. This product value is then summed with the starting offset to obtain the corresponding offset of the target data in the mask pool. The offset can be calculated using the formula k + (i - i') * c, where k represents the starting offset of the target group, i represents the target index identifier, i' represents the first index identifier, and c represents the target category size.

[0107] As an alternative implementation, for any starting offset of the target group in the mask pool, the product of the target index and the target category size can be added to the starting offset to obtain the offset of the target data in the mask pool. In this case, the first index of the target group is 0. The offset can be calculated using the formula k + i * c, where k represents the starting offset of the target group, i represents the target index, and c represents the target category size. For example, if the starting offsets of the target groups in the mask pool are 20, 87, and 130, the target index is 2, and the target category size is 64 bytes, then for a starting offset of 20, the offset of the target data in the mask pool is 20 + 2 * 64 * 8 = 1044. For a starting offset of 87, the offset of the target data in the mask pool is 87 + 2 * 64 * 8 = 1111. For a starting offset of 130, the offset of the target data in the mask pool is 130 + 2 * 64 * 8 = 1154. Therefore, the offsets of the target data in the mask pool can be obtained as 1044, 1111, and 1154, respectively.

[0108] This allows for the accurate determination of the offset of the target data, while reducing the offset calculation process and improving the efficiency of offset calculation.

[0109] The process of filling the mask pool with a bit sequence is described below. In some embodiments, the above method may further include:

[0110] Configure a mask pool of a predetermined size; randomly generate the first byte of data according to the predetermined size; fill the mask pool with the bit sequence corresponding to the first byte of data.

[0111] A byte is a unit of measurement used in computer information processing to describe storage and transmission capacity; it is the basic unit of computer storage. Typically, one byte can consist of eight adjacent binary bits.

[0112] The predetermined size of the mask pool can be set according to actual needs. Based on this predetermined size, a first byte of data with the same predetermined size can be randomly generated. In this embodiment, the first byte of data can be randomly generated during the initialization of the mask pool, and the bit sequence corresponding to the first byte of data can be filled into the mask pool.

[0113] By configuring a mask pool of a predetermined size according to actual needs and randomly generating a first byte of data of the same size, the bit sequence corresponding to the first byte of data is filled into the mask pool to realize the filling configuration of the bit sequence in the mask pool. On this basis, at least one bit string with the same size as the target data can be obtained from the mask pool for masking operations, thereby realizing masking operations on target data of any size, meeting the processing needs of small data in heterogeneous memory architecture, improving the security of data transmission and storage, and the flexibility of data encryption.

[0114] To further enhance the security of data transmission and storage, the bit sequence filled in the mask pool can also be updated. Therefore, in some embodiments, the above method may further include:

[0115] At predetermined time intervals, multiple encrypted data generated by masking operations using bit strings provided by a mask pool are retrieved from the second memory; based on the first mapping relationship corresponding to each of the multiple encrypted data, at least one offset corresponding to each of the multiple encrypted data is determined; at least one bit string corresponding to each of the multiple encrypted data is retrieved from the mask pool using the at least one offset corresponding to each of the multiple encrypted data; the multiple encrypted data are decrypted using the at least one bit string corresponding to each of the multiple encrypted data to obtain multiple target data; a second byte of data is randomly generated; the mask pool is updated using the bit sequence of the second byte of data; for any target data among the multiple target data, the step of generating at least one offset is returned to continue execution.

[0116] In this embodiment, the bit sequence filled in the mask pool can be updated at predetermined intervals. The predetermined intervals can be set according to actual needs. Before updating, multiple encrypted data items encrypted using bit strings provided by the mask pool and not yet decrypted can be retrieved from the second memory. Based on the first mapping relationship corresponding to each of the multiple encrypted data items, or based on the second and third mapping relationships corresponding to each of the multiple encrypted data items, at least one offset corresponding to each of the multiple encrypted data items is determined. Based on the offsets, at least one bit string corresponding to each of the multiple encrypted data items is obtained from the mask pool to perform decryption operations on the multiple encrypted data items, obtaining multiple target data items, which are then stored back in the first memory. According to the predetermined size of the mask pool, second byte data is randomly generated, and the bit sequence corresponding to this second byte data is used to update the mask pool.

[0117] After the mask pool is updated, the updated bit sequence can be used to re-encrypt the target data. In other words, for any one of the multiple target data sets, the step of generating at least one offset is returned to continue execution.

[0118] By updating the bit sequence filled in the mask pool at predetermined time intervals, the security of data transmission and storage is further improved, avoiding the occurrence of many overlapping fields in the bit string used for masking during long-term encryption, which would lead to guessing the original target data based on multiple mask results.

[0119] To further enhance the security of data transmission and storage, multiple bit strings can be used for masking operations. In some embodiments, a method for masking target data using at least one bit string to generate encrypted data may include:

[0120] Multiple rounds of masking operations are performed on the target data using multiple bit strings to generate encrypted data. The masking result of the previous round of masking operation is used as the data to be masked in the next round of masking operation.

[0121] In this embodiment, multiple offsets can be generated. Therefore, when multiple bit strings are obtained from the mask pool, these multiple bit strings can be used to perform multiple masking operations on the target data to generate encrypted data. Specifically, each round of masking can select one bit string, and the masking result of the previous round can be used as the data to be masked in the next round. The number of masking rounds can be the same as the number of bit strings.

[0122] By using multiple bit strings to perform multiple rounds of masking operations on the target data, and selecting one bit string for each round of masking, the masking result of the previous round of masking operation is used as the data to be masked in the next round of masking operation. This avoids the occurrence of many overlapping fields in the bit strings of different target data masks during the process of selecting a single bit string for masking, which would lead to guessing the original target data based on the masking results of different target data, and further improves the security of data transmission and storage.

[0123] In some embodiments, a method for generating encrypted data by performing multiple rounds of masking operations on target data using multiple bit strings may include:

[0124] The target data is encrypted and transformed to obtain the transformed data. The transformed data is masked using the first bit string to obtain the first round of masking results. The following operations are performed iteratively: the masking results of the previous round are encrypted and transformed to obtain the transformation results of the next round. The transformation results of the next round are masked using the next bit string to obtain the masking results of the next round. The masking results of the last round are used as the encrypted data.

[0125] In this embodiment, a preset encryption algorithm can be used to encrypt and transform the target data before masking to obtain transformed data. The first bit string is used to mask the transformed data to obtain the first round of masking results. The process of encrypting and transforming the previous round of masking results to obtain the next round of transformation results, and then using the next bit string to mask the transformation results to obtain the next round of masking results is iterated until the last bit string is used to mask the data to obtain the final round of masking results. The final round of masking results is then used as the encrypted data.

[0126] Optionally, the preset encryption algorithm can be the Rijndael encryption algorithm (a basic cryptographic algorithm used in the Advanced Encryption Standard (AES)). Specifically, the target data can be represented in matrix form, and each round of encryption transformation and masking can be implemented as follows: byte substitution is performed on the data to be transformed using a preset nonlinear substitution table, where the nonlinear substitution table can be implemented, for example, as a Rijndael S-box (a nonlinear substitution table used in the Rijndael encryption algorithm; the S-box is a basic component in cryptography used to perform substitution operations, designed to increase the complexity of the encryption process and resist linear and differential attacks). In the first round of encryption transformation and masking, the target data is the data to be transformed; the byte-substituted data to be transformed undergoes a row shift transformation; the row-shifted data to be transformed undergoes a column mixing transformation to obtain the transformation result; and the transformation result is XORed using a bit string to obtain the masking result.

[0127] By combining a preset encryption algorithm, encryption transformation is performed first before masking, and then the transformation result is masked using a bit string. This process involves multiple rounds of encryption transformation and masking, which further improves the security of data transmission and storage.

[0128] like Figure 2 The diagram shown is a flowchart of another embodiment of a data transmission method provided in this application, which may include the following steps.

[0129] 201: Retrieve encrypted data from the second memory.

[0130] This embodiment specifically involves transferring encrypted data from a second memory to a first memory. The first memory and the mask pool described below are located in a trusted environment, while the second memory is located in an untrusted environment. The encrypted data can be generated by masking target data in the first memory using at least one bit string, where the at least one bit string is obtained from the mask pool based on at least one offset. The encryption process is as follows: Figure 1 The embodiments shown have been described in detail and will not be repeated here.

[0131] 202: Determine at least one offset corresponding to the encrypted data, and based on at least one offset, obtain at least one corresponding bit string from the mask pool.

[0132] In this case, the offset corresponding to the encrypted data can be determined based on the saved mapping relationship between the offset and the data, which will be explained in subsequent embodiments.

[0133] 203: Use at least one bit string to decrypt the encrypted data to obtain the target data.

[0134] Decryption can be performed using a decryption operation corresponding to the encryption operation. For example, if the encryption operation involves performing a bitwise XOR operation on the target data using a bit string, then the decryption operation can be performed by performing a bitwise XOR operation on the encrypted data using the same bit string to obtain the target data. Alternatively, if encryption is implemented using other encryption operations, the corresponding decryption operation can also be used, as will be explained in subsequent embodiments.

[0135] In practical applications, after obtaining the target data, it can be stored in a trusted environment, such as stored back in the primary memory or other memory in the trusted environment, or the target data can be processed according to actual needs, without any restrictions.

[0136] In this embodiment, the encrypted data obtained from the second memory located in the untrusted environment is generated by masking the target data in the first memory using at least one bit string. This at least one bit string is obtained from a mask pool based on at least one offset. Therefore, after the encrypted data is obtained into the trusted environment, at least one offset corresponding to the encrypted data can be determined. The at least one bit string used for masking is then obtained from the mask pool, and this at least one bit string is used to decrypt the encrypted data to obtain the target data. This achieves secure transmission and storage of data between different types of memory in a heterogeneous memory architecture. Furthermore, the at least one bit string obtained from the mask pool for masking is the same size as the target data, thus enabling masking operations on target data of any size. This meets the processing requirements for small-sized data in a heterogeneous memory architecture and improves the flexibility of data encryption and decryption.

[0137] In practical applications, after encryption is completed, the offsets corresponding to the bit strings used for encryption are usually recorded and stored, that is, the initial mapping relationship between encrypted data and at least one offset is saved. Therefore, in some embodiments, the method for determining at least one offset corresponding to encrypted data and obtaining at least one corresponding bit string from the mask pool based on at least one offset may include:

[0138] Obtain a first mapping relationship between encrypted data and at least one offset; based on the first mapping relationship, determine at least one offset corresponding to the encrypted data; based on the at least one offset, obtain at least one corresponding bit string from a mask pool. The first mapping relationship can be obtained from memory stored in a trusted environment.

[0139] By obtaining a first mapping relationship between encrypted data and at least one offset, it is possible to determine the corresponding at least one offset based on the first mapping relationship, and then find at least one bit string used by the mask in the mask pool according to the at least one offset, thereby decrypting the encrypted data and obtaining the target data, which improves the integrity of data transmission and storage between different types of memory in heterogeneous memory architecture.

[0140] When determining the offset using a grouping method, what is stored is a second mapping relationship between the encrypted data and the target group identifier and the target index identifier, and a third mapping relationship between the target group identifier and at least one starting offset. Therefore, in some embodiments, the method for determining at least one offset corresponding to the encrypted data and obtaining at least one corresponding bit string from the mask pool based on at least one offset may include:

[0141] Obtain a second mapping relationship between encrypted data and target block identifier and target index identifier, and a third mapping relationship between target block identifier and at least one starting offset; wherein, the target block is determined based on the target category size corresponding to the data size of the target data, the target index identifier is assigned to the target data by the target block, and at least one starting offset is at least one starting offset of the target block in the mask pool; based on the second mapping relationship, determine the target block corresponding to the encrypted data and the target index identifier assigned in the target block; based on the third mapping relationship, determine at least one starting offset of the target block in the mask pool; based on at least one starting offset, target index identifier, and target category size, determine at least one offset of the target data in the mask pool; based on at least one offset, obtain at least one corresponding bit string from the mask pool.

[0142] This can be achieved by retrieving the second and third mapping relationships from memory stored in a trusted environment.

[0143] Optionally, if the second mapping relationship is appended to the encrypted data as metadata and sent together with the encrypted data to a second memory storage location, the second mapping relationship can be retrieved from the encrypted data, for example, from a preset field of the encrypted data. Additionally, the third mapping relationship can be retrieved from memory stored in a trusted environment.

[0144] By using the second and third mapping relationships, the offset corresponding to the encrypted data and the bit string used in the mask can be found, thereby decrypting the encrypted data and obtaining the target data. This improves the integrity of data transmission and storage between different types of memory in a heterogeneous memory architecture. Furthermore, it eliminates the need to store a mapping relationship between a single encrypted data and at least one offset, reducing the memory occupied by the mapping relationship and lowering memory resource overhead.

[0145] In practical applications, multiple rounds of masking operations can be performed on the target data using multiple bit strings to generate encrypted data. Therefore, in some embodiments, a method for decrypting encrypted data using at least one bit string to obtain the target data may include:

[0146] Multiple rounds of decryption operations are performed on encrypted data using multiple bit strings to obtain the target data. The decryption result of the previous round serves as the data to be decrypted in the next round.

[0147] Specifically, multi-round masking operations can be multi-round XOR operations. Correspondingly, during decryption, the same bit string can be used to perform the same XOR operation on the data to be decrypted to obtain the decryption result.

[0148] Encryption is achieved by using multiple bit strings to perform multiple rounds of masking operations on the target data, and decryption is achieved by using multiple bit strings to perform multiple rounds of decryption operations on the encrypted data. This avoids the problem of too many overlapping fields in the bit strings of different target data masks when selecting a single bit string for masking, which would lead to guessing the original target data based on the masking results of different target data, thus further improving the security of data transmission and storage.

[0149] When generating encrypted data by combining a preset encryption algorithm and masking, multiple rounds of decryption operations are performed on the encrypted data using multiple bit strings to obtain the target data, which may include:

[0150] The encrypted data is decrypted using the last bit string to obtain the decryption result; the decryption result is then inversely transformed to obtain the first round of transformation result, and the following operations are performed iteratively: the previous round of transformation result is decrypted using the previous bit string to obtain the next round of decryption result; the previous round of decryption result is then inversely transformed to obtain the next round of transformation result; the final round of transformation result is used as the target data.

[0151] Optionally, when the default encryption algorithm is Rijndael, the corresponding decryption algorithm can be used to perform an inverse transformation to obtain the transformation result. When performing an XOR operation on the transformation result using a bit string, the same bit string can be XORed again to obtain the decryption result.

[0152] By combining a preset encryption algorithm, encryption transformation is performed first before masking, and then the transformation result is masked using a bit string. Multiple rounds of encryption transformation and masking are performed, and decryption is performed using the decryption algorithm corresponding to the preset encryption algorithm and the same bit string. Multiple rounds of decryption operations and inverse transformations are performed, which further improves the security of data transmission and storage.

[0153] like Figure 3 The diagram shown is a flowchart of an embodiment of a data encryption method provided in this application. The method may include the following steps.

[0154] 301: In response to the first data transmission command, determine the target data.

[0155] In this embodiment, the target data to be transmitted may be determined in response to a first data transmission instruction from a target application in a trusted environment. Specifically, the target data to be transmitted may be retrieved from a first memory located in the trusted environment. In one implementation, the first memory may be local memory.

[0156] 302: Generate at least one offset.

[0157] The method of generating the offset is as follows: Figure 1 The embodiments shown have been described in detail and will not be repeated here.

[0158] 303: Based on at least one offset, obtain at least one bit string from the mask pool that has the same data size as the target data.

[0159] In this embodiment, the mask pool is a memory region located in a trusted environment, and the mask pool stores bit sequences. In one implementation, the mask pool can be local memory.

[0160] 304: Masks the target data using at least one bit string to generate encrypted data.

[0161] The encryption process is in Figure 1 The embodiments shown have been described in detail and will not be repeated here.

[0162] In practical applications, after obtaining encrypted data, the encrypted data can be transferred to a second memory in an untrusted environment, enabling secure data transfer and storage between different types of memory. In one implementation, the second memory can be remote memory.

[0163] In this embodiment, in response to a first data transmission instruction, target data can be determined and at least one offset can be generated. Based on the at least one offset, at least one bit string of the same size as the target data is obtained from a mask pool to perform a masking operation on the target data, thereby generating encrypted data. This achieves encryption of the target data, enabling the encrypted data to be transmitted to memory in an untrusted environment, improving the security of data transmission and storage between different types of memory in a heterogeneous memory architecture. Furthermore, the mask pool stores bit sequences, and the bit string obtained from the mask pool for masking operations is at least one bit string of the same size as the target data. Therefore, it is possible to encrypt target data of any size, meeting the processing needs of small-sized data in a heterogeneous memory architecture and improving the flexibility of data encryption.

[0164] In some embodiments, the above method may further include:

[0165] A first mapping relationship between encrypted data and at least one offset is maintained. This first mapping relationship can be used to determine at least one offset corresponding to the encrypted data, and the at least one offset can be used to obtain at least one corresponding bit string from a mask pool. The at least one bit string can be used to decrypt the encrypted data to obtain the target data.

[0166] In some embodiments, a method for generating at least one offset may include:

[0167] Based on the size of the target data, determine the target category size corresponding to the target data; find the target group corresponding to the target category size; select unassigned target index identifiers from multiple index identifiers corresponding to the target group and assign them to the target data; wherein, multiple index identifiers are generated according to a predetermined size threshold and the target category size; based on the target index identifier, at least one starting offset of the target group in the mask pool, and the target category size, determine at least one offset corresponding to the target data in the mask pool;

[0168] The above methods may also include:

[0169] The system stores a second mapping relationship between encrypted data and target block identifiers and target index identifiers, and a third mapping relationship between the target block identifier and at least one starting offset. The second mapping relationship can be used to determine the target block corresponding to the encrypted data and the target index identifier allocated within the target block. The third mapping relationship can be used to determine at least one offset corresponding to the target data in the mask pool based on at least one starting offset corresponding to the target block in the mask pool, the target index identifier corresponding to the target data, and the target category size of the target block. At least one offset can be used to obtain at least one corresponding bit string from the mask pool, and at least one bit string can be used to decrypt the encrypted data to obtain the target data.

[0170] In some embodiments, the method for storing the second mapping relationship between encrypted data and target block identifier and target index identifier may include:

[0171] The second mapping relationship between the encrypted data and the target packet identifier and the target index identifier is sent to the second memory.

[0172] In some embodiments, the method for determining the target category size corresponding to the target data based on the data size of the target data may include:

[0173] Determine the range of values ​​defined by the two consecutive powers of 2 as endpoints; use the right endpoint of the range of values ​​corresponding to the size of the target data as the target category size.

[0174] In some embodiments, when searching for the target group corresponding to the target category size, the method may include:

[0175] If there is no target group corresponding to the target category size, or if there is no unassigned index identifier in the target group, create a target group corresponding to the target category size and determine at least one starting offset corresponding to the target group in the mask pool; generate multiple index identifiers corresponding to the target group according to the target category size and a predetermined size threshold; use the index identifier of at least one starting offset as the target index identifier for the target data, and use at least one starting offset as at least one offset corresponding to the target data in the mask pool.

[0176] In some embodiments, calculating at least one offset of the target data in the mask pool can be implemented in various ways.

[0177] As an optional implementation, for any starting offset of the target group in the mask pool, the difference between the target index identifier and the first index identifier can be multiplied by the target category size to obtain the product value. The product value can then be summed with the starting offset to obtain the offset of the target data in the mask pool.

[0178] As an alternative implementation, for any starting offset of the target group in the mask pool, the product of the target index identifier and the target category size can be added to the starting offset to obtain the offset of the target data in the mask pool. At this time, the first index identifier in the target group is 0.

[0179] In some embodiments, the above method may further include:

[0180] Configure a mask pool of a predetermined size; randomly generate the first byte of data according to the predetermined size; fill the mask pool with the bit sequence corresponding to the first byte of data.

[0181] In some embodiments, the above method may further include:

[0182] At predetermined time intervals, multiple encrypted data generated by masking operations using bit strings provided by a mask pool are retrieved from the second memory; based on the first mapping relationship corresponding to each of the multiple encrypted data, at least one offset corresponding to each of the multiple encrypted data is determined; at least one bit string corresponding to each of the multiple encrypted data is retrieved from the mask pool using the at least one offset corresponding to each of the multiple encrypted data; the multiple encrypted data are decrypted using the at least one bit string corresponding to each of the multiple encrypted data to obtain multiple target data; a second byte of data is randomly generated; the mask pool is updated using the bit sequence of the second byte of data; for any target data among the multiple target data, the step of generating at least one offset is returned to continue execution.

[0183] In some embodiments, a method for masking target data using at least one bit string to generate encrypted data may include:

[0184] Multiple rounds of masking operations are performed on the target data using multiple bit strings to generate encrypted data. The masking result of the previous round of masking operation is used as the data to be masked in the next round of masking operation.

[0185] In some embodiments, a method for generating encrypted data by performing multiple rounds of masking operations on target data using multiple bit strings may include:

[0186] The target data is encrypted and transformed to obtain the transformed data. The transformed data is masked using the first bit string to obtain the first round of masking results. The following operations are performed iteratively: the masking results of the previous round are encrypted and transformed to obtain the transformation results of the next round; the transformation results are masked using the next bit string to obtain the masking results of the next round; the masking results of the last round are used as the encrypted data.

[0187] like Figure 4The diagram shown is a flowchart of an embodiment of a data decryption method provided in this application. The method may include the following steps.

[0188] 401: In response to the second data transmission command, determine the encrypted data.

[0189] In this embodiment, encrypted data may be determined in response to a second data transmission instruction from a target application in a trusted environment. The encrypted data may be generated by masking target data in a first memory using at least one bit string, where the at least one bit string is obtained from a mask pool based on at least one offset. The encryption process is performed in... Figure 1 The embodiments shown have been described in detail and will not be repeated here. The first memory and the mask pool are located in a trusted environment. In one implementation, the first memory can be local memory. Specifically, encrypted data can be obtained from a second memory in an untrusted environment. In another implementation, the second memory can be remote memory.

[0190] 402: Determine at least one offset corresponding to the encrypted data, and based on at least one offset, obtain at least one corresponding bit string from the mask pool.

[0191] In this case, the offset corresponding to the encrypted data can be determined based on the saved mapping relationship between the offset and the data, which will be explained in subsequent embodiments.

[0192] 403: The encrypted data is decrypted using at least one bit string to obtain the target data.

[0193] The decryption process is in Figure 2 The embodiments shown have been described in detail and will not be repeated here.

[0194] In practical applications, after obtaining the target data, it can be stored in a trusted environment, such as stored back in the primary memory or other memory in the trusted environment, or the target data can be processed according to actual needs, without any restrictions.

[0195] In this embodiment, in response to a second data transmission instruction, encrypted data can be determined. This encrypted data is generated by masking target data with at least one bit string. This at least one bit string is obtained from a mask pool based on at least one offset. Therefore, at least one offset corresponding to the encrypted data can be determined, and at least one bit string used for masking can be obtained from the mask pool. This at least one bit string is then used to decrypt the encrypted data to obtain the target data. This achieves decryption of the encrypted data, thereby enabling secure transmission and storage of data between different types of memory in a heterogeneous memory architecture. Furthermore, the at least one bit string obtained from the mask pool for masking is the same size as the target data. Therefore, masking operations on target data of any size can be performed, meeting the processing requirements for small-sized data in a heterogeneous memory architecture and improving the flexibility of data encryption and decryption.

[0196] In some embodiments, a method for determining at least one offset corresponding to encrypted data and obtaining at least one corresponding bit string from a mask pool based on at least one offset may include:

[0197] Obtain a first mapping relationship between encrypted data and at least one offset; based on the first mapping relationship, determine at least one offset corresponding to the encrypted data; based on at least one offset, obtain at least one corresponding bit string from the mask pool.

[0198] In some embodiments, a method for determining at least one offset corresponding to encrypted data and obtaining at least one corresponding bit string from a mask pool based on at least one offset may include:

[0199] Obtain a second mapping relationship between encrypted data and target packet identifier and target index identifier, and a third mapping relationship between target packet identifier and at least one starting offset; wherein, the target packet is determined based on the target category size corresponding to the data size of the target data, the target index identifier is assigned to the target data by the target packet, and at least one starting offset is at least one starting offset of the target packet in the mask pool; based on the second mapping relationship, determine the target packet corresponding to the encrypted data and the target index identifier assigned in the target packet; based on the third mapping relationship, determine at least one starting offset of the target packet in the mask pool; based on at least one starting offset, target index identifier, and target category size, determine at least one offset of the target data in the mask pool; based on at least one offset, obtain at least one corresponding bit string from the mask pool.

[0200] In some embodiments, a method for decrypting encrypted data using at least one bit string to obtain target data may include:

[0201] Multiple rounds of decryption operations are performed on encrypted data using multiple bit strings to obtain the target data. The decryption result of the previous round serves as the data to be decrypted in the next round.

[0202] In some embodiments, performing multiple rounds of decryption operations on encrypted data using multiple bit strings to obtain the target data may include:

[0203] The encrypted data is decrypted using the last bit string to obtain the decryption result; the decryption result is then inversely transformed to obtain the first round of transformation result, and the following operations are performed iteratively: the previous round of transformation result is decrypted using the previous bit string to obtain the next round of decryption result; the previous round of decryption result is then inversely transformed to obtain the next round of transformation result; the final round of transformation result is used as the target data.

[0204] like Figure 5 The diagram shown is a structural schematic of an embodiment of a data transmission device provided in this application. The device may include the following modules.

[0205] The first acquisition module 501 is used to acquire target data from the first memory;

[0206] The first determining module 502 is used to determine the bit sequence filled in the mask pool;

[0207] The first generation module 503 is used to generate at least one offset and, based on the at least one offset, obtain at least one bit string from the mask pool that has the same data size as the target data;

[0208] Encryption module 504 is used to mask target data using at least one bit string to generate encrypted data;

[0209] The first sending module 505 is used to send encrypted data to the second memory; wherein the first memory and the mask pool are located in a trusted environment, and the second memory is located in an untrusted environment.

[0210] The data transmission device in this embodiment can be used to implement Figure 1The data transmission method of the illustrated embodiment, before transferring target data from a first memory located in a trusted environment to a second memory located in an untrusted environment, generates encrypted data by performing a masking operation on it using at least one bit string obtained from a mask pool located in the trusted environment. The encrypted data is then transmitted to the second memory, improving the security of data transmission and storage between different types of memory in a heterogeneous memory architecture. Furthermore, the mask pool is filled with bit sequences, and the bit string obtained from the mask pool for masking operations is at least one bit string with the same size as the target data. Therefore, masking operations can be performed on target data of any size, meeting the processing requirements for small-sized data in a heterogeneous memory architecture and improving the flexibility of data encryption.

[0211] In some embodiments, the above-described apparatus may further include:

[0212] The first storage module is used to store a first mapping relationship between encrypted data and at least one offset; wherein, the first mapping relationship is used to determine at least one offset corresponding to the encrypted data when the encrypted data is obtained from the second memory; the at least one offset is used to obtain at least one corresponding bit string from the mask pool, and the at least one bit string is used to decrypt the encrypted data to obtain the target data.

[0213] In some embodiments, the above-described apparatus may further include:

[0214] The configuration module is used to configure a mask pool of a predetermined size; the second generation module is used to randomly generate the first byte of data according to the predetermined size; and the filling module is used to fill the mask pool with the bit sequence corresponding to the first byte of data.

[0215] In some embodiments, the above-described apparatus may further include:

[0216] The second acquisition module is used to acquire multiple encrypted data generated by masking operations using bit strings provided by the mask pool from the second memory at predetermined time intervals; the second determination module is used to determine at least one offset corresponding to each of the multiple encrypted data according to the first mapping relationship corresponding to each of the multiple encrypted data; the third acquisition module is used to acquire at least one bit string corresponding to each of the multiple encrypted data from the mask pool using at least one offset corresponding to each of the multiple encrypted data; the first decryption module is used to decrypt the multiple encrypted data using at least one bit string corresponding to each of the multiple encrypted data to obtain multiple target data; the third generation module is used to randomly generate second byte data; and the update module is used to update the mask pool using the bit sequence of the second byte data.

[0217] In some embodiments, the first generation module 503 may include:

[0218] The first determining unit is used to determine the target category size corresponding to the target data based on the data size of the target data; the searching unit is used to search for the target group corresponding to the target category size; the allocation unit is used to select unallocated target index identifiers from multiple index identifiers corresponding to the target group and allocate them to the target data; wherein, the multiple index identifiers are generated according to a predetermined size threshold and the target category size; the second determining unit is used to determine at least one offset corresponding to the target data in the mask pool based on the target index identifier, at least one starting offset of the target group in the mask pool, and the target category size;

[0219] The above-mentioned device may further include:

[0220] The second storage module is used to store a second mapping relationship between encrypted data and target packet identifier and target index identifier, and a third mapping relationship between target packet identifier and at least one starting offset. The second mapping relationship is used to determine the target packet corresponding to the encrypted data and the target index identifier allocated in the target packet when encrypted data is retrieved from the second memory. The third mapping relationship is used to determine at least one offset corresponding to the target data in the mask pool based on at least one starting offset corresponding to the target packet in the mask pool, the target index identifier corresponding to the target data, and the target category size of the target packet. At least one offset is used to retrieve at least one corresponding bit string from the mask pool, and the at least one bit string is used to decrypt the encrypted data to obtain the target data.

[0221] In some embodiments, the above-described apparatus may further include:

[0222] A creation module is used to create a target group corresponding to the target category size when there is no target group corresponding to the target category size, or when there is no unassigned index identifier in the target group, and to determine at least one starting offset corresponding to the target group in the mask pool; a fourth generation module is used to generate multiple index identifiers corresponding to the target group according to the target category size and a predetermined size threshold; an allocation module is used to use the index identifier of at least one starting offset as the target index identifier for the target data allocation, and to use at least one starting offset as at least one offset corresponding to the target data in the mask pool.

[0223] In some embodiments, the second storage module may be specifically used to send the second mapping relationship between encrypted data and target packet identifier and target index identifier to the second memory.

[0224] In some embodiments, the second determining unit may be specifically used to sum the product of the target index identifier and the target category size with the starting offset for any starting offset of the target group in the mask pool, so as to obtain the offset of the target data in the mask pool.

[0225] In some embodiments, the first determining unit may be specifically used to determine the numerical range formed by two adjacent positive integer powers of the value 2 as endpoints; and to take the numerical range corresponding to the data size of the target data as the target category size corresponding to the target data.

[0226] In some embodiments, the encryption module 504 can be used to perform multiple rounds of masking operations on the target data using multiple bit strings to generate encrypted data; wherein the masking result of the previous round of masking operation is used as the data to be masked in the next round of masking operation.

[0227] In some embodiments, the encryption module 504 can be specifically used to perform encryption transformation on the target data to obtain transformed data; to perform masking processing on the transformed data using the first bit string to obtain the first round of masking results, and to iteratively perform the following operations: to perform encryption transformation on the masking results of the previous round to obtain the transformation results of the next round; to perform masking processing on the transformation results using the next bit string to obtain the masking results of the next round; and to use the masking results of the last round as encrypted data.

[0228] like Figure 6 The diagram shown is a structural schematic of another embodiment of a data transmission device provided in this application. The device may include the following modules.

[0229] The fourth acquisition module 601 is used to acquire encrypted data from the second memory; the encrypted data is generated by masking the target data with at least one bit string, and the at least one bit string is acquired from the mask pool based on at least one offset corresponding to the target data in the mask pool;

[0230] The third determining module 602 is used to determine at least one offset corresponding to the encrypted data, and to obtain at least one corresponding bit string from the mask pool based on the at least one offset;

[0231] The second decryption module 603 is used to decrypt encrypted data using at least one bit string to obtain the target data;

[0232] The first memory and mask pool are located in a trusted environment, while the second memory is located in an untrusted environment.

[0233] The data transmission device in this embodiment can be used to implement Figure 2The data transmission method of the illustrated embodiment involves obtaining encrypted data from a second memory located in an untrusted environment. This encrypted data is generated by masking the target data using at least one bit string. This at least one bit string is obtained from a mask pool based on at least one offset corresponding to the target data in a mask pool located in a trusted environment. Therefore, after obtaining the encrypted data into the trusted environment, at least one offset corresponding to the encrypted data can be determined. The at least one bit string used for masking is then obtained from the mask pool, and this at least one bit string is used to decrypt the encrypted data to obtain the target data. This achieves secure transmission and storage of data between different types of memory in a heterogeneous memory architecture. Furthermore, the at least one bit string obtained from the mask pool for masking is the same size as the target data. Therefore, masking operations on target data of any size can be performed, meeting the processing requirements for small-sized data in a heterogeneous memory architecture and improving the flexibility of data encryption and decryption.

[0234] In some embodiments, the third determining module 602 may be specifically used to obtain a second mapping relationship between encrypted data and target packet identifier and target index identifier, and a third mapping relationship between target packet identifier and at least one starting offset; based on the second mapping relationship, determine the target packet corresponding to the encrypted data and the target index identifier allocated in the target packet; based on the third mapping relationship, determine at least one starting offset of the target packet in the mask pool; based on at least one starting offset, target index identifier and target category size, determine at least one offset of the target data in the mask pool; based on at least one offset, obtain at least one corresponding bit string from the mask pool.

[0235] In some embodiments, the second decryption module 603 can be specifically used to perform multiple rounds of decryption operations on encrypted data using multiple bit strings to obtain target data; wherein the decryption result of the previous round of decryption operation is used as the data to be decrypted in the next round of decryption operation.

[0236] To facilitate understanding, the following example uses a data transfer scenario between different types of memory in a real heterogeneous memory architecture, combined with... Figure 7 The schematic diagram shown illustrates the technical solution of this application.

[0237] like Figure 7The system architecture shown may include a first memory 701 and a mask pool 702 located in a trusted environment, and a second memory 703 located in an untrusted environment. The trusted environment also includes a device manager 704, used to interact with the second memory 703, sending data from the trusted environment to the second memory 703 and retrieving data from the second memory 703. The trusted environment can refer to the local operating environment of the computer system; both the first memory and the mask pool are local memory. The second memory is remote memory in an external device of the computer system, and is an untrusted environment relative to the local operating environment.

[0238] The mask pool 702 can be pre-filled with bit sequences. A mask pool of predetermined size 's' can be configured, and a first byte of data is randomly generated according to the predetermined size. The bit sequence corresponding to the first byte of data is then filled into the mask pool. Furthermore, to improve the security of data transmission and storage, the bit sequences filled in the mask pool can be updated at predetermined intervals. Before the update, multiple encrypted data items that have been encrypted using the bit strings provided by the mask pool and have not yet been decrypted can be retrieved from the second memory and decrypted. After the mask pool is updated, the target data is re-encrypted using the updated bit sequences.

[0239] By updating the bit sequence filled in the mask pool at predetermined time intervals, the security of data transmission and storage is further improved, avoiding the occurrence of many overlapping fields in the bit string used for masking during long-term encryption, which would lead to guessing the original target data based on multiple mask results.

[0240] During data transmission, in response to a request from the target application, the target data to be transmitted can be retrieved from the first memory 501, and the bit sequence filled in the mask pool 702 can be determined. Furthermore, at least one random number from 0 to s-1 can be generated as at least one offset corresponding to the target data mask pool 702. Based on the at least one offset, at least one bit string of the same size as the target data (denoted as m) can be retrieved from the mask pool 702. The target data is then masked using the at least one bit string to generate encrypted data. This encrypted data is then sent to the second memory 703 via the device manager 704, and a first mapping relationship between the encrypted data and the at least one offset is stored in a trusted environment.

[0241] By masking the target data using at least one bit string obtained from a mask pool in the trusted environment before transferring the target data from a first memory located in a trusted environment to a second memory located in an untrusted environment, encrypted data is generated and then transferred to the second memory. This improves the security of data transfer and storage between different types of memory in a heterogeneous memory architecture. Furthermore, the mask pool is filled with bit sequences, and the bit string obtained from the mask pool for masking is of the same size as the target data. Therefore, masking operations can be performed on target data of any size, meeting the processing needs of small-sized data in a heterogeneous memory architecture and improving the flexibility of data encryption.

[0242] If the target data is transferred to memory in an untrusted environment again, the process can return to the step of generating at least one offset of the target data in the mask pool and continue execution. In other words, during encryption, at least one offset of the target data in the mask pool is dynamically generated, and the bit string used for masking the target data is a one-time event. When the encrypted data is transferred back to the trusted environment, decrypted, and stored back in the first memory, if the target data needs to be transferred to memory in an untrusted environment again, the process will continue according to the step of generating at least one offset of the target data in the mask pool. That is, at least one offset is regenerated, and the bit string is obtained based on the regenerated offset for masking to generate encrypted data. This ensures that comparison information from multiple encrypted data transfers cannot be obtained, avoiding guessing the original target data based on comparison information, and further improving the security of data transmission.

[0243] Optionally, to reduce the memory footprint of the mapping relationship, the target category size corresponding to the target data can be determined based on the data size of the target data, and the target group corresponding to the target category size can be found. An unallocated target index identifier can be selected from multiple index identifiers corresponding to the target group and allocated to the target data. Based on the target index identifier, at least one starting offset of the target group in the mask pool, and the target category size, at least one offset corresponding to the target data in the mask pool can be determined, and then at least one bit string corresponding to it can be obtained to perform masking operations, generate encrypted data, and save the second mapping relationship between the encrypted data and the target group identifier and the target index identifier, as well as the third mapping relationship between the target group identifier and at least one starting offset in a trusted environment.

[0244] By using a grouping approach to determine the offset of the target data, for a single encrypted data, it is only necessary to save the second mapping relationship between the encrypted data and the target group identifier and the target index identifier, and for each target group, save the third mapping relationship between the target group identifier and at least one starting offset. This enables the lookup of the offset corresponding to the encrypted data and the bit string used by the mask during decryption. It is not necessary to save the mapping relationship between a single encrypted data and at least one offset, thereby reducing the memory occupied by the mapping relationship and reducing memory resource overhead.

[0245] Optionally, the second mapping relationship can also be used as metadata of the encrypted data and attached to the encrypted data, for example, by adding it to a preset field of the encrypted data and sending it to the second memory along with the encrypted data. In this case, the third mapping relationship is still stored in the trusted environment, further reducing the memory occupied by the mapping relationship and reducing memory resource consumption.

[0246] During data encryption, multiple bit strings can be used to perform multiple rounds of masking operations on the target data. Each round of masking selects one bit string, and the masking result of the previous round of masking operation is used as the data to be masked in the next round of masking operation. This can avoid the occurrence of many overlapping fields in the bit strings of masking different target data during the process of selecting a single bit string for masking, which would lead to guessing the original target data based on the masking results of different target data, and further improve the security of data transmission and storage.

[0247] Furthermore, to further enhance the security of data transmission and storage, it can be combined with preset encryption algorithms. For example... Figure 7 As shown, three bit strings, m1, m2, and m3, are selected. A preset encryption algorithm, the Rijndael encryption algorithm, is used. A non-linear substitution table, such as the Rijndael S-box, is used to encrypt and transform the target data t0, resulting in transformed data s0. The first bit string m1 is used to mask the transformed data s0, specifically through an XOR operation, to obtain the first round mask result t1. The previous round mask result t1 is then encrypted and transformed to obtain the next round mask result s1. The next bit string m2 is then XORed with the transformed result s1 to obtain the next round mask result t2. The mask result t2 is then encrypted and transformed to obtain the next round mask result s2. Finally, the last bit string m3 is XORed with the transformed result s3 to obtain the final round mask result t3. The mask result t3 is used as encrypted data and sent to the second memory 703 via Device Manager 704.

[0248] By combining a preset encryption algorithm, encryption transformation is performed first before masking, and then the transformation result is masked using a bit string. This process involves multiple rounds of encryption transformation and masking, which further improves the security of data transmission and storage.

[0249] like Figure 8 The diagram shown is a structural schematic of an embodiment of a computing device provided in this application. The device may include a storage component 801 and a processing component 802.

[0250] The storage component 801 can be used to store one or more computer program instructions, wherein one or more computer program instructions are called and executed by the processing component 802 to achieve... Figure 1 or Figure 2 The data transmission method shown, or Figure 3 The data encryption method shown, or Figure 4 The data decryption method shown.

[0251] Of course, the aforementioned computing device may also include other components, such as input / output interfaces, communication components, etc.

[0252] Input / output interfaces provide interfaces between processing components and peripheral interface modules, which can be output devices, input devices, etc. Communication components are configured to facilitate wired or wireless communication between computing devices and other devices.

[0253] It should be noted that the above-mentioned computing devices implement Figure 1 or Figure 2 The data transmission method shown, or Figure 3 The data encryption method shown, or Figure 4 The data decryption method shown can be implemented using physical devices or elastic computing hosts provided by cloud computing platforms. It can be implemented as a distributed cluster consisting of multiple servers or terminal devices, or as a single server or terminal device.

[0254] The aforementioned computing device can also be implemented as an electronic device. An electronic device can refer to a user-used device with the necessary functions such as internet access, computing, and communication; examples include mobile phones, tablets, personal computers, and wearable devices. It is understood that the aforementioned electronic device may also include display components, input / output interfaces, communication components, and other components, which will not be elaborated further.

[0255] In one or more of the above embodiments, the processing component may include one or more processors to execute computer instructions to perform all or part of the steps in the above method. Alternatively, the processing component may be implemented as one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components for performing the above method.

[0256] Storage components are configured to store various types of data to support operations on the terminal. Storage components can be implemented from any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0257] The display component can be an electroluminescent (EL) element, a liquid crystal display or a microdisplay with a similar structure, or a retina-direct display or a similar laser scanning display.

[0258] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a computer, can perform... Figure 1 or Figure 2 The data transmission method shown, or Figure 3 The data encryption method shown, or Figure 4 The data decryption method is shown. This computer-readable medium may be included in the computing device described in the above embodiments; or it may exist independently and not assembled into the computing device.

[0259] Computer-readable storage media may be, for example, but not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatuses, or devices, or any combination thereof.

[0260] This application also provides a computer program product, which includes a computer program carried on a computer-readable storage medium, and the computer program can perform [the following functions] when executed by a computer. Figure 1 or Figure 2 The data transmission method shown, or Figure 3 The data encryption method shown, or Figure 4 The data decryption method shown.

[0261] In such embodiments, the computer program may be downloaded and installed from a network, and / or installed from a removable medium. When the computer program is executed by a processor, it performs the various functions defined in the system of this application.

[0262] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0263] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0264] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0265] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A data transmission method, characterized in that, include: Retrieve the target data from the first memory location; Determine the bit sequence to fill the mask pool; Generate at least one offset, and based on the at least one offset, obtain at least one bit string from the mask pool that has the same data size as the target data; The target data is masked using at least one bit string to generate encrypted data; The encrypted data is sent to a second memory; wherein the first memory and the mask pool are located in a trusted environment, and the second memory is located in an untrusted environment.

2. The method according to claim 1, characterized in that, Also includes: A first mapping relationship between the encrypted data and the at least one offset is stored; wherein, the first mapping relationship is used to determine at least one offset corresponding to the encrypted data when the encrypted data is obtained from the second memory; the at least one offset is used to obtain at least one corresponding bit string from the mask pool, and the at least one bit string is used to decrypt the encrypted data to obtain the target data.

3. The method according to claim 1, characterized in that, Also includes: Configure a mask pool of a predetermined size; The first byte of data is randomly generated according to the predetermined size; The bit sequence corresponding to the first byte of data is filled into the mask pool.

4. The method according to claim 2, characterized in that, Also includes: At predetermined intervals, multiple encrypted data generated by masking operations using bit strings provided by the mask pool are retrieved from the second memory; Based on the first mapping relationship corresponding to the plurality of encrypted data, at least one offset corresponding to each of the plurality of encrypted data is determined; At least one bit string corresponding to each of the multiple encrypted data is obtained from the mask pool using at least one offset corresponding to each of the multiple encrypted data. Using at least one bit string corresponding to each of the multiple encrypted data, the multiple encrypted data are decrypted to obtain multiple target data; Randomly generate the second byte of data; The mask pool is updated using the bit sequence of the second byte of data; For any one of the plurality of target data, return to the step of generating at least one offset and continue execution.

5. The method according to claim 1, characterized in that, The generation of at least one offset includes: Based on the size of the target data, determine the size of the target category corresponding to the target data; Find the target group corresponding to the target category size; An unassigned target index identifier is selected from multiple index identifiers corresponding to the target group and assigned to the target data; wherein, the multiple index identifiers are generated according to a predetermined size threshold and the target category size; Based on the target index identifier, at least one starting offset of the target group in the mask pool, and the target category size, determine at least one offset corresponding to the target data in the mask pool; The method further includes: The system stores a second mapping relationship between the encrypted data and the target group identifier and the target index identifier, and a third mapping relationship between the target group identifier and the at least one starting offset. The second mapping relationship is used to determine the target group corresponding to the encrypted data and the target index identifier allocated in the target group when the encrypted data is retrieved from the second memory. The third mapping relationship is used to determine at least one offset corresponding to the target data in the mask pool based on at least one starting offset corresponding to the target group in the mask pool, the target index identifier corresponding to the target data, and the target category size of the target group. The at least one offset is used to retrieve at least one corresponding bit string from the mask pool, and the at least one bit string is used to decrypt the encrypted data to obtain the target data.

6. The method according to claim 5, characterized in that, Also includes: If there is no target group corresponding to the target category size, or if there is no unassigned index identifier in the target group, create a target group corresponding to the target category size, and determine at least one starting offset corresponding to the target group in the mask pool; Based on the target category size and a predetermined size threshold, generate multiple index identifiers corresponding to the target group; The index identifier of the at least one starting offset is used as the target index identifier for the target data allocation, and the at least one starting offset is used as at least one offset corresponding to the target data in the mask pool.

7. The method according to claim 5, characterized in that, The second mapping relationship between storing the encrypted data, the target packet identifier, and the target index identifier includes: The second mapping relationship between the encrypted data and the target packet identifier and the target index identifier is sent to the second memory.

8. The method according to claim 5, characterized in that, The step of determining at least one offset corresponding to the target data in the mask pool based on the target index identifier, at least one starting offset of the target group in the mask pool, and the target category size includes: For any starting offset of the target group in the mask pool, the product of the target index identifier and the target category size is summed with the starting offset to obtain the offset of the target data in the mask pool.

9. The method according to claim 5, characterized in that, The step of determining the target category size corresponding to the target data based on the data size of the target data includes: Determine the range of values ​​defined by the two consecutive integer powers of 2 as endpoints; The right endpoint of the numerical range corresponding to the size of the target data is taken as the target category size corresponding to the target data.

10. The method according to claim 1, characterized in that, The step of masking the target data using the at least one bit string to generate encrypted data includes: Multiple rounds of masking operations are performed on the target data using multiple bit strings to generate encrypted data; wherein the masking result of the previous round of masking operation is used as the data to be masked in the next round of masking operation.

11. The method according to claim 10, characterized in that, The step of performing multiple rounds of masking operations on the target data using multiple bit strings to generate encrypted data includes: The target data is encrypted and transformed to obtain transformed data; The transformed data is masked using the first bit string to obtain the first round of masking results, and the following operations are performed iteratively: The masking result from the previous round is encrypted and transformed to obtain the transformation result for the next round. The transformation result is masked using the next bit string to obtain the mask result for the next round; The masking result from the last round is used as encrypted data.

12. The method according to claim 1, characterized in that, The first memory and the mask pool are local memory, and the second memory is remote memory.

13. A data transmission method, characterized in that, include: Encrypted data is obtained from the second memory; the encrypted data is generated by masking target data in the first memory using at least one bit string, and the at least one bit string is obtained from a mask pool based on at least one offset; Determine the at least one offset corresponding to the encrypted data, and based on the at least one offset, obtain the corresponding at least one bit string from the mask pool; The encrypted data is decrypted using at least one bit string to obtain the target data; The first memory and the mask pool are located in a trusted environment, while the second memory is located in an untrusted environment.

14. The method according to claim 13, characterized in that, The step of determining at least one offset corresponding to the encrypted data, and obtaining at least one corresponding bit string from the mask pool based on the at least one offset, includes: Obtain a second mapping relationship between the encrypted data and the target group identifier and the target index identifier, and a third mapping relationship between the target group identifier and at least one starting offset; wherein, the target group is determined based on the target category size corresponding to the data size of the target data, the target index identifier is assigned to the target data by the target group, and the at least one starting offset is at least one starting offset of the target group in the mask pool; Based on the second mapping relationship, the target group corresponding to the encrypted data and the target index identifier allocated in the target group are determined. Based on the third mapping relationship, at least one starting offset of the target packet in the mask pool is determined; Based on the at least one starting offset, the target index identifier, and the target category size, determine at least one offset of the target data in the mask pool; Based on the at least one offset, obtain at least one corresponding bit string from the mask pool.

15. The method according to claim 13, characterized in that, The step of decrypting the encrypted data using the at least one bit string to obtain the target data includes: The encrypted data is decrypted in multiple rounds using multiple bit strings to obtain the target data. The decryption result of the previous decryption operation is used as the data to be decrypted in the next decryption operation.

16. A data encryption method, characterized in that, include: In response to the first data transmission command, the target data is determined; Generate at least one offset; Based on the at least one offset, at least one bit string with the same data size as the target data is obtained from the mask pool; the mask pool stores bit sequences. The target data is masked using at least one bit string to generate encrypted data.

17. A data decryption method, characterized in that, include: In response to a second data transmission instruction, encrypted data is determined; the encrypted data is generated by masking the target data using at least one bit string, the at least one bit string being obtained from a mask pool based on at least one offset; Determine the at least one offset corresponding to the encrypted data, and based on the at least one offset, obtain at least one corresponding bit string from the mask pool; The encrypted data is decrypted using at least one bit string to obtain the target data.

18. A computing device, characterized in that, It includes a storage component and a processing component; the storage component stores one or more computer program instructions, which are invoked and executed by the processing component, and the processing component executes the one or more computer program instructions to implement the data transmission method as described in any one of claims 1 to 15, the data encryption method as described in claim 16, or the data decryption method as described in claim 17.

19. A computer-readable storage medium, characterized in that, The device contains a computer program that is executed by a computer to implement the data transmission method as described in any one of claims 1 to 15, the data encryption method as described in claim 16, or the data decryption method as described in claim 17.

20. A computer program product, characterized in that, The device contains a computer program that, when executed by a computer, implements the data transmission method as described in any one of claims 1 to 15, the data encryption method as described in claim 16, or the data decryption method as described in claim 17.

Images