Data encryption storage method and device, computer equipment, storage medium and product

Abstract

The invention relates to a data encryption storage method and device, computer equipment, a storage medium and a product. The method comprises the following steps: acquiring resource state indexes of a computing system, wherein the resource state indexes comprise performance indexes related to computing power, memory and network communication; determining the sensitivity level of each piece of to-be-stored data; determining a target encryption algorithm of the to-be-stored data based on the resource state index and the sensitivity level; and encrypting the to-be-stored data by using the target encryption algorithm to obtain encrypted data, and storing the encrypted data to the computing system. By adopting the method, the safety and the system performance can be balanced.

Description

Technical Field

[0001] This application relates to the field of data security technology, and in particular to a data encryption and storage method, apparatus, computer equipment, storage medium and product. Background Technology

[0002] In the field of data security, especially in environments with limited computing power such as edge computing nodes, mobile devices, cloud services, and enterprise think tanks, ensuring the secure storage of data is a crucial task. Enterprise think tanks, which are internal systems used by enterprises to store, analyze, and share knowledge assets, are particularly important for data security. Encryption technology is the cornerstone of ensuring data security.

[0003] However, there is currently no encryption strategy specifically designed for environments with limited computing power. Related technologies typically encrypt data according to preset encryption algorithms. This approach either results in low security due to insufficient encryption strength, or excessive encryption strength that exceeds the computing power limit of the system undertaking the encryption task, leading to performance degradation or even system crashes.

[0004] Therefore, there is an urgent need for an encryption mechanism that can balance security and performance. Summary of the Invention

[0005] Therefore, it is necessary to provide a data encryption and storage method, device, computer equipment, storage medium, and product that can balance security and system performance to address the above-mentioned technical problems.

[0006] Firstly, this application provides a method for encrypting and storing data, including:

[0007] Obtain resource status indicators of the computing system, including performance indicators related to computing power, memory, and network communication.

[0008] Determine the sensitivity level of each piece of data to be saved;

[0009] Based on the resource status indicators and the sensitivity level, the target encryption algorithm for the data to be saved is determined;

[0010] The data to be saved is encrypted using the target encryption algorithm to obtain encrypted data, and the encrypted data is then saved to the computing system.

[0011] In one embodiment, determining the target encryption algorithm for the data to be saved based on the resource status indicator and the sensitivity level includes:

[0012] Obtain the weights of the resource status indicators and the sensitivity levels;

[0013] Calculate the resource status weighted sum based on the resource status indicators and their weights;

[0014] Calculate the sensitivity weighted value based on the sensitivity level and the weight of the sensitivity level;

[0015] Based on the weighted sum of resource states, the sensitivity weighting value, and a preset mapping relationship, a target encryption algorithm for the data to be saved is determined; wherein, the mapping relationship includes the correspondence between the preset encryption algorithm and the preset weighted sum of resource states and the sensitivity weighting value.

[0016] In one embodiment, determining the target encryption algorithm for the data to be saved based on the resource status indicator and the sensitivity level includes:

[0017] The resource status level is determined based on the aforementioned resource status indicators;

[0018] Based on the resource status level and the sensitivity level, the target encryption algorithm for the data to be saved is determined.

[0019] In one embodiment, determining the target encryption algorithm for the data to be saved based on the resource status level and the sensitivity level includes:

[0020] When the resource status level is sufficient and the sensitivity level is confidential, the target encryption algorithm for the data to be saved is determined to be the first encryption algorithm combination.

[0021] When the resource status level is overload level and the sensitivity level is confidential level, the target encryption algorithm for the data to be saved is determined to be the second encryption algorithm combination.

[0022] When the resource status level is at the extreme level and the sensitivity level is at the internal level, the target encryption algorithm for the data to be saved is determined to be the third encryption algorithm.

[0023] Among them, the resources of the sufficient level, the overload level and the extreme level decrease in sequence, the sensitivity of the confidential level is higher than that of the internal level, and the encryption strength of the first encryption algorithm combination, the second encryption algorithm combination and the third encryption algorithm decreases in sequence.

[0024] In one embodiment, the method further includes:

[0025] If the resource status indicators of the computing system change after the data is encrypted and saved, a new target encryption algorithm is determined based on the changed resource status indicators.

[0026] The encrypted data is decrypted, and the decrypted data is re-encrypted and saved using the new target encryption algorithm.

[0027] In one embodiment, the method further includes: outputting an alarm message if the decryption or re-encryption and saving fails.

[0028] Secondly, this application also provides a data encryption and storage device, comprising:

[0029] The acquisition module is used to acquire resource status indicators of the computing system, including performance indicators related to computing power, memory and network communication.

[0030] The first determination module is used to determine the sensitivity level of each piece of data to be saved;

[0031] The second determining module is used to determine the target encryption algorithm for the data to be saved based on the resource status indicators and the sensitivity level.

[0032] An encrypted storage module is used to encrypt the data to be saved using the target encryption algorithm, obtain encrypted data, and save the encrypted data to the computing system.

[0033] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the data encryption and storage method proposed in the first aspect.

[0034] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the data encryption and storage method proposed in the first aspect.

[0035] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the data encryption and storage method proposed in the first aspect.

[0036] The aforementioned data encryption and storage methods, apparatuses, computer equipment, computer-readable storage media, and computer program products acquire resource status indicators of the computing system, including performance indicators related to computing power, memory, and network communication; determine the sensitivity level of each piece of data to be saved; determine the target encryption algorithm for the data to be saved based on the resource status indicators and sensitivity levels; encrypt the data to be saved using the target encryption algorithm to obtain encrypted data, and save the encrypted data to the computing system. This application's embodiment simultaneously determines the corresponding target encryption algorithm based on the computing system's resource status indicators and the data to be saved, and then encrypts and saves the data. By considering both resource status indicators and sensitivity levels, it balances system performance and data security, achieving a balance between security and system performance. Attached Figure Description

[0037] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0038] Figure 1 This is an application environment diagram of a data encryption and storage method in one embodiment;

[0039] Figure 2 This is a flowchart illustrating a data encryption and storage method in one embodiment;

[0040] Figure 3 This is a flowchart illustrating step 203 in the first embodiment;

[0041] Figure 4 This is a flowchart illustrating step 203 in the second embodiment;

[0042] Figure 5 This is a flowchart illustrating step 203 in the third embodiment;

[0043] Figure 6 This is an application environment diagram of the data encryption and storage method in another embodiment;

[0044] Figure 7 This is a flowchart illustrating a specific example of a data encryption and storage method.

[0045] Figure 8 This is a structural block diagram of a data encryption and storage device in one embodiment;

[0046] Figure 9This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0047] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0048] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.

[0049] Definitions of terms used in this application:

[0050] Limited computing power environment: refers to scenarios where computing resources (CPU, memory, network bandwidth, etc.) are limited, such as low-configuration instances in edge computing nodes, mobile devices, or cloud services.

[0051] Corporate think tank: A computing system within an enterprise used to store, analyze, and share knowledge assets, typically containing sensitive data (such as trade secrets and customer information).

[0052] Dynamic encryption strategy: A mechanism that dynamically adjusts the encryption algorithm based on real-time resource load and data sensitivity.

[0053] Resource awareness: A mechanism that adjusts algorithm behavior by monitoring the resource status of the computing system (such as CPU utilization, memory usage, and network latency).

[0054] In corporate think tanks, data security is paramount. However, traditional encryption methods (such as AES-256 and RSA-2048) suffer from the following problems in environments with limited computing power:

[0055] (1) Performance bottleneck: High-strength encryption algorithms have high computing power requirements, which may lead to increased system latency or even system crash;

[0056] (2) Limitations of static strategies: The fixed encryption strength of the preset encryption algorithm cannot adapt to the dynamic changes in resource load and data sensitivity requirements.

[0057] (3) The contradiction between security and performance: reducing encryption strength to ensure system performance may lead to data leakage risk.

[0058] In related technologies, there is a lack of research on dynamic encryption strategies for environments with limited computing power. These typically rely on hardware acceleration or fixed rules, lacking the ability to monitor resource status in real time and dynamically adjust encryption strategies.

[0059] Therefore, this application proposes a data encryption and storage method to solve the following technical problems:

[0060] In environments with limited computing power, security and performance can be balanced by dynamically adjusting the strength of the encryption algorithm;

[0061] Real-time monitoring of system resource status helps prevent encryption failures or service unavailability due to resource overload.

[0062] By combining lightweight algorithms and switching strategies, the efficiency and security of data storage can be improved.

[0063] The data encryption and storage method provided in this application embodiment can be applied to, for example... Figure 1 In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104 or located on the cloud or other network servers. Terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, drones, low-altitude aircraft, IoT devices, and portable wearable devices. IoT devices can include smart speakers, smart TVs, smart air conditioners, smart in-vehicle devices, projection devices, etc. Portable wearable devices can include smartwatches, smart bracelets, head-mounted devices, etc. Head-mounted devices can be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc. Server 104 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0064] In one exemplary embodiment, such as Figure 2 As shown, a data encryption and storage method is provided, which can be applied to... Figure 1 Taking the server in the example, the explanation includes the following steps 202 to 204. Wherein:

[0065] Step 201: Obtain the resource status indicators of the computing system, including performance indicators related to computing power, memory, and network communication.

[0066] Optionally, resource status metrics include at least one of Central Processing Unit (CPU) utilization, memory usage, network bandwidth, and network latency. A computing system refers to a system with data analysis, encryption, and storage capabilities, and may include corporate think tanks.

[0067] For example, at least one of the following metrics can be collected in real time from the computing system: CPU utilization, memory usage, network bandwidth, and network latency, using various feasible methods such as system call interfaces or performance monitoring tools. This data is then preprocessed, including data cleaning, invalid value filtering, and normalization, and saved as the basis for subsequent encryption.

[0068] Step 202: Determine the sensitivity level of each piece of data to be saved.

[0069] Data to be saved refers to any form of data that is about to be written into the computing system. Optionally, the data to be saved may include structured data and unstructured data, such as documents, images, videos, and log files. Optionally, multiple sensitivity levels can be preset, for example, level 3, level 2, and level 1 with decreasing sensitivity. The higher the sensitivity level, the stronger the encryption required; the lower the sensitivity level, the weaker the encryption required.

[0070] For example, the sensitivity level of the data to be saved is determined based on the attribute information of each piece of data to be saved, wherein the attribute information includes at least one of the following: data label, data content, data type, data source, creator information, context information, data management strategy, and storage duration.

[0071] In the first possible implementation, each piece of data to be saved is analyzed to obtain its attribute information, such as data tag, content, type, data source, creator information, context information, data management strategy, and / or retention period. The sensitivity level of the data to be saved is then determined based on this attribute information. For example, data containing "identification information" is determined to be at a high level, i.e., level 3 (confidential), requiring stronger encryption.

[0072] In the second possible implementation, the sensitivity level of the data to be saved is determined based on the data type. The data type can include at least one of public data, internal data, and confidential data. For example, confidential data could be classified as high-level (Level 3), requiring stronger encryption; internal data could be classified as Level 2, requiring medium-level encryption; and public data could be classified as Level 1, where Level 1 can be no encryption or almost equivalent to no encryption.

[0073] In the third possible implementation, the sensitivity level of the data to be saved is determined based on the creator information. This creator information may include at least one of job level information and tenant information. Job level information includes at least job title and job level information, and tenant information includes at least tenant level information. For example, data created by senior managers might be classified as high-level (Level 3), requiring stronger encryption; data created by ordinary employees might be classified as Level 2, requiring medium-level encryption; and data created by outsourced personnel might be classified as Level 1, requiring no encryption or nearly equivalent to no encryption.

[0074] Optionally, after determining the sensitivity level, it can be labeled using metadata tags (e.g., sensitivity: level 3). The data to be saved is monitored in real time, and the determined sensitivity level is adjusted as the attribute information of the data to be saved changes, achieving dynamic adjustment and labeling.

[0075] Step 203: Based on resource status indicators and sensitivity levels, determine the target encryption algorithm for the data to be saved.

[0076] Optionally, the target encryption algorithm may include one encryption algorithm or a combination of multiple encryption algorithms.

[0077] For example, after obtaining the resource status indicators and the sensitivity indicators of each piece of data to be saved, a target encryption algorithm for the data to be saved is determined based on the resource status indicators and sensitivity levels, and according to preset rules. This target encryption algorithm conforms to the resource status indicators and sensitivity levels. The preset rules may include a pre-defined correspondence between the resource status indicators and sensitivity levels and the identifiers of various encryption algorithms. For instance, when the resource status indicators indicate that the resources are greater than a threshold (indicating sufficient resources) and the sensitivity level is the highest, a high-strength encryption algorithm is used; when the resource status indicators indicate that the resources are less than or equal to the threshold (indicating insufficient resources) and the sensitivity level is the highest, a low-strength encryption algorithm is used.

[0078] Step 204: Encrypt the data to be saved using the target encryption algorithm to obtain encrypted data, and save the encrypted data to the computing system.

[0079] For example, after obtaining the target encryption algorithm, a cryptographic library is invoked to encrypt each piece of data to be saved, generating encrypted data corresponding to the data to be saved. Then, the encrypted data is written to the storage medium of the computing system (such as a hard drive, database, or distributed storage system) to complete the saving. Optionally, the encrypted data can be saved to an enterprise think tank within the computing system.

[0080] Algorithm selection can be based on factors such as hardware requirements, security requirements, and performance requirements. For example, the following encryption algorithms are selected based on:

[0081] ChaCha20: Low hardware acceleration requirements, suitable for embedded devices and mobile terminals;

[0082] AES-128-GCM: Balancing speed and security, suitable for low-bandwidth scenarios;

[0083] Hybrid encryption algorithm (AES-256+RSA-2048): Asymmetric encryption (RSA) is used only for key exchange, reducing computational overhead.

[0084] In the aforementioned data encryption and storage method, resource status indicators of the computing system are obtained, including performance indicators related to computing power, memory, and network communication; the sensitivity level of each piece of data to be stored is determined; based on the resource status indicators and sensitivity levels, a target encryption algorithm for the data to be stored is determined; the target encryption algorithm is used to encrypt the data to be stored, resulting in encrypted data, which is then stored in the computing system. This embodiment of the application simultaneously determines the corresponding target encryption algorithm based on the computing system's resource status indicators and the data to be stored, and then encrypts and stores the data. By considering both resource status indicators and sensitivity levels, it balances system performance and data security, achieving a balance between security and system performance.

[0085] When determining the target encryption algorithm in step 203, it can be determined in three ways, which are described exemplarily below.

[0086] In the first exemplary embodiment, such as Figure 3 As shown, step 203 includes steps 301 to 304. Wherein:

[0087] Step 301: Obtain the weights of the resource status indicators and the weights of the sensitivity levels.

[0088] Optionally, the resource status levels include an adequate level, an overload level, and a limit level, with resources decreasing sequentially. The sensitivity levels include a confidential level (level 3), an internal level (level 2), and a public level (level 1), with encryption complexity or encryption strength decreasing sequentially.

[0089] Optionally, each resource status indicator corresponds to a weight, which represents the importance of the corresponding resource status indicator, and the sum of the weights corresponding to each resource status indicator is 1. Each sensitivity level corresponds to a weight, which represents the importance of the corresponding sensitivity level, and the sum of the weights corresponding to each sensitivity level is 1. Each weight can be pre-set and input into a weight library based on historical experience, experimental testing, and actual needs. The weights in the weight library can be adjusted according to the actual needs of the business scenario to meet flexibility; for example, for computing power-sensitive businesses, the weights of resource status indicators can be set higher.

[0090] For example, after obtaining the resource status index and sensitivity level, the weights corresponding to the resource status index and sensitivity level are searched in the weight library to obtain the required weights.

[0091] Step 302: Calculate the weighted sum of resource status based on the resource status indicators and their weights.

[0092] For example, the product between each resource status indicator and its weight is calculated to obtain multiple products. The sum of these multiple products is then obtained as a weighted sum of resource status values.

[0093] Step 303: Calculate the sensitivity weighted value based on the sensitivity level and the weight of the sensitivity level.

[0094] For example, for each piece of data to be saved, the product of its sensitivity level and the weight of that level is calculated, and the product is used as the sensitivity weight value.

[0095] Step 304: Determine the target encryption algorithm for the data to be saved based on the resource status weighted sum, sensitivity weighted value, and preset mapping relationship.

[0096] The mapping relationship includes the correspondence between preset encryption algorithms and preset resource state weighted sums and sensitivity weighted values. The mapping relationship can be a decision function or a lookup table, where the output of the decision function is the algorithm identifier.

[0097] In one possible implementation, the resource state weighted sum and sensitivity weighted value are input into the decision function, the decision function outputs a calculation result, and the identifier of the target encryption algorithm can be obtained by searching the encryption library for the identifier of the encryption algorithm that matches the calculation result.

[0098] In another possible implementation, the resource state weighted sum and sensitivity weighted value are input into a lookup table to obtain the encryption algorithm corresponding to the resource state weighted sum and sensitivity weighted value, thus obtaining the target encryption algorithm. For example, if the resource state weighted sum is greater than the resource threshold and the sensitivity weighted value is greater than the sensitivity threshold, the corresponding target encryption algorithm is a lightweight encryption algorithm combination (such as ChaCha20+RSA-1024).

[0099] It provides a user interface or a configuration file (YAML) interface, allowing administrators to adjust various weights and encryption algorithms in real time. For example, the YAML file includes identifiers for the algorithm combinations used under both resource-sufficient and resource-overloaded conditions for confidential data; for instance, the algorithm combination under resource-sufficient conditions is AES-256+RSA-2048. For internal data, the algorithm combinations used under both resource-sufficient and resource-overloaded conditions are AES-128-GCM and AES-128-ECB (reflecting a performance-priority trade-off). This YAML file defines the target encryption algorithm for different scenarios; administrators only need to modify this file to change the encryption strategy. It can monitor the configuration file modification time or receive update signals in real time. When a change is detected, it hot-loads and parses the new configuration file in memory, replacing the old memory mapping.

[0100] In this embodiment, the target encryption algorithm is determined by weighted sum of resource status, sensitivity weighting value, and preset mapping relationship. This achieves accurate and dynamic matching between the encryption strategy and the real-time status and security requirements of the system, significantly improving the adaptability and intelligence of the method. Lightweight algorithms such as ChaCha20 are introduced to reduce computational power consumption while ensuring security. Furthermore, it features hot-loading of the strategy, allowing the encryption strategy to be updated without restarting the service by dynamically loading configuration files.

[0101] In a second exemplary embodiment, such as Figure 4 As shown, step 203 includes steps 401 and 402. Wherein:

[0102] Step 401: Determine the resource status level based on the resource status indicators.

[0103] Optionally, a pre-defined correspondence between threshold range combinations for each resource state and each resource state level is established, with each threshold range combination corresponding to one resource. The resource state levels include, in descending order of resource availability, overload, and limit levels.

[0104] For example, when CPU utilization is less than a first utilization threshold, memory utilization is less than a first utilization threshold, and network latency is less than a first time threshold, the resource status level is determined to be sufficient. When CPU utilization is greater than or equal to the first utilization threshold and less than a second utilization threshold, memory utilization is greater than or equal to the first utilization threshold and less than the second utilization threshold, or network latency is greater than or equal to the first time threshold and less than the second time threshold, the resource status level is determined to be overloaded. When CPU utilization is greater than or equal to the second utilization threshold, memory utilization is greater than or equal to the second utilization threshold, or network latency is greater than or equal to the first time threshold, the resource status level is determined to be extreme. The second utilization threshold is greater than the first utilization threshold. The second utilization threshold is greater than the first utilization threshold. The second time threshold is greater than the first time threshold.

[0105] Taking a first utilization threshold of 50%, a second utilization threshold of 80%, a first occupancy threshold of 60%, a second occupancy threshold of 90%, and a first time threshold of 100ms and a second time threshold of 200ms respectively as an example, when CPU utilization is <50%, memory occupancy is <60%, and network latency is <100ms, the resource status level is determined to be sufficient; when 80% > CPU utilization ≥50%, 90% > memory occupancy ≥60%, or 200ms > network latency ≥100ms, the resource status level is determined to be overloaded; when CPU utilization ≥80%, memory occupancy ≥90%, or network latency ≥200ms, the resource status level is determined to be extreme.

[0106] Step 402: Determine the target encryption algorithm for the data to be saved based on the resource status level and sensitivity level.

[0107] Optionally, a policy lookup table is pre-set, which establishes a correspondence between combinations of resource status levels and sensitivity levels and the identifiers of encryption algorithms. This lookup table is dynamically expandable and adjustable.

[0108] For example, the process of determining the target encryption algorithm can be an efficient table lookup process. The resource status level and sensitivity level are input into a policy lookup table for searching, yielding the target encryption algorithm corresponding to the combination of the source status level and sensitivity level. Sensitivity levels include confidentiality, internal, and public levels, with encryption complexity or strength decreasing sequentially.

[0109] In one implementation of step 401, step 401 includes: when the resource status level is sufficient and the sensitivity level is confidential, determining the target encryption algorithm for the data to be saved as a first encryption algorithm combination; when the resource status level is overloaded and the sensitivity level is confidential, determining the target encryption algorithm for the data to be saved as a second encryption algorithm combination; when the resource status level is extreme and the sensitivity level is internal, determining the target encryption algorithm for the data to be saved as a third encryption algorithm; wherein, the resources of the sufficient level, overloaded level and extreme level decrease sequentially, the sensitivity of the confidential level (i.e., level 3) is higher than the sensitivity of the internal level (i.e., level 2), and the encryption strength of the first encryption algorithm combination, the second encryption algorithm combination and the third encryption algorithm decrease sequentially.

[0110] For example, for a certain data A to be saved, if the resource status level is sufficient and the sensitivity level is level 3 (e.g., A is a commercial contract or customer privacy), it indicates that the resources are sufficient and the sensitivity level is high. Therefore, the target encryption algorithm for A is determined to be a high-strength first encryption algorithm combination, such as AES-256+RSA-2048, and AES-256+RSA-2048 is used to encrypt data A. If the resource status level is overloaded and the sensitivity level is level 3 (e.g., A is a commercial contract or customer privacy), the target encryption algorithm for A is determined to be a lightweight high-strength second encryption algorithm combination, such as... ChaCha20 (lightweight algorithm) + RSA-1024 (shortened key length), using AES-256 + RSA-2048 to encrypt data A; when the resource status level is extreme and the sensitivity level is level 2 (such as A being employee files or meeting minutes), the target encryption algorithm for A is determined to be only the third encryption algorithm combination, such as AES-128-GCM, and AES-128-GCM is used to encrypt data A, further simplifying the encryption process; if the sensitivity level of data A is public (level 1), then regardless of the resource status level, data A does not need to be saved.

[0111] In other words, data with a sensitivity level higher than level 2 is encrypted according to the sensitivity level and resource status level, while data with a sensitivity level of 1 does not need to be encrypted.

[0112] Therefore, this embodiment simplifies the complex decision-making process into a fast query by combining resource status and sensitivity level with table lookup method. The decision latency is extremely low and the result is certain. It is suitable for edge computing and other scenarios with extremely high real-time requirements. It is easy to configure and adjust, which greatly improves the practicality and operability of the solution.

[0113] In a third exemplary embodiment, such as Figure 5As shown, step 203 includes steps 501 to 504. Wherein:

[0114] Step 501: Obtain the weights of the resource status indicators.

[0115] For a detailed implementation of this step, please refer to step 301 above.

[0116] Step 502: Calculate the weighted sum of resource status based on the resource status indicators and their weights.

[0117] For a detailed implementation of this step, please refer to step 302 above.

[0118] Step 503: Determine the resource status level based on the weighted sum of resource statuses.

[0119] Optionally, multiple sum threshold ranges can be preset, with each sum threshold range corresponding to a resource status level.

[0120] For example, if the weighted sum of resource states is less than a first sum threshold, the resource state level is determined to be sufficient; if the weighted sum of resource states is greater than or equal to the first sum threshold and less than a second sum threshold, the resource state level is determined to be overloaded; if the weighted sum of resource states is greater than or equal to the second sum threshold, the resource state level is determined to be extreme.

[0121] Step 504: Determine the target encryption algorithm for the data to be saved based on the resource status level and sensitivity level.

[0122] For a detailed implementation of this step, please refer to step 402 above.

[0123] In this embodiment, the resource status level is determined by weighted summation of resource status, and the target encryption algorithm for the data to be saved is determined based on the resource status level and the sensitivity level. This ensures the reliability of the resource status level, thereby ensuring the reliability of the target encryption algorithm.

[0124] The above describes a specific implementation method for encrypting and saving the data to be saved. After the initial encryption and saving is completed, resource status indicators can be continuously acquired in real time, and the encryption strategy can be dynamically adjusted based on the resource status indicators, ensuring the reliability of the operation throughout the process. This will be described in detail below.

[0125] In an exemplary embodiment, the data encryption and storage method further includes: after the data is encrypted and stored, if the resource status indicators of the computing system change, a new target encryption algorithm is determined based on the changed resource status indicators; the encrypted data is decrypted, and the decrypted data is re-encrypted and stored using the new target encryption algorithm.

[0126] For example, after encrypting and saving the data, the resource status indicators of the computing system are monitored in real time. If the current resource status indicators have changed compared to the original resource status indicators before saving, a new target encryption algorithm is determined based on the current resource status indicators and the original sensitivity level of the data (see [reference]). Figure 3 , Figure 4 or Figure 5 For example, when resource status indicators recover from overload or limit to a sufficient level (the specific judgment criteria are consistent with the aforementioned resource status level judgment), a new target encryption algorithm is determined. The new target encryption algorithm is the highest strength encryption algorithm at the corresponding sensitivity level. For example, for confidential team medical data, the new target encryption algorithm is AES-256+RSA-2048. The encrypted data can be decrypted using the target encryption algorithm used when saving (e.g., ChaCha20+RSA-1024), and then the decrypted data can be re-encrypted using the new target encryption algorithm, such as AES-256+RSA-2048, and the re-encrypted data can be saved to the computing system.

[0127] In one possible implementation, if the resource status indicator recovers to the normal threshold range, such as CPU utilization being less than 50%, the user is prompted to trigger a rollback command. Upon receiving the rollback command, the system checks whether the current resource status meets the rollback conditions. If so, a new target encryption algorithm is determined, and the decrypted data is re-encrypted.

[0128] Therefore, in this embodiment, the encryption strategy of the encrypted data stored in the computing system is dynamically adjusted according to the current resource status indicators of the computing state, thereby realizing the dynamic adjustment of the encryption algorithm strength. This can balance security and system performance, perceive the system resource status in real time, and avoid encryption failure or service unavailability caused by resource overload.

[0129] In one exemplary embodiment, the data encryption and storage method further includes: outputting an alarm message if decryption or re-encryption and storage fails.

[0130] For example, if resources are restored, the system automatically rolls back to the original encryption algorithm. If the encryption algorithm switching fails (decryption or re-encryption and saving fails), an alarm is triggered, outputting alarm information and logging the data. For instance, if data cannot be decrypted using the recorded key and algorithm (possibly indicating a key error or ciphertext tampering) or cannot be re-encrypted, structured alarm information can be sent through various channels such as system logs, console, email, SMS, or integration into the operation and maintenance monitoring system. The alarm content should include at least: the identifier of the failed data, the failed operation steps, the error code, the timestamp, and the associated resource status snapshot. The rollback process is aborted to ensure that the original encrypted data remains unchanged and is not corrupted. In extreme cases, if decryption succeeds but re-encryption and saving fails, the decrypted plaintext data is securely erased from memory and never written to the computing system to prevent data leakage.

[0131] Therefore, this embodiment can not only "degrade" to maintain performance when resources are scarce, but also proactively "upgrade" to enhance security when resources recover, forming a self-optimizing closed loop. Combined with comprehensive anomaly alerts, it greatly improves the reliability of the entire method in long-term operation, ensuring full controllability and security throughout the data lifecycle.

[0132] The data encryption and storage method of this application embodiment can be applied to... Figure 6 Each module shown can be configured on the server. Figure 6 The arrows in the diagram indicate the direction of data retrieval. A specific example will be provided below for detailed explanation.

[0133] like Figure 7 As shown, applied to Figure 6 Data encryption and storage methods may include the following steps:

[0134] Step 701: The resource monitoring module 601 collects resource status indicators such as CPU utilization, memory usage, and network latency of the enterprise think tank in real time.

[0135] Step 702: The data sensitivity assessment module 602 classifies and labels the sensitivity level of each plaintext file based on user position, tenant level, and data type.

[0136] Step 703: The dynamic encryption strategy decision module 603 obtains resource status indicators from the resource monitoring module 601 and obtains the sensitivity level from the data sensitivity assessment module 602.

[0137] Step 704: The dynamic encryption strategy decision module 603 determines the target encryption algorithm for the plaintext file based on the resource status indicators and sensitivity level.

[0138] Step 705: The encryption / decryption execution module 604 uses the target encryption algorithm to encrypt the plaintext file to obtain the ciphertext file, and saves the ciphertext file to the enterprise think tank;

[0139] Step 706: When the resource status indicators of the enterprise think tank change, the dynamic encryption strategy decision module 603 determines a new target encryption algorithm based on the changed resource status indicators.

[0140] Step 707: After decrypting the ciphertext file, the encryption and decryption execution module 604 encrypts it using a new target encryption algorithm and saves the new ciphertext file to the enterprise think tank.

[0141] Through the above steps, this embodiment can dynamically adjust the data encryption strategy in a limited computing power environment, ensuring a balance between data security and system performance. In today's rapidly developing digital landscape, the secure storage of data in enterprise think tanks faces unprecedented challenges. This embodiment combines resource monitoring and data sensitivity assessment to apply different levels of encryption measures to data of varying importance. For highly sensitive data, such as trade secrets and personal privacy information, high-strength encryption algorithms (e.g., AES-256+RSA-2048) are used when resources are sufficient to ensure storage security; while under resource constraints, a lightweight encryption algorithm (e.g., ChaCha20) is automatically switched to, ensuring basic security requirements while avoiding service interruptions due to excessive resource consumption. In a limited computing power environment, traditional fixed-strength encryption algorithms often lead to performance bottlenecks. This embodiment dynamically adjusts the encryption strategy based on real-time resource status, effectively reducing the system's computational burden. For example, when CPU utilization exceeds a preset threshold, the system automatically reduces the encryption strength to maintain service stability, thereby improving overall work efficiency and reducing unnecessary energy consumption.

[0142] In summary, the embodiments of this application dynamically adjust the encryption algorithm strength and parameters based on real-time resource status (CPU, memory, network), realizing resource-aware dynamic encryption strategy adjustment; they match different encryption strategies through data sensitivity classification (Level 1, Level 2, and Level 3), achieving data sensitivity-driven strategy layering; they introduce lightweight algorithms such as ChaCha20 to reduce computing power consumption while ensuring security; they support real-time rollback of strategies and hot reloading of configurations to adapt to changes in resource status, realizing strategy rollback and dynamic updates. Based on this, when resources are limited, downgrading the encryption strategy reduces computing power overhead, avoids system crashes, and optimizes system performance; dynamically adjusting the strategy ensures that highly sensitive data is always under high-strength encryption protection, enhancing data security; supporting rapid strategy switching and rollback adapts to the dynamic business needs of enterprise think tanks, improving flexibility; and policy management is implemented through interfaces and APIs, reducing operational complexity and providing an operationally friendly approach.

[0143] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0144] Based on the same inventive concept, this application also provides a data encryption and storage device for implementing the data encryption and storage method described above. The solution provided by this device is similar to the implementation scheme described in the above method; therefore, the specific limitations in one or more data encryption and storage device embodiments provided below can be found in the limitations of the data encryption and storage method described above, and will not be repeated here.

[0145] In one exemplary embodiment, such as Figure 8 As shown, a data encryption and storage device is provided, comprising: an acquisition module 801, a first determination module 802, a second determination module 803, and a first encryption and storage module 804, wherein:

[0146] The acquisition module 801 is used to acquire resource status indicators of the computing system, including performance indicators related to computing power, memory and network communication.

[0147] The first determining module 802 is used to determine the sensitivity level of each piece of data to be saved;

[0148] The second determining module 803 is used to determine the target encryption algorithm for the data to be saved based on the resource status indicators and the sensitivity level.

[0149] The first encryption and storage module 804 is used to encrypt the data to be saved using the target encryption algorithm to obtain encrypted data, and save the encrypted data to the computing system.

[0150] In one embodiment, the second determining module 803 includes: an acquisition unit, a first calculation unit, a second calculation unit, and a first determining unit, wherein: the acquisition unit is used to acquire the weights of the resource status indicators and the sensitivity level; the first calculation unit is used to calculate a resource status weighted sum based on the resource status indicators and their weights; the second calculation unit is used to calculate a sensitivity weighted value based on the sensitivity level and its weight; and the first determining unit is used to determine a target encryption algorithm for the data to be saved based on the resource status weighted sum, the sensitivity weighted value, and a preset mapping relationship; wherein the mapping relationship includes a correspondence between a preset encryption algorithm and preset resource status weighted sums and sensitivity weighted values.

[0151] In one embodiment, the second determining module 803 includes a second determining unit and a third determining unit, wherein: the second determining unit is used to determine a resource status level based on the resource status index; and the third determining unit is used to determine a target encryption algorithm for the data to be saved based on the resource status level and the sensitivity level.

[0152] In one embodiment, the third determining unit is specifically configured to: determine the target encryption algorithm for the data to be saved as a first encryption algorithm combination when the resource status level is sufficient and the sensitivity level is confidential; determine the target encryption algorithm for the data to be saved as a second encryption algorithm combination when the resource status level is overloaded and the sensitivity level is confidential; and determine the target encryption algorithm for the data to be saved as a third encryption algorithm when the resource status level is extreme and the sensitivity level is internal; wherein the resources of the sufficient level, the overload level, and the extreme level decrease sequentially, the sensitivity of the confidential level is higher than the sensitivity of the internal level, and the encryption strength of the first encryption algorithm combination, the second encryption algorithm combination, and the third encryption algorithm decreases sequentially.

[0153] In one embodiment, the apparatus further includes: a third determining module and a second encryption and storage module, wherein: the third determining module is used to determine a new target encryption algorithm based on the changed resource status index if the resource status index of the computing system changes after the data is encrypted and stored; the second encryption and storage module is used to decrypt the encrypted data and re-encrypt and store the decrypted data using the new target encryption algorithm.

[0154] In one embodiment, the device further includes an output module for outputting alarm information in the event that the decryption or re-encryption and saving fails.

[0155] Each module in the aforementioned data encryption and storage device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0156] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 9 As shown, this computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores data for encrypted data storage. The I / O interfaces allow the processor to exchange information with external devices. The communication interface allows communication with external terminals via a network connection. When executed by the processor, the computer program implements a data encryption storage method.

[0157] Those skilled in the art will understand that Figure 9 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0158] In one exemplary embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the data encryption and storage method proposed in the above embodiments of this application.

[0159] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, implements the data encryption and storage method proposed in the above embodiments of this application.

[0160] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the data encryption and storage method proposed in the above embodiments of this application.

[0161] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0162] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0163] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for encrypting and storing data, characterized in that, The method includes: Obtain resource status indicators of the computing system, including performance indicators related to computing power, memory, and network communication. Determine the sensitivity level of each piece of data to be saved; Based on the resource status indicators and the sensitivity level, the target encryption algorithm for the data to be saved is determined; The data to be saved is encrypted using the target encryption algorithm to obtain encrypted data, and the encrypted data is then saved to the computing system.

2. The method according to claim 1, characterized in that, The step of determining the target encryption algorithm for the data to be saved based on the resource status indicators and the sensitivity level includes: Obtain the weights of the resource status indicators and the sensitivity levels; Calculate the resource status weighted sum based on the resource status indicators and their weights; Calculate the sensitivity weighted value based on the sensitivity level and the weight of the sensitivity level; Based on the weighted sum of resource states, the weighted value of sensitivity, and the preset mapping relationship, the target encryption algorithm for the data to be saved is determined; wherein, the mapping relationship includes the correspondence between the preset encryption algorithm and the preset weighted sum of resource states and the weighted value of sensitivity.

3. The method according to claim 1, characterized in that, The step of determining the target encryption algorithm for the data to be saved based on the resource status indicators and the sensitivity level includes: The resource status level is determined based on the aforementioned resource status indicators; Based on the resource status level and the sensitivity level, the target encryption algorithm for the data to be saved is determined.

4. The method according to claim 3, characterized in that, The step of determining the target encryption algorithm for the data to be saved based on the resource status level and the sensitivity level includes: When the resource status level is sufficient and the sensitivity level is confidential, the target encryption algorithm for the data to be saved is determined to be the first encryption algorithm combination. When the resource status level is overload level and the sensitivity level is confidential level, the target encryption algorithm for the data to be saved is determined to be the second encryption algorithm combination. When the resource status level is at the extreme level and the sensitivity level is at the internal level, the target encryption algorithm for the data to be saved is determined to be the third encryption algorithm. Among them, the resources of the sufficient level, the overload level and the extreme level decrease in sequence, the sensitivity of the confidential level is higher than that of the internal level, and the encryption strength of the first encryption algorithm combination, the second encryption algorithm combination and the third encryption algorithm decreases in sequence.

5. The method according to any one of claims 1-4, characterized in that, The method further includes: If the resource status indicators of the computing system change after the data is encrypted and saved, a new target encryption algorithm is determined based on the changed resource status indicators. The encrypted data is decrypted, and the decrypted data is re-encrypted and saved using the new target encryption algorithm.

6. The method according to claim 5, characterized in that, The method further includes: If the decryption or re-encryption and saving fails, an alarm message will be output.

7. A data encryption and storage device, characterized in that, The device includes: The acquisition module is used to acquire resource status indicators of the computing system, including performance indicators related to computing power, memory and network communication. The first determination module is used to determine the sensitivity level of each piece of data to be saved; The second determining module is used to determine the target encryption algorithm for the data to be saved based on the resource status indicators and the sensitivity level. The first encryption and storage module is used to encrypt the data to be saved using the target encryption algorithm to obtain encrypted data, and then save the encrypted data to the computing system.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images