Data encryption system, method, device and equipment

Abstract

The invention discloses a data encryption system, method, device and equipment, and relates to the technical field of encryption, and the data encryption system comprises a data cache, a gateway, a password service instance and a plurality of encryption units. The gateway is used for receiving an encryption request sent by a user side, the encryption request is used for encrypting first data, and the encryption request is forwarded to the password service instance; the data cache is used for receiving and storing first data sent by a user side; the cryptographic service instance is used for receiving an encryption request, determining an encryption key and counter information based on the encryption request when the data cache receives first data, and sending the encryption key and counter information to the plurality of encryption units; the plurality of encryption units are used for receiving the encryption key and the counter information and sending a plurality of encryption results to the data cache; the data cache is also used for receiving a plurality of encryption results; and performing operation on the plurality of encryption results and the first data based on the arrangement order of the plurality of encryption results to generate encrypted data. The data encryption efficiency can be improved.

Description

Technical Field

[0001] This application relates to the field of encryption technology, and in particular to a data encryption system, method, apparatus, and device. Background Technology

[0002] When building information systems, companies typically use encryption algorithms to encrypt sensitive fields in the system to ensure system security.

[0003] In related technologies, users send encryption requests to a cryptographic service platform to invoke the encryption service to encrypt data. To ensure the standardization and security of the encryption process, it typically includes the following steps: data filtering and inspection by the gateway, data format processing by the cryptographic service instance, and data caching.

[0004] However, in the above encryption process, the user's data needs to be transmitted multiple times internally before reaching the encryption unit, and the data encryption process can only be carried out after the complete data is obtained. The data encryption process consumes a lot of computing resources and has low efficiency. Summary of the Invention

[0005] This application provides a data encryption system, method, apparatus, and device that can improve the efficiency of data encryption. The technical solution is as follows:

[0006] On the one hand, a data encryption system is provided, which includes a data cache, a gateway, a cryptographic service instance, and multiple encryption units;

[0007] The gateway is configured to receive an encryption request sent by the user terminal, the encryption request being used to encrypt the first data; and forward the encryption request to the cryptographic service instance.

[0008] The data cache is used to receive and store the first data sent by the user terminal;

[0009] The cryptographic service instance is used to receive the encryption request; when the data cache receives the first data, it determines the encryption key and counter information based on the encryption request; and sends the encryption key and counter information to the plurality of encryption units, wherein the encryption key and the counter information are used to indicate the method of encrypting the first data, and the counter information includes configuration information of a plurality of counters.

[0010] The plurality of encryption units are configured to receive the encryption key and the counter information; wherein, the i-th encryption unit generates the i-th encryption result based on the encryption key and the counter information, resulting in a plurality of encryption results generated by the plurality of encryption units respectively, the plurality of encryption results being used to generate encrypted data, where i is a positive integer; the plurality of encryption results are sent to the data buffer; the data buffer is further configured to receive the plurality of encryption results; and to perform operations on the plurality of encryption results and the first data based on the order of the plurality of encryption results to generate the encrypted data.

[0011] On the other hand, a data encryption method is provided, the method comprising:

[0012] Receive an encryption request, the encryption request being used to encrypt the first data;

[0013] When the data cache receives the first data, it determines an encryption key and counter information based on the encryption request. The encryption key and the counter information are used to indicate the method of encrypting the first data. The counter information includes configuration information for multiple counters.

[0014] The encryption key and counter information are sent to multiple encryption units, which are used to receive the encryption key and the counter information; wherein, the i-th encryption unit generates the i-th encryption result based on the encryption key and the counter information, and multiple encryption results generated by the multiple encryption units are obtained respectively, and the multiple encryption results are used to generate encrypted data, where i is a positive integer.

[0015] On the other hand, a data encryption device is provided, the device comprising:

[0016] A receiving module is used to receive an encryption request, the encryption request being used to encrypt the first data;

[0017] An information determination module is used to determine an encryption key and counter information based on the encryption request when the data cache receives the first data. The encryption key and the counter information are used to indicate the method of encrypting the first data. The counter information includes configuration information of multiple counters.

[0018] A sending module is used to send the encryption key and counter information to multiple encryption units, and the multiple encryption units are used to receive the encryption key and the counter information; wherein, the i-th encryption unit generates the i-th encryption result based on the encryption key and the counter information, and obtains multiple encryption results generated by the multiple encryption units respectively, and the multiple encryption results are used to generate encrypted data, where i is a positive integer.

[0019] On the other hand, a computer device is provided, the computer device including a processor and a memory, the memory storing at least one instruction, at least one program, code set or instruction set, the at least one instruction, the at least one program, the code set or instruction set being loaded and executed by the processor to implement the data encryption method as described in any of the embodiments of this application above.

[0020] On the other hand, a computer-readable storage medium is provided, wherein at least one instruction, at least one program, code set, or instruction set is stored therein, wherein the at least one instruction, the at least one program, the code set, or the instruction set is loaded and executed by a processor to implement the data encryption method as described in any of the embodiments of this application above.

[0021] On the other hand, a computer program product or computer program is provided, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform any of the data encryption methods described in the above embodiments.

[0022] The beneficial effects of the technical solutions provided in this application include at least the following:

[0023] When a user requests encryption of the first data, the data cache and cryptographic service instance in the data encryption system can be invoked simultaneously. This generates the data stream required for encryption during data storage, improving encryption efficiency. The first data only needs to be directly uploaded to the data cache. Compared to related technologies where the first data requires multiple complete transmissions before encryption can be performed, this reduces overall resource consumption during data transmission. Using multiple encryption units to encrypt different parts of the first data balances the workload of each unit and improves the security of the encryption result. Attached Figure Description

[0024] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0025] Figure 1 This is a schematic diagram of a data encryption system provided in an exemplary embodiment of this application;

[0026] Figure 2This is a schematic diagram illustrating the correspondence between the first data after it has been divided and multiple counters, provided in an exemplary embodiment of this application.

[0027] Figure 3 This is a flowchart of a data encryption method provided in an exemplary embodiment of this application;

[0028] Figure 4 This is a flowchart of a data encryption method provided in another exemplary embodiment of this application;

[0029] Figure 5 This is a structural block diagram of a data encryption device provided in an exemplary embodiment of this application;

[0030] Figure 6 This is a structural block diagram of a computer device provided in an exemplary embodiment of this application. Detailed Implementation

[0031] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0032] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0033] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used in this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.

[0034] It should be noted that all information and data involved in this application are authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0035] It should be understood that although the terms first, second, etc., may be used in this application to describe various information, this information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, a first parameter may also be referred to as a second parameter, and similarly, a second parameter may also be referred to as a first parameter. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0036] In the construction of modern enterprise information systems, to meet confidentiality requirements, companies typically use encryption algorithms to encrypt sensitive fields within the system. Choosing a unified cryptographic service platform allows users to easily invoke encryption services to encrypt data, meeting the encryption needs of large volumes of data.

[0037] In common encryption services, when a cryptographic service platform receives an encryption request from a user, it selects an appropriate key and transmits the key and user data to a secure encryption unit, such as a server encryption machine (Hardware Security Module, HSM, also known as a hardware security module) or an encryption server instance.

[0038] However, in this process, user data needs to be transmitted or pass through multiple components of the cryptographic service platform, including gateways, cryptographic service instances, and data caches, before finally reaching the encryption unit. Each component needs to receive the complete user data, leading to an increase in the overall cost of data encryption. Furthermore, the encryption unit can only perform the encryption operation when the data finally arrives; the transmission and encryption processes have a sequential order, and the data transmission rate affects the overall efficiency of data encryption.

[0039] This application provides a data encryption system that can simultaneously realize the data transmission and encryption process, improve the overall efficiency of data encryption, eliminate the need for data to be received completely multiple times, and solve the problem of high computational resource consumption.

[0040] The data encryption system involved in the embodiments of this application is described in an illustrative manner. Please refer to [the relevant documentation]. Figure 1 , Figure 1 This is a schematic diagram of a data encryption system.

[0041] The data encryption system 100 includes the following components: data cache 110, gateway 120, cryptographic service instance 130, and multiple encryption units 140. Figure 1 In the middle, the multiple encryption units 140 include encryption unit U1 and encryption unit U2.

[0042] The process by which the data encryption system 100 encrypts the first data uploaded by the user terminal 101 is as follows:

[0043] Gateway 120 receives an encryption request sent by client 101. The encryption request is used to encrypt the first data. Gateway 120 forwards the encryption request to cryptographic service instance 130. The first data refers to the data to be encrypted.

[0044] Data cache 110 receives and stores the first data sent by client 101.

[0045] Cryptographic service instance 130 receives an encryption request. When data cache 110 receives the first data, it determines the encryption key and counter information based on the encryption request.

[0046] Cryptographic service instance 130 calls multiple encryption units 140 to generate encryption results: Cryptographic service instance 130 sends encryption key and counter information to multiple encryption units 140. The encryption key and counter information are used to indicate the method of encrypting the first data. The counter information contains configuration information of multiple counters.

[0047] Multiple encryption units 140 receive encryption keys and counter information. The i-th encryption unit generates the i-th encryption result based on the encryption key and counter information, resulting in multiple encryption results generated by the multiple encryption units 140. These multiple encryption results are used to generate encrypted data, where i is a positive integer. The multiple encryption units 140 send the multiple encryption results to the data buffer 110.

[0048] Data cache 110 receives multiple encryption results, performs operations on the multiple encryption results and the first data based on the order of the multiple encryption results, and generates encrypted data.

[0049] The data encryption system 100 separates the receiving and encryption processes of the first data. The data cache 110 receives the complete first data, and at the same time, the cryptographic service instance 130 calls multiple encryption units 140 to generate a key stream (encryption result). The key stream is sent to the data cache 110, and the data cache 110 combines the first data with the key stream to generate the final encrypted data. This encrypted data is the data after encrypting the first data.

[0050] In this process, the gateway 120 sends encryption instruction information to the user terminal 101 based on the encryption request. The encryption instruction information is used to instruct the user terminal 101 to send the first data to the data cache 110 and to request the user terminal 101 to determine the key information. The key information is used to determine the encryption key.

[0051] Gateway 120 receives key information sent by user terminal 101. The key information is generated by user terminal 101 based on encryption instruction information. The key information includes key identifier and data length information of first data. The key identifier is used to locate the encryption key in the data encryption system.

[0052] Gateway 120 sends key information to cryptographic service instance 130; cryptographic service instance 130 receives key information. When data buffer 110 receives the first data, cryptographic service instance 130 determines encryption key and counter information based on the key information.

[0053] Multiple encryption units 140 divide multiple counters into multiple groups to obtain multiple counter groups, each counter group containing at least one counter; based on the encryption key, the multiple counter groups are encrypted to obtain multiple encryption results, wherein there is a correspondence between the multiple encryption units 140 and the multiple counter groups, and the i-th encryption unit is used to encrypt the i-th counter group to obtain the i-th encryption result.

[0054] The data lengths of multiple encrypted results match the data length of the first data, and the multiple encrypted results also include the starting value of the first counter among multiple counters.

[0055] Data cache 110 performs an XOR operation on multiple encrypted results and first data based on the order of multiple encrypted results to generate encrypted data; the starting value of the first counter and the encrypted data are sent to the user terminal 101. The starting value of the first counter is used to guide the decryption of the encrypted data to obtain the first data.

[0056] The encryption key involved can be a key uploaded by the user terminal 101; or a key determined by the cryptographic service instance 130 based on the key identifier after the user terminal 101 uploads the key identifier; or, the encryption key can be a key automatically generated by the cryptographic service instance 130 based on the first data. This embodiment does not limit the method of obtaining the encryption key.

[0057] Optionally, the example is taken as an encryption key determined based on the key identifier uploaded by the user terminal 101.

[0058] For example, when user terminal 101 initiates a data encryption request to data encryption system 100, gateway 120 will ask user terminal 101 to provide information such as the key identifier required for encryption and the length of the first data, and according to the status of data cache 110, ask user terminal 101 to transmit the first data to data cache 110.

[0059] While the user terminal 101 uploads the first data, the gateway 120 sends the data length information and key identifier of the first data to the cryptographic service instance 130. The cryptographic service instance 130 confirms the encryption key and calls multiple encryption units 140 to perform encryption operations.

[0060] In this process, the cryptographic service instance 130 needs to determine the counter information: the size of each counter group (e.g., 16 bytes), the starting value of each counter (e.g., 0xdc19e6dc 19e6dc17 e6dc19e600000001), and the increment of the counter by 1 for each generated group (e.g., the second group is 0xdc19e6dc19e6dc17 e6dc19e6 00000002). The cryptographic service instance 130 concatenates multiple counters until the length of the concatenated counters matches the length of the first data. After confirming the counter information, multiple encryption units 140 perform group encryption on the multiple counters. When the cryptographic service instance 130 can call multiple encryption units 140, it can separate the counters and encrypt them in different encryption units. The cryptographic service instance 130 needs to ensure that different encryption units do not encrypt the same counter (e.g., encryption unit U1 encrypts counters with sequence numbers 0-9, and encryption unit U2 encrypts counters with sequence numbers 10-10).

[0061] For multiple encryption units 140, each encryption unit encrypts its assigned counter group to obtain the corresponding encryption result. After the cryptographic service instance 130 collects the multiple encryption results generated by all encryption units, it obtains key stream data. The key stream data can be combined with the first data to generate encrypted data.

[0062] The multiple encryption results are arranged in a specific order, determined by the sequence of multiple counters. Multiple encryption units 140 send the encryption results to a data buffer 110, which then performs an XOR operation between the encryption results and the first data according to the order. For example, there are 10 counters divided into two groups: the first group contains counters numbered 0-4, and the second group contains counters numbered 5-9. Encryption unit U1 in the multiple encryption units 140 encrypts the counters in the first group to obtain the first encryption result; encryption unit U2 in the multiple encryption units 140 encrypts the counters in the second group to obtain the second encryption result. During encryption, the first data is divided into two parts: a first part and a second part. The first part is XORed with the first encryption unit, and the second part is XORed with the second encryption unit.

[0063] When all encryption results have undergone an XOR operation with the first data, the encryption request from client 101 is completed, generating encrypted data. At this point, data encryption system 100 prompts client 101 to download the encrypted data from data cache 110. The finally downloaded encrypted data is a digital envelope containing the encrypted data required by client 101 and the starting value of the first counter. For example, the first counter refers to the first counter.

[0064] Indicative, such as Figure 2 As shown, Figure 2 This is a schematic diagram showing the correspondence between the first data after it has been divided and multiple counters.

[0065] The first data uploaded by the user client 200 has a certain length. The first data 210 is randomly divided into 8 sub-data groups: first sub-data 211, second sub-data 212, third sub-data 213, fourth sub-data 214, fifth sub-data 215, sixth sub-data 216, seventh sub-data 217, and eighth sub-data 218.

[0066] Each set of sub-data is encrypted using a counter, and there are a total of 8 counters: first counter 221, second counter 222, third counter 223, fourth counter 224, fifth counter 225, sixth counter 226, seventh counter 227, and eighth counter 228.

[0067] Among them, the first counter 221 is used to encrypt the first sub-data 211, the second counter 222 is used to encrypt the second sub-data 212, and so on.

[0068] For example, encryption units U1 and U2 are invoked to perform encryption, and the above 8 counters are grouped into two groups. The first group is encrypted by encryption unit U1 and includes the first counter 221, the second counter 222, the third counter 223, and the fourth counter 224. The second group is encrypted by encryption unit U2 and includes the fifth counter 225, the sixth counter 226, the seventh counter 227, and the eighth counter 228.

[0069] After encryption unit U1 and encryption unit U2 have finished encrypting all counters, they obtain encryption results corresponding to the 8 sets of sub-data / 8 types of counters respectively. For example, the first encryption result corresponds to the first sub-data 211 and the first counter 221, the second encryption result corresponds to the second sub-data 212 and the second counter 222, and so on.

[0070] These encryption results will be Figure 1 The cryptographic service instance 130 / multiple encryption units 140 are transmitted to the data cache 110, and XORed with the first data in the data cache 110 to finally generate encrypted data.

[0071] The operation process is illustrated using the first encrypted result and the first sub-data 211 as an example. The operation process between the remaining encrypted data and sub-data is the same.

[0072] The lengths of the first encryption result and the first sub-data 211 are matched. Each bit of the first encryption result and the first sub-data 211 are XORed. Taking the j-th bit as an example, if the j-th bit value of the first encryption result is the same as the j-th bit value of the first sub-data 211, then the j-th bit result in the encrypted data is 0; if the j-th bit value of the first encryption result is different from the j-th bit value of the first sub-data 211, then the j-th bit result in the encrypted data is 1, where j is a positive integer; and so on, to obtain the first group of sub-results in the encrypted data.

[0073] The above operations are performed on each group of sub-data to obtain eight groups of sub-results. These sub-results are then concatenated in order to obtain encrypted data, which is represented as a string of binary numbers.

[0074] In some embodiments, if other encryption algorithms are used to encrypt the first data, the form of the encrypted data will also be different.

[0075] It is worth noting that, such as Figure 1 As shown, the data decryption process is the same as the encryption process. User terminal 101 uploads encrypted data to data cache 110 and submits the value of the first counter in the digital envelope. Cryptographic service instance 130 repeats the above encryption process based on the value of the first counter provided by user terminal 101, and sends all encryption results to data cache 110. It then performs an XOR operation with the encrypted data uploaded by user terminal 101 to obtain the original first data, which is then provided to user terminal 101 for download.

[0076] Optionally, the data cache 110 receives and stores the encrypted data sent by the user terminal 101, and the cryptographic service instance 130 receives the decryption request and the starting value of the first counter sent by the user terminal 101. The decryption request is used to decrypt the encrypted data to obtain the first data. The cryptographic service instance 130 obtains decryption information based on the decryption request and the starting value of the first counter, and sends the decryption information to multiple encryption units 140.

[0077] Multiple encryption units 140 receive decryption information, generate decryption stream data based on the decryption information, use the decryption stream data to decrypt encrypted data, and send the decryption stream data to the data buffer 110.

[0078] Data cache 110 receives decrypted stream data and obtains the first data based on the decrypted stream data and encrypted data.

[0079] In this data encryption system, multiple components can be manifested as hardware or software (e.g., an application program), and these components can be deployed on a server or terminal. The aforementioned user terminal refers to a client logged in with a user account.

[0080] Based on the above description of terms and application scenarios, the data encryption method provided in this application is explained. This method is executed by a data encryption system, which includes a data cache, a gateway, a cryptographic service instance, and multiple encryption units. For example... Figure 3 As shown, Figure 3 This is a flowchart of a data encryption method provided in an exemplary embodiment of this application. The method includes the following steps.

[0081] Step 310: Receive the encryption request sent by the user through the gateway and forward the encryption request to the cryptographic service instance.

[0082] The encryption request is used to encrypt the first data, which is the content to be encrypted uploaded by the user on the user's end.

[0083] In this embodiment, the gateway can act as an interface between the data encryption unit and the user terminal. Without directly processing the data, it is responsible for routing, managing and forwarding encryption requests to ensure the security of the encryption process.

[0084] After receiving an encryption request, the data encryption system sends encryption instruction information to the user terminal through the gateway. The encryption instruction information is used to instruct the user terminal to send the first data to the data cache and to request the user terminal to determine the key information, which is used to determine the encryption key. After the user terminal sends an encryption request to the data encryption system, it sends the first data to the data cache.

[0085] The gateway receives key information sent by the user. The key information is generated by the user based on the encryption instruction information. The key information contains a key identifier and the data length information of the first data. The key identifier is used to locate the encryption key in the data encryption system.

[0086] The key information is represented by a key identifier, which can be user-defined.

[0087] For example, an 8-digit number randomly composed of numbers, English characters, punctuation marks, etc. The encryption key is a parameter used in the encryption and decryption process to determine the encrypted result output by the encryption unit. The key can be a number, a string, or any other form of data.

[0088] For example, the key identifier can be calculated and expanded based on a preset key generation algorithm / function to obtain a key with a length that meets the preset requirements. For instance, a hash function can be used to process the key identifier to generate a hash value of a fixed length, which can be used as an encryption key.

[0089] In this embodiment, when multiple encryption units encrypt the counter, they use an encryption algorithm based on the encryption key to iteratively change the value of the counter. During this process, the encryption key is combined with the value of the counter to generate the key stream data required for encryption. The key stream data is used to perform operations with the first data to obtain the encrypted data required by the user.

[0090] Step 320: Receive and store the first data sent by the user terminal through a data cache.

[0091] In the field of encryption technology, data caching refers to temporarily storing data on a faster storage medium for quick access and processing. Data caching can improve performance, reduce latency, and alleviate pressure on main storage resources during the encryption process.

[0092] The first data is sent directly to the data cache. Once the key stream data is generated, the data cache can directly combine the first data and the key stream data to obtain encrypted data.

[0093] This process involves only one complete data transmission. Compared to related technologies, which sequentially transmit the first data (the data to be encrypted) to the gateway, the cryptographic service instance, the cache, and finally to the encryption unit, where the encryption unit generates key stream data based on the complete data and combines the key stream data with the first data, this method can alleviate the problem of high resource consumption caused by multiple complete data transmissions. It separates the data transmission and key stream data generation processes, thereby improving encryption efficiency.

[0094] Step 331: Receive the encryption request through the cryptographic service instance.

[0095] The encryption request is forwarded by the gateway.

[0096] Step 332: When the data cache receives the first data, the cryptographic service instance determines the encryption key and counter information based on the encryption request.

[0097] The encryption key and counter information are used to indicate the method of encrypting the first data, and the counter information contains configuration information for multiple counters.

[0098] Step 333: Send encryption key and counter information to multiple encryption units through the cryptographic service instance.

[0099] Cryptographic service instances are functional modules or components implemented in software or hardware specifically designed to perform encryption and decryption operations. These instances can be standalone services, libraries, or hardware devices used to provide secure data protection features.

[0100] In the field of cryptography, a counter is a numerical value used to generate keystream data; this value increments with each encryption operation.

[0101] Optionally, the starting value and change range of each of the multiple counters are determined by the cryptographic service instance to obtain the configuration information of the multiple counters. The multiple counters are then concatenated based on the data length information of the first data in the key information to obtain the counter information, wherein the length of the concatenated multiple counters matches the data length information of the first data.

[0102] For example, if the size of the concatenated counters is the same as the size of the first data, then the length of the concatenated counters is considered to match the data length information.

[0103] Step 340: Receive encryption key and counter information through multiple encryption units.

[0104] In this process, the i-th encryption unit generates the i-th encryption result based on the encryption key and counter information, resulting in multiple encryption results generated by multiple encryption units. These multiple encryption results are used to generate encrypted data, where i is a positive integer.

[0105] Optionally, multiple encryption units divide multiple counters into multiple groups to obtain multiple counter groups, and each counter group contains at least one counter.

[0106] For example, there are 20 counters, and 20 encryption units are called to encrypt the counters. The counters and encryption units are each numbered 0-19. Each encryption unit encrypts the counters with the same number and generates different encryption results.

[0107] For example, there are 10 counters in total. Four encryption units are called to encrypt the counters. The counters are grouped according to their lengths to obtain four counter groups. The length of each counter group is the same (the lengths of the counters in the group are added together). Different encryption units randomly encrypt one of the counter groups.

[0108] For example, multiple counters are randomly grouped, and each encryption unit is randomly assigned to at least one counter group for encryption. For instance, if there are 10 counters, they are randomly divided into 4 groups: the first group contains counters 1 and 2; the second group contains counters 3, 4, and 5; the third group contains counter 6; and the fourth group contains counters 7, 8, 9, and 10. Two encryption units are then invoked to encrypt the counters. Encryption unit U1 encrypts the first group of counters, and encryption unit U2 encrypts the second, third, and fourth groups of counters.

[0109] Multiple counter groups are encrypted using an encryption key to obtain multiple encryption results. There is a correspondence between the multiple encryption units and the multiple counter groups. The i-th encryption unit is used to encrypt the i-th counter group to obtain the i-th encryption result.

[0110] That is, each encryption unit encrypts a different counter. The encryption unit calls a preset encryption algorithm and encrypts the counter based on the encryption key to obtain the encryption result. These encryption results are arranged in order to form a key stream data that is directly combined with the first data.

[0111] The process of generating encrypted data refers to the process of combining the encryption result with the first data. For example, the first data is divided into three sub-data segments according to length. Each sub-data segment is XORed with a different encryption result to obtain partial encrypted data. After the encrypted data corresponding to all sub-data segments is generated, they are integrated to obtain the encrypted data corresponding to the first data.

[0112] For example, encryption unit U1 is called to encrypt the sequentially arranged counters 1 and 2 to obtain a first encryption result. The first encryption result is XORed with the first segment of data in the first data to obtain the first part of encrypted data. Encryption unit U2 is called to encrypt the sequentially arranged counters 3 to obtain a second encryption result. The second encryption result is XORed with the second segment of data in the first data to obtain the second part of encrypted data. Encryption unit U3 is called to encrypt the sequentially arranged counters 4 and 5 to obtain a third encryption result. The third encryption result is XORed with the third segment of data in the first data to obtain the third part of encrypted data. The first part of encrypted data, the second part of encrypted data, and the third part of encrypted data are then integrated sequentially to obtain the complete encrypted data.

[0113] Step 350: Send multiple encryption results to the data cache through multiple encryption units.

[0114] After multiple encryption units generate multiple encryption results, they are directly sent to the data cache. In some embodiments, since multiple encryption units are called by a cryptographic service instance, the generated multiple encryption results can also be sent to the data cache by the cryptographic service instance.

[0115] Step 360: Receive multiple encrypted results through a data cache, and perform operations on the multiple encrypted results and the first data based on the order of the encrypted results to generate encrypted data.

[0116] The data lengths of multiple encrypted results match the data length of the first data, and the multiple encrypted results also include the starting value of the first counter among multiple counters.

[0117] By using a data cache, multiple encrypted results are XORed with the first data based on their order to generate encrypted data. The data cache then sends the initial value of the first counter and the encrypted data to the user terminal. The initial value of the first counter guides the decryption of the encrypted data to obtain the first data.

[0118] The decryption process is the same as the encryption process. The first data is replaced with the encrypted data, and the above steps are repeated to obtain the decrypted first data.

[0119] In summary, the data encryption method provided in this application allows for the simultaneous invocation of the data cache and cryptographic service instance within the data encryption system when a user requests encryption of the first data. This generates the data stream required for encryption during data storage, improving the efficiency of data encryption. The first data only needs to be directly uploaded to the data cache. Compared to related technologies where the first data requires multiple complete transmissions to achieve the encrypted data, this method reduces overall resource consumption during data transmission. Using multiple encryption units to encrypt different parts of the first data balances the workload of each encryption unit and improves the security of the encryption result.

[0120] Figure 4 This is a flowchart of a data encryption method provided by another exemplary embodiment of this application, which is executed by a cryptographic service instance and includes the following steps.

[0121] Step 410: Receive encryption request.

[0122] The encryption request is sent by the client and is used to encrypt the first data. When the client sends the encryption request to the cryptographic service instance, it also sends the first data to be encrypted to the data cache.

[0123] Step 420: When the data buffer receives the first data, determine the encryption key and counter information based on the encryption request.

[0124] The encryption key and counter information are used to indicate the method of encrypting the first data, and the counter information contains configuration information for multiple counters.

[0125] The encryption key can be uploaded by the user or generated by the cryptographic service instance using a relevant algorithm. The encryption key and counter are used to generate the encryption result. The encryption result is an important component in generating encrypted data. The data obtained by performing relevant operations on the first data to be encrypted and the encryption result is the encrypted data required by the user.

[0126] The counter information includes the starting values ​​of multiple counters, which are represented as a string of data. When responding to an encryption request from a user, the cryptographic service instance invokes multiple encryption units based on the request. These encryption units perform iterative calculations on the encryption key and counters based on an encryption algorithm. During the calculations, the starting values ​​of the counters are updated in real time. When the iteration ends, the result of the calculations on the counters is the encryption result.

[0127] Step 430: Send encryption keys and counter information to multiple encryption units.

[0128] Multiple encryption units are used to receive encryption keys and counter information.

[0129] The i-th encryption unit generates the i-th encryption result based on the encryption key and counter information, resulting in multiple encryption results generated by multiple encryption units. These multiple encryption results are used to generate encrypted data, where i is a positive integer.

[0130] For example, the counter information includes the length information and starting value of counters 1 to 4. The first data is divided into two sub-data segments, and each sub-data segment needs to be XORed with a different encryption result to obtain the encrypted data corresponding to that sub-data segment.

[0131] Since the first data is uploaded to the data cache by the user, the XOR operation is also performed by the data cache. After multiple encryption units generate multiple encryption results, the cryptographic service example will upload the multiple encryption results to the data cache. The first data in the data cache is XORed with the multiple encryption results to obtain encrypted data, which will be returned to the user.

[0132] For example, the first encryption result obtained by encrypting counter 1 and counter 2 using the first encryption unit is used to perform an XOR operation with the first segment of data to obtain the first encrypted data; the second encryption result obtained by encrypting counter 3 and counter 4 using the second encryption unit is used to perform an XOR operation with the second segment of data to obtain the second encrypted data; the first encrypted data and the second encrypted data are integrated to obtain the complete encrypted data after encrypting the first data.

[0133] In summary, the method provided in this embodiment can call multiple encryption units through a cryptographic service instance to generate the encryption result required for the encryption process. While the user uploads the data to be encrypted to the data cache, the data preparation for encryption is realized. The data cache performs unified calculations on the received data to be encrypted and the encryption result to obtain the final encrypted data, thereby improving the data encryption efficiency.

[0134] Figure 5This is a structural block diagram of a data encryption device provided in an exemplary embodiment of this application, such as... Figure 5 As shown, the device includes the following parts.

[0135] The receiving module 510 is used to receive an encryption request, the encryption request being used to encrypt the first data;

[0136] The information determination module 520 is used to determine an encryption key and counter information based on the encryption request when the data buffer receives the first data. The encryption key and the counter information are used to indicate the method of encrypting the first data. The counter information includes configuration information of multiple counters.

[0137] The sending module 530 is used to send the encryption key and counter information to multiple encryption units, and the multiple encryption units are used to receive the encryption key and the counter information; wherein, the i-th encryption unit generates the i-th encryption result based on the encryption key and the counter information, and obtains multiple encryption results generated by the multiple encryption units respectively, and the multiple encryption results are used to generate encrypted data, where i is a positive integer.

[0138] In an optional embodiment, the receiving module 510 is further configured to receive key information, the key information including a key identifier and data length information of the first data, the key identifier being used to locate the encryption key in the data encryption system.

[0139] In an optional embodiment, the information determination module 520 is further configured to determine the starting value and change range corresponding to each of the plurality of counters to obtain the configuration information of the plurality of counters; and to concatenate the plurality of counters based on the data length information of the first data in the key information to obtain the counter information, wherein the length of the concatenated plurality of counters matches the data length information of the first data.

[0140] In an optional embodiment, the receiving module 510 is further configured to receive a decryption request and the starting value of the first counter, the decryption request being used to decrypt the encrypted data to obtain the first data; and to obtain decryption information based on the decryption request and the starting value of the first counter.

[0141] In summary, the data encryption device provided in this application allows for the simultaneous invocation of the data cache and cryptographic service instance within the data encryption system when a user requests encryption of the first data. This generates the data stream required for encryption during data storage, improving the efficiency of data encryption. The first data only needs to be directly uploaded to the data cache. Compared to related technologies where the first data requires multiple complete transmissions to achieve the encryption result, this reduces the overall resource consumption during data transmission. Using multiple encryption units to encrypt different parts of the first data balances the workload of each encryption unit, improving the security of the encryption result.

[0142] It should be noted that the data encryption device provided in the above embodiments is only an example of the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the data encryption device and the data encryption method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process can be found in the method embodiments, which will not be repeated here.

[0143] Figure 6 This illustration shows a structural block diagram of a computer device 600 provided in an exemplary embodiment of this application. The computer device 600 may be a smartphone, tablet computer, MP3 player (Moving Picture Experts Group Audio Layer III), MP4 player (Moving Picture Experts Group Audio Layer IV), laptop computer, or desktop computer. The computer device 600 may also be referred to as a user device, portable terminal, laptop terminal, desktop terminal, or other names.

[0144] Typically, computer device 600 includes a processor 601 and a memory 602.

[0145] Processor 601 may include one or more processing cores, such as a quad-core processor, an octa-core processor, etc. Processor 601 may be implemented using at least one hardware form selected from DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). Processor 601 may also include a main processor and a coprocessor. The main processor, also known as a CPU (Central Processing Unit), is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, processor 601 may integrate a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the screen. In some embodiments, processor 601 may also include an AI (Artificial Intelligence) processor, which is used to handle computational operations related to machine learning.

[0146] The memory 602 may include one or more computer-readable storage media, which may be non-transitory. The memory 602 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices or flash memory devices. In some embodiments, the non-transitory computer-readable storage media in the memory 602 are used to store at least one instruction, which is executed by the processor 601 to implement the data encryption method provided in the method embodiments of this application.

[0147] In some embodiments, the computer device 600 also includes other components 603, the type and number of which can be selected based on the functional needs of the computer device 600. Those skilled in the art will understand that... Figure 6 The structure shown does not constitute a limitation on the computer device 600, and may include more or fewer components than shown, or combine certain components, or use different component arrangements.

[0148] Optionally, the computer-readable storage medium may include: read-only memory (ROM), random access memory (RAM), solid-state drives (SSDs), or optical discs, etc. The random access memory may include resistive random access memory (ReRAM) and dynamic random access memory (DRAM). The sequence numbers of the embodiments in this application are merely descriptive and do not represent the superiority or inferiority of the embodiments.

[0149] This application also provides a computer device, which includes a processor and a memory. The memory stores at least one instruction, at least one program, a code set, or an instruction set. The at least one instruction, the at least one program, the code set, or the instruction set is loaded and executed by the processor to implement the data encryption method as described in any of the above embodiments of this application.

[0150] This application also provides a computer-readable storage medium storing at least one instruction, at least one program, code set, or instruction set, wherein the at least one instruction, the at least one program, the code set, or the instruction set is loaded and executed by a processor to implement the data encryption method as described in any of the above embodiments of this application.

[0151] This application also provides a computer program product or computer program that includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform any of the data encryption methods described in the above embodiments.

[0152] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware or by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk.

[0153] The above description is merely an optional embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A data encryption system, characterized in that, The data encryption system includes a data cache, a gateway, a cryptographic service instance, and multiple encryption units; The gateway is configured to receive an encryption request sent by a user, the encryption request being used to request encryption of first data; and to forward the encryption request to the cryptographic service instance. The data cache is used to receive and store the first data sent by the user terminal; The cryptographic service instance is used to receive the encryption request; When the data buffer receives the first data, it determines the encryption key and counter information based on the encryption request; The encryption key and counter information are sent to the plurality of encryption units. The encryption key and the counter information are used to indicate the method of encrypting the first data. The counter information includes configuration information of a plurality of counters. The plurality of encryption units are used to receive the encryption key and the counter information; wherein, the i-th encryption unit generates the i-th encryption result based on the encryption key and the counter information, thereby obtaining a plurality of encryption results generated by the plurality of encryption units respectively, the plurality of encryption results being used to generate encrypted data, i being a positive integer; and the plurality of encryption results being sent to the data buffer; The data cache is also used to receive the plurality of encryption results; and to perform operations on the plurality of encryption results and the first data based on the order of the plurality of encryption results to generate the encrypted data.

2. The data encryption system according to claim 1, characterized in that, The gateway is further configured to send encryption indication information to the user terminal based on the encryption request. The encryption indication information is used to instruct the user terminal to send the first data to the data cache and to request the user terminal to determine key information. The key information is used to determine the encryption key. The gateway is also used to receive key information sent by the user terminal. The key information is generated by the user terminal based on the encryption indication information. The key information includes a key identifier and the data length information of the first data. The key identifier is used to locate the encryption key in the data encryption system.

3. The data encryption system according to claim 2, characterized in that, The gateway is also used to send the key information to the cryptographic service instance; The cryptographic service instance is also used to receive the key information; and when the data cache receives the first data, to determine the encryption key and the counter information based on the key information.

4. The data encryption system according to claim 2, characterized in that, The cryptographic service instance is further configured to determine the starting value and change range of each of the plurality of counters to obtain the configuration information of the plurality of counters; and to concatenate the plurality of counters based on the data length information of the first data in the key information to obtain the counter information, wherein the length of the concatenated plurality of counters matches the data length information of the first data.

5. The data encryption system according to any one of claims 1 to 4, characterized in that, The plurality of encryption units are used to divide the plurality of counters into multiple groups to obtain multiple counter groups, each counter group containing at least one counter; and to encrypt the plurality of counter groups based on the encryption key to obtain the plurality of encryption results, wherein there is a correspondence between the plurality of encryption units and the plurality of counter groups, and the i-th encryption unit is used to encrypt the i-th counter group to obtain the i-th encryption result.

6. The data encryption system according to any one of claims 1 to 4, characterized in that, The data lengths of the multiple encryption results match the data length of the first data, and the multiple encryption results also include the starting value of the first counter among the multiple counters; The data cache is further configured to perform an XOR operation on the multiple encryption results and the first data based on the order of the multiple encryption results to generate the encrypted data; and to send the starting value of the first counter and the encrypted data to the user terminal, wherein the starting value of the first counter is used to guide the decryption of the encrypted data to obtain the first data.

7. The data encryption system according to claim 6, characterized in that, The data cache is also used to receive and store encrypted data sent by the user terminal; The cryptographic service instance is further configured to receive a decryption request sent by the user terminal and the starting value of the first counter, wherein the decryption request is used to decrypt the encrypted data to obtain the first data; Decryption information is obtained based on the decryption request and the starting value of the first counter; The decryption information is sent to the plurality of encryption units; The plurality of encryption units are further configured to receive the decryption information; generate decryption stream data based on the decryption information, the decryption stream data being used to decrypt the encrypted data; and send the decryption stream data to the data buffer. The data cache is also used to receive the decrypted stream data; and to obtain the first data based on the decrypted stream data and the encrypted data.

8. A data encryption method, characterized in that, The method includes: Receive an encryption request, the encryption request being used to encrypt the first data; When the data cache receives the first data, it determines an encryption key and counter information based on the encryption request. The encryption key and the counter information are used to indicate the method of encrypting the first data. The counter information includes configuration information for multiple counters. The encryption key and counter information are sent to multiple encryption units, which are used to receive the encryption key and the counter information; wherein, the i-th encryption unit generates the i-th encryption result based on the encryption key and the counter information, and multiple encryption results generated by the multiple encryption units are obtained respectively, and the multiple encryption results are used to generate encrypted data, where i is a positive integer.

9. A data encryption device, characterized in that, The device includes: A receiving module is used to receive an encryption request, the encryption request being used to encrypt the first data; An information determination module is used to determine an encryption key and counter information based on the encryption request when the data cache receives the first data. The encryption key and the counter information are used to indicate the method of encrypting the first data. The counter information includes configuration information of multiple counters. A sending module is used to send the encryption key and counter information to multiple encryption units, and the multiple encryption units are used to receive the encryption key and the counter information; wherein, the i-th encryption unit generates the i-th encryption result based on the encryption key and the counter information, and obtains multiple encryption results generated by the multiple encryption units respectively, and the multiple encryption results are used to generate encrypted data, where i is a positive integer.

10. A computer device, characterized in that, The computer device includes a processor and a memory, the memory storing at least one program, which is loaded and executed by the processor to implement the data encryption method as described in claim 8.

Images