Data isolation method, device, system, equipment and medium based on encryption algorithm

Abstract

The application provides a data isolation method, device, system, equipment and medium based on an encryption algorithm, comprising: obtaining a plurality of to-be-stored service data, determining a data level of the service data based on a feature field of the service data, and searching for a corresponding encryption master key based on the data level; calling a threshold secret sharing algorithm to split each encryption master key into a plurality of threshold key fragments according to the data level; searching for a corresponding target data storage pool based on the feature field of the service data, and dividing a plurality of data areas in the target data storage pool according to the number of threshold key fragments; after encrypting the service data by using the encryption master key to obtain encrypted data, storing each encrypted data and a plurality of corresponding threshold key fragments into the plurality of data areas, so that the plurality of service data are stored in isolation. The application stores the ciphertext and each key fragment into an isolated data area respectively, realizes hierarchical and domain isolation storage of multiple types of service data, and reduces the risk of data loss and theft.

Description

Technical Field

[0001] This application relates to the field of data processing, and in particular to a data isolation method, apparatus, system, device, and medium based on an encryption algorithm. Background Technology

[0002] With the rapid advancement of digitalization, online business and online transaction services are becoming increasingly widespread. In addition to transaction and service-related data, online services and transactions also involve highly sensitive data such as customer ID cards, bank cards, account balances, transaction records, credit information, and asset and liability details. To ensure customer data security, encryption is necessary.

[0003] One common data processing method is to extract feature data fields from various types of business data, aggregate and classify them according to the feature data fields to determine the data type, and call different encryption algorithms to encrypt the data based on the level corresponding to the data type, thereby distinguishing different data and ensuring the security of sensitive data.

[0004] However, the above method has the following technical problems: encrypted ciphertexts of different security levels are stored uniformly in the same database, object storage bucket, or file directory, and data levels are distinguished only by field tags. Once the storage account is stolen or the backend authentication mechanism fails, attackers can batch-read all ciphertexts, including ordinary logs, sensitive user information, and core credit information, which can easily lead to large-scale data theft and has weak security protection capabilities. Summary of the Invention

[0005] In view of the aforementioned problems, this application is made to provide a data isolation method, apparatus, system, device, and medium based on an encryption algorithm that overcomes or at least partially solves the aforementioned problems, comprising: A data isolation method based on an encryption algorithm, the method comprising: When acquiring several pieces of business data to be stored, the data level of the business data is determined based on the feature fields of the business data, and the corresponding encryption master key is found based on the data level; The threshold secret sharing algorithm is invoked to split each of the encrypted master keys into several threshold key fragments according to the data level; Based on the characteristic fields of the business data, the corresponding target data storage pool is found, and multiple data areas are divided in the target data storage pool according to the number of threshold key fragments; After encrypting the business data using the encryption master key to obtain encrypted data, each encrypted data and the corresponding threshold keys are fragmented and stored in the multiple data areas to isolate the multiple business data.

[0006] Optionally, the threshold secret sharing algorithm is invoked to split each of the encryption master keys into several threshold key fragments according to the data level, including: A first identifier ID is generated using the data level and the ID of the business data, and the level value of the data level is determined. The first quantity value is calculated using the number of fields of the level value and the first identifier ID. Based on the first quantity value, the threshold secret sharing algorithm is called to split the encryption master key corresponding to each business data into several first key fragments. The first identifier ID is bound to each of the first key fragments to obtain several threshold key fragments.

[0007] Optionally, the threshold secret sharing algorithm is invoked to split each of the encryption master keys into several threshold key fragments according to the data level, including: Determine the data capacity value of the business data, and generate a second identifier ID using the data capacity value and the ID of the business data; Calculate a second quantity value using the data level and the data capacity value, and then use the threshold secret sharing algorithm to split the encryption master key corresponding to each business data into several second key fragments based on the second quantity value; The second identifier ID is bound to each of the second key fragments to obtain several threshold key fragments.

[0008] Optionally, the step of finding the corresponding target data storage pool based on the feature fields of the business data, and dividing the target data storage pool into multiple data regions according to the number of threshold key shards, includes: Calculate the similarity between the feature fields of each business data and the description fields of several preset data storage pools to obtain several field similarities; Target similarities that meet preset similarity conditions are filtered from several fields of similarity, and the preset data storage pool corresponding to the target similarity is determined as the target data storage pool; The number of partitions is determined based on the number of threshold key fragments and the communication protocol of the target data storage pool; The target data storage pool is divided into multiple data regions according to the specified number of divisions.

[0009] Optionally, determining the number of partitions based on the number of threshold key fragments and the communication protocol of the target data storage pool includes: The transmission capacity of a single data transmission and the total data capacity of the service data are determined based on the communication protocol of the target data storage pool. The amount of data stored is determined based on the comparison between the transmission capacity and the total data capacity; The sum of the number of data storage units and the number of threshold key fragments is calculated to obtain the number of partitions.

[0010] Optionally, the plurality of data areas include: at least one business area for storing encrypted data and several fragment areas for storing the threshold key fragments; After encrypting the business data using the encryption master key to obtain encrypted data, each piece of encrypted data and its corresponding plurality of threshold keys are fragmented and stored in the plurality of data regions, including: The business data is encrypted using a preset encryption algorithm based on the encryption master key to obtain encrypted data; The encrypted data is stored in the business area, and the several threshold key fragments are stored in several fragment areas respectively.

[0011] A data isolation device based on an encryption algorithm, the device comprising: The determination module is used to determine the data level of a business data based on the feature fields of the business data when acquiring a number of business data to be stored, and to find the corresponding encryption master key based on the data level; The splitting module is used to call the threshold secret sharing algorithm to split each of the encrypted master keys into several threshold key fragments according to the data level; The partitioning module is used to find the corresponding target data storage pool based on the feature fields of the business data, and to divide the target data storage pool into multiple data regions according to the number of threshold key fragments. An isolation module is used to encrypt the business data using the encryption master key to obtain encrypted data, and then to fragment and store each piece of encrypted data and the corresponding threshold keys into the multiple data areas, so as to isolate and store the multiple pieces of business data.

[0012] A data isolation system based on an encryption algorithm, the system comprising: a data processing platform and several data storage clusters, wherein the data processing platform is communicatively connected to each data storage cluster; The data storage cluster is suitable for the data isolation method based on encryption algorithms as described above.

[0013] An apparatus includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program, when executed by the processor, implements the steps of the data isolation method based on the encryption algorithm as described above.

[0014] A computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the data isolation method based on the encryption algorithm described above.

[0015] This application has the following advantages: In the embodiments of this application, several pieces of business data to be stored can be acquired. The data level of the business data is determined based on its characteristic fields, and the corresponding encryption master key is found based on the data level. A threshold secret sharing algorithm is invoked to split each encryption master key into several threshold key fragments according to the data level. A corresponding target data storage pool is found based on the characteristic fields of the business data, and multiple data areas are divided in the target data storage pool according to the number of threshold key fragments. After encrypting the business data using the encryption master key to obtain encrypted data, each encrypted data and its corresponding threshold key fragments are stored in multiple data areas to ensure isolated storage of the business data. This application, after acquiring different business data, can find the encryption master key based on the data level of the business data, split each encryption master key into several threshold key fragments according to the data level, encrypt the business data using the encryption master key to obtain encrypted data, and then store each encrypted data and its corresponding threshold key fragments in multiple data areas to ensure isolated storage of the business data. This reduces the risk of data theft and improves data security. Attached Figure Description

[0016] To more clearly illustrate the technical solution of this application, the drawings used in the description of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a flowchart illustrating the steps of a data isolation method based on an encryption algorithm provided in an embodiment of this application; Figure 2 This is a structural block diagram of a data isolation device based on an encryption algorithm provided in an embodiment of this application; Figure 3 This is a structural block diagram of a data isolation system based on an encryption algorithm provided in one embodiment of this application; Figure 4 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0018] To make the objectives, features, and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0019] With the rapid advancement of digitalization, online business and online transaction services are becoming increasingly widespread. In addition to transaction and service-related data, online services and transactions also involve highly sensitive data such as customer ID cards, bank cards, account balances, transaction records, credit information, and asset and liability details. To ensure customer data security, encryption is necessary.

[0020] One common data processing method is to extract feature data fields from various types of business data, aggregate and classify them according to the feature data fields to determine the data type, and call different encryption algorithms to encrypt the data based on the level corresponding to the data type, thereby distinguishing different data and ensuring the security of sensitive data.

[0021] However, the above method has the following technical problems: encrypted ciphertexts of different security levels are stored uniformly in the same database, object storage bucket, or file directory, and data levels are distinguished only by field tags. Once the storage account is stolen or the backend authentication mechanism fails, attackers can batch-read all ciphertexts, including ordinary logs, sensitive user information, and core credit information, which can easily lead to large-scale data theft and has weak security protection capabilities.

[0022] To address the aforementioned issues, the following detailed description and explanation will be provided through specific embodiments of a data isolation method, apparatus, system, device, and medium based on an encryption algorithm, as provided in this application.

[0023] To address the technical issues of security risks associated with existing data storage technologies, referring to Figure 1 The diagram shows a flowchart of a data isolation method based on an encryption algorithm provided in an embodiment of this application.

[0024] In one embodiment, the data isolation method based on encryption algorithms is applicable to an enterprise's data management system or management platform, and data encryption and isolation operations are performed through the management system or management platform.

[0025] As an example, the data isolation method based on the encryption algorithm may include: S11. When acquiring several pieces of business data to be stored, determine the data level of the business data based on the feature fields of the business data, and find the corresponding encryption master key based on the data level.

[0026] In one embodiment, several pieces of business data to be stored can be obtained. Then, the business data can be structured and parsed to extract a multi-level set of feature fields. In one operation mode, deep parsing of business data in JSON, Protobuf, or log text can extract features such as field name, field value, context, association ID, length, entropy value, and format features to obtain feature fields. Optionally, the feature fields can be converted into multi-dimensional feature vectors. Specifically, a multi-dimensional feature vector can be represented by the following formula: F = {fname, fvalue, len, entropy, regex_hit, rel_id}; In a practical application, user data can also be parsed to extract features such as name, id_card, phone, email, bank_card, and address. However, single-layer feature recognition is incomplete and may lead to missed detections of sensitive data. The method described above covers all sensitive features without omission.

[0027] Optionally, the feature field can be perturbed by encrypted hashing to generate an irreversible feature fingerprint. In one operation mode, SM3 / SHA-256 (feature value + random salt + tenant ID) can be used to generate the feature fingerprint; when using it, plaintext features can be omitted, and only the hash fingerprint can be stored. The user's ID number can be excluded from direct participation in the classification process, but instead hashed and used in the classification determination. Traditional technologies may leak plaintext features during the classification process, creating a vulnerability surface. However, using feature fingerprints for classification ensures that sensitive plaintext features are not exposed throughout the entire process.

[0028] Next, a multi-level regularization and entropy model can be loaded to perform federated scoring on the feature fingerprints. This multi-model federated decision-making can include: a regularization model + an entropy model + a length model + an association model. Each model can be called to score each feature independently, and the weighted sum is used to obtain the grade score S. Then, the data grade can be determined based on the determined grade score.

[0029] In one operating mode, a level score can be mapped to a data level LevelID, and a unique level code can be generated. For example, if the level score S∈[0,20), the data level is determined to be L1 (normal); if the level score S∈[20,40), the data level is determined to be L2 (internal); if the level score S∈[40,70), the data level is determined to be L3 (sensitive); and if the level score S∈[70,100], the data level is determined to be L4 (confidential).

[0030] Specifically, the data level LevelID = Hash (tenant ID + level value + data UUID + timestamp).

[0031] In a practical application, mobile phone numbers and bank card information for business data are classified as L3; log data points are classified as L1.

[0032] In an optional embodiment, the level determination result can be cryptographically signed to generate a tamper-proof level label. Specifically, an asymmetric algorithm (SM2 / RSA) can be used to sign the LevelID and the feature fingerprint; specifically, the level label = LevelID + signature value + fingerprint.

[0033] Alternatively, the grade label can be written into the data header, and any tampering will cause the signature verification to fail.

[0034] Traditional methods of assigning grades can be maliciously altered, leading to the downgrading of sensitive data. Grade tags can prevent tampering and achieve traceability and verifiability.

[0035] In another optional embodiment, a trusted audit log can be created for the grade determination process, with the log being anonymized and encrypted. Specifically, only the data ID, grade, fingerprint, time, and model version can be recorded; plaintext is not recorded; and the log is encrypted using AES-256 and written to disk.

[0036] In practical applications, audit logs are stored in an independent audit cluster, making them undeletable and unalterable. If the hierarchical process is not audited, internal tampering cannot be traced. Through these measures, the entire hierarchical process can be audited and non-repudiable.

[0037] In another optional embodiment, a grade tag can be injected into the data header to form a data unit to be encrypted with a grade identifier. The data structure can be fixed as: [Grade Tag][Data Body][Checksum]. Furthermore, storage and retrieval can be restricted to first parsing the grade tag.

[0038] In practical applications, subsequent encryption, routing, storage, and decryption all rely solely on the level label. Through this process, data is strongly bound to the level, making it inseparable throughout its lifespan.

[0039] After determining the data level LevelID, a level-master key mapping table can be loaded based on the LevelID. This mapping table can be stored in an HSM or encryption configuration center, with encrypted storage to prevent tampering; and each level uniquely corresponds to a single encryption master key MK_L. For example, data level L1 corresponds to the encryption master key MK_L1, data level L2 corresponds to MK_L2, data level L3 corresponds to MK_L3, and data level L4 corresponds to MK_L4. Traditional techniques use a shared master key across multiple levels, and a single point of leakage could lead to total data loss. This application, however, uses different encryption master keys for different levels, ensuring complete key isolation between different levels.

[0040] Additionally, the encryption master key can be bound to a level domain to generate a key handle that cannot be used across domains. For example, the encryption master key MK_L can be cryptographically bound to the data level LevelID: KeyHandle = SM4 (MK_L, LevelID); the key handle is only valid within this level domain.

[0041] In a practical application, the L3 key handle cannot be used in the L1 or L2 storage domain. The key is strongly bound to the hierarchical domain and cannot be reused across domains.

[0042] S12. Invoke the threshold secret sharing algorithm to split each of the encrypted master keys into several threshold key fragments according to the data level.

[0043] In one embodiment, a threshold secret sharing algorithm can be invoked to split each cryptographic master key into several threshold key fragments according to the data level.

[0044] For example, if the data level is L1 and the corresponding encryption master key is MK_L1, each encryption master key MK_L1 can be split into 3 threshold key fragments. As another example, if the data level is L3 and the corresponding encryption master key is MK_L3, each encryption master key MK_L3 can be split into 10 threshold key fragments.

[0045] In an optional embodiment, although the level values ​​of different data levels are different, different users may have business data of the same data level. In order to distinguish the number of encryption master keys of different users according to the ID of the user's business data, as an example, the invocation of the threshold secret sharing algorithm to split each encryption master key into several threshold key fragments according to the data level may include the following sub-steps: S21. Generate a first identifier ID using the data level and the ID of the business data, and determine the level value of the data level.

[0046] S22. Calculate a first quantity value using the number of fields of the level value and the first identifier ID, and call the threshold secret sharing algorithm according to the first quantity value to split the encryption master key corresponding to each business data into several first key fragments.

[0047] S23. Bind the first identifier ID to each of the first key fragments to obtain a number of threshold key fragments.

[0048] Specifically, a first identifier ID can be generated using the data level and the business data ID. A globally unique ID can then be generated using SHA-256 (business data ID, data level, and user ID), resulting in the first identifier ID, for example, ID=0x3A7F… Simultaneously, the data level value can be determined.

[0049] Next, the first quantity value can be calculated using the number of fields of the level value and the first identifier ID. Based on the first quantity value, the threshold secret sharing algorithm is called to split the encrypted master key corresponding to each business data into several first key fragments.

[0050] For example, the first quantity value can be obtained by calculating the sum of the number of fields in the level value and the first identifier ID. Alternatively, the ratio of the number of fields in the level value to the number of fields in the first identifier ID can be calculated, and then rounded to obtain the first quantity value. Rounding can be done upwards. Finally, the Shamir threshold secret sharing algorithm can be used to fragment MK_L according to the first quantity value. Since single-fragment key leakage is risky, this application can divide the encryption master key, preventing single-point breaches and ensuring that the key cannot be stolen from a single point. Subsequently, t threshold key fragments are needed to recover the key. Finally, the first identifier ID can be bound to each first key fragment to obtain several threshold key fragments.

[0051] The first key fragment needs to be extracted based on the first identifier ID, and the data can only be decrypted after all the threshold key fragments are collected.

[0052] In an optional embodiment, although the level values ​​of different data levels are different, different users may have business data of the same data level. In order to distinguish the number of encryption master keys for different users based on the data capacity of the user's business data, as an example, the invocation of the threshold secret sharing algorithm to split each encryption master key into several threshold key fragments according to the data level may include the following sub-steps: S31. Determine the data capacity value of the business data, and generate a second identifier ID using the data capacity value and the ID of the business data.

[0053] S32. Calculate a second quantity value using the data level and the data capacity value, and call the threshold secret sharing algorithm according to the second quantity value to split the encryption master key corresponding to each business data into several second key fragments.

[0054] S33. Bind the second identifier ID to each of the second key fragments to obtain several threshold key fragments.

[0055] In one operating mode, the data capacity value of the business data can be determined, and the data capacity value can be a numerical value of the capacity. For example, if the business data is 20 MB, then the data capacity value is 20. Or, for example, if the business data is 512 KB, then the data capacity value is 512.

[0056] Next, a second identifier ID can be generated using the data capacity value and the business data ID. Specifically, a globally unique ID can also be generated using SHA-256 (business data ID, data capacity value, and user ID) to obtain the second identifier ID, for example, ID=0x4A2F….

[0057] The second quantity value is then calculated using the data level and data capacity values. For example, the second quantity value can be obtained by summing the data level value and the data capacity value. Alternatively, the ratio of the data level value to the data capacity value can be calculated, and then the ratio can be rounded up to obtain the second quantity value.

[0058] Finally, based on the second quantity value, the threshold secret sharing algorithm can be invoked to split the encryption master key corresponding to each business data into several second key fragments. Then, the second identifier ID is bound to each second key fragment, resulting in several threshold key fragments.

[0059] Optionally, threshold key fragments can be injected into different physical security domains (KMS fragment clusters). For example, threshold key fragments can be stored in different data centers, different HSMs, and different KMS clusters. If the fragments are stored centrally, they may all be stolen at once. However, with distributed storage, attackers cannot collect all the fragments.

[0060] Optionally, the first and second identifiers can be tamper-proof signatures (HMAC-SM3) for each shard. Specifically, each shard can be accompanied by a signature to prevent tampering, replacement, or forgery. In practical applications, attackers can maliciously replace key shards to disrupt decryption or gain unauthorized access. The above method allows for integrity verification of each shard. For example, a KMS cluster must verify the HMAC signature before returning a shard. If the signature fails, the shard can be left unreturned.

[0061] Furthermore, by performing the above operations, shards cannot be used across domains, which ensures data security.

[0062] S13. Based on the feature fields of the business data, find the corresponding target data storage pool, and divide the target data storage pool into multiple data areas according to the number of threshold key fragments.

[0063] In one embodiment, a dedicated target data storage pool can be automatically matched according to the characteristics of business data to achieve isolation of the underlying storage pools for different businesses and different sensitive data. Then, the number of partitions can be calculated by combining the number of threshold key fragments and the transmission capacity of the target data storage pool, and multiple independent data areas can be generated in the target data storage pool to provide physical or logical carriers for subsequent ciphertext and key fragment domain isolation storage, thereby blocking the existing technical defects of "unauthorized traversal reading of unified storage pool" from the storage layer.

[0064] To match the corresponding target data storage pool and divide the target data storage pool into corresponding data regions, as an example, the step of finding the corresponding target data storage pool based on the feature fields of the business data and dividing the target data storage pool into multiple data regions according to the number of threshold key shards may include the following sub-steps: S131. Calculate the similarity between the feature fields of each business data and the description fields of several preset data storage pools to obtain several field similarities.

[0065] S132. Filter target similarities that meet preset similarity conditions from several fields of similarity, and determine the preset data storage pool corresponding to the target similarity as the target data storage pool.

[0066] S133. Determine the number of partitions based on the number of threshold key fragments and the communication protocol of the target data storage pool.

[0067] S134. Divide the target data storage pool into multiple data regions according to the number of divisions.

[0068] In one embodiment, as explained above, the multidimensional feature field set of the feature fields of the business data can be as follows: F={fname,fvalue,len,entropy,regex_hit,rel_id}; It includes multi-dimensional information such as business type, sensitive field identifier, data entropy value, associated user ID, data length, and regular expression sensitive matching flag; it also includes the generated feature hash fingerprint (SM3 / SHA256 salted hash, without plaintext sensitive information) for similarity calculation to avoid plaintext leakage.

[0069] If it is financial business data, the feature fields additionally include: bank card, credit report, account balance, transaction history and other exclusive sensitive marker fields.

[0070] In one embodiment, multiple independent preset data storage pools (which may be distributed object storage, database clusters, block storage clusters, or file storage clusters) can be pre-configured. Each preset data storage pool can be bound to a unique set of description fields, which include: Business compatibility tags: financial transactions, basic user information, system logs, credit scoring, etc. Security level labels: L1 General / L2 Internal / L3 Sensitive / L4 Confidential; Storage capacity threshold, supported data formats (JSON / Protobuf / log); Tenant isolation identifiers, data center physical domain markers, and access permission levels; It supports encryption types and fragmented storage adaptation capabilities.

[0071] Example: Storage pool A description field = {Business: Credit Investigation, Level: L4, Data Center: Encrypted Data Center 1, Supports sharded storage: Yes}; Storage pool B description field = {Business: System event logs, Level: L1, Data Center: General Data Center, Supports sharded storage: No}.

[0072] Next, a weighted cosine similarity algorithm can be used to calculate the matching between the feature fields and the storage pool description fields, distinguishing the field weights. Specifically, it can be done as follows: 1) High-weight fields (weight 0.6): Data security level markers, sensitive business type fields (credit reporting / bank cards, etc.); 2) Weighted fields (weight 0.3): data format, data entropy value, data capacity range; 3) Low-weight fields (weight 0.1): associated tenant ID, data length, log tag.

[0073] Specifically, the process for calculating field similarity is as follows: The first step is to convert the business feature fields and storage pool description fields into numerical feature vectors of a unified dimension. The second step is to assign values ​​to the two types of vectors according to preset weights to eliminate interference from irrelevant fields. The third step is to substitute each value into the cosine similarity formula to calculate the matching score between the current business data and each preset storage pool. The score range is [0,1], and the closer the value is to 1, the higher the matching degree. The fourth step is to iterate through all the preset storage pools and output a set of corresponding field similarity arrays.

[0074] Traditional solutions use fixed storage pools, and highly sensitive data is easily assigned to general storage clusters. This step uses multi-dimensional weighted similarity matching to achieve intelligent and automatic matching between data and storage pools. Data with higher sensitivity levels is given priority to be matched with dedicated storage pools with high security isolation specifications, thus achieving coarse-grained isolation of storage pools from the source.

[0075] Next, target similarities that meet preset similarity conditions can be filtered from several similarity fields, and the preset data storage pool corresponding to the target similarity can be determined as the target data storage pool. The preset similarity condition configuration rules are as follows: Similarity thresholds can be pre-configured, and the thresholds are tied to data levels; the higher the level, the higher the threshold, thus increasing the stringency of matching for highly sensitive data storage. L1 (Normal): Similarity threshold ≥ 0.4; L2 (internal): Similarity threshold ≥ 0.6; L3 (Sensitive): Similarity threshold ≥ 0.75; L4 (Confidential): Similarity threshold ≥ 0.9.

[0076] Judgment logic: Only storage pools with similarity scores greater than or equal to the corresponding level threshold are included in the candidate pool list.

[0077] The process for target similarity and target storage pool selection can include the following steps: 1. Filtering: Remove storage pools with similarity below the level threshold to obtain a set of candidate storage pools; 2. Optimal selection: Select the item with the highest similarity value from the candidate set as the target similarity; 3. Binding: Define the preset storage pool corresponding to the target similarity as the target data storage pool dedicated to the current business data.

[0078] In an optional embodiment, if no storage pool meets the similarity threshold (or there is no matching candidate pool), the storage pool creation or expansion process can be automatically triggered. A new independent storage pool with corresponding security specifications can be automatically generated based on the current business feature fields as the target storage pool to avoid data being mixed in mismatched clusters.

[0079] In another alternative embodiment, if multiple storage pools are completely equal in similarity, the storage pool with a higher level of physical isolation, an independent HSM encryption gateway, and an independent data center deployment can be selected as the target storage pool.

[0080] Each piece of business data is allocated to a unique and dedicated target storage pool. Data from different businesses and with different security levels naturally fall into different storage clusters, achieving cluster-level horizontal isolation and eliminating the original security flaws of storing multiple levels of encrypted data together in the same storage cluster.

[0081] Next, the number of partitions can be determined based on the number of threshold key fragments and the communication protocol of the target data storage pool. Finally, the target data storage pool can be divided into multiple data regions according to the number of partitions.

[0082] In one embodiment, the number of threshold key fragments can be increased by 1 to equal the number of fragments.

[0083] For example, the threshold key can be divided into 10 segments, resulting in a total of 10 + 1 = 11 segments. One data area stores encrypted business data, and the remaining 10 data areas are used to store the 10 threshold key segments.

[0084] As an example, determining the number of partitions based on the number of threshold key fragments and the communication protocol of the target data storage pool may include the following sub-steps: S1331. Determine the transmission capacity of a single data transmission and the total data capacity of the service data based on the communication protocol of the target data storage pool.

[0085] S1332. Determine the number of data storage units based on the comparison result between the transmission capacity and the total data capacity.

[0086] S1333. Calculate the sum of the number of data storages and the number of threshold key fragments to obtain the number of partitions.

[0087] In one embodiment, the transmission capacity of a single data transmission and the total data capacity of the service data can be determined based on the communication protocol of the target data storage pool. Specifically, the storage pool communication protocol parameters can be parsed.

[0088] Different storage pools use different communication protocols (S3 object storage protocol, MySQL database protocol, distributed block storage iSCSI protocol, file storage NFS protocol), which have different single transmission limits. The gateway reads the built-in parameters of the target storage pool's protocol to extract the maximum transmission capacity (protocol single packet / single write limit). For example, the single transmission limit for the protocol is 128MB; the single write limit for the database protocol is 16MB.

[0089] Next, the total capacity of the business data can be calculated. Specifically, the original capacity value of the collected business data can be read, and the ciphertext expansion amount after encryption (SM4 / AES encryption ciphertext has a fixed expansion byte) can be added to obtain the total capacity of the complete encrypted data, that is, the overall storage volume of the encrypted business data.

[0090] Then, the data storage quantity is determined based on the comparison between the transmission capacity and the total data capacity. The data storage quantity can be considered the minimum number of independent business areas used to store encrypted business data, and the following determination rule is derived from the comparison between the transmission capacity and the total ciphertext capacity: 1. If the total ciphertext capacity is less than or equal to the single transmission capacity: the number of data storage units = 1, and only one independent service area is needed to completely store the encrypted data; 2. If the total ciphertext capacity is greater than the single transmission capacity: round up to calculate the number of segments, which will be used as the data storage quantity. The encrypted data will be segmented and stored in multiple independent business areas to adapt to the storage pool transmission protocol limitations.

[0091] For example: The total ciphertext capacity is 200MB, and the maximum single transmission limit of the storage pool is 128MB. 200÷128≈1.56, and the number of data stored is 2 when rounded up.

[0092] Finally, the total number of data storage units and the number of threshold key fragments can be calculated to obtain the number of partitions. Specifically, the number of data storage units and the number of threshold key fragments can be obtained. Then, the number of partitions can be calculated as follows: Number of partitions = Number of data storages + Number of threshold key fragments.

[0093] The number of partitions refers to the total number of independent data regions that need to be partitioned within the target data storage pool. This includes two types of regions: the business region for storing ciphertext and the partition region for storing key fragments.

[0094] The above operations can take into account both the hardware limitations of the underlying transmission protocol of the storage pool and the need for isolated storage of key fragments. The total number of area divisions can be dynamically calculated, which ensures that the business ciphertext can be written to the storage pool in normal fragmentation, and allocates an independent isolation area for each key fragment to avoid the risk of key leakage caused by centralized storage of key fragments.

[0095] S14. After encrypting the business data using the encryption master key to obtain encrypted data, each encrypted data and the corresponding threshold keys are fragmented and stored in the multiple data areas so that the multiple business data are stored in isolation.

[0096] After completing all the preliminary processes of data classification, master key sharding, dedicated storage pool matching, and storage area division, encryption and domain-based storage operations are performed. Specifically, business data can be encrypted to generate ciphertext. Then, the ciphertext and key shards can be physically or logically isolated and stored in separate areas. This separates the plaintext encryption carrier and the key carrier at the storage carrier level, solving the risk of mass theft caused by the mixed storage of ciphertext and keys in existing technologies.

[0097] In an optional embodiment, the plurality of data areas include: at least one business area for storing encrypted data and a plurality of fragment areas for storing the threshold key fragments; As an example, the step of encrypting the business data using the encryption master key to obtain encrypted data, and then storing each piece of encrypted data and the corresponding plurality of threshold keys in the plurality of data regions, may include the following sub-steps: S141. The business data is encrypted using a preset encryption algorithm based on the encryption master key to obtain encrypted data.

[0098] S142. The encrypted data is stored in the business area, and the several threshold key fragments are stored in several fragment areas respectively.

[0099] In one embodiment, a pre-built set of encryption algorithms can be constructed, specifically by embedding a national standard commercial encryption suite. The corresponding encryption algorithm is automatically matched according to the data level, and hierarchical encryption further enhances security strength. For example: L1 (Regular Log): SM4-128 symmetric encryption; L2 (Internal Business): SM4-256 Symmetric Encryption; L3 (Sensitive user information: mobile phone number, bank card): SM4-256 + SM3 integrity check; L4 (Confidential Credit and Asset Data): SM4-256 encryption + SM3 hash verification + SM2 signature secondary encapsulation.

[0100] Before encryption, a pre-verification process can be performed, which may include the following steps: 1) Parse the data header level tag, complete SM2 signature verification using the pre-stored public key, and verify whether the level tag has been tampered with; if the signature verification fails, directly terminate the encryption and write it to the audit log; 2) Verify whether the master key handle matches the current data LevelID to prevent cross-level key reuse; for example, L3 data cannot be encrypted using the L2 master key; 3) Extract the original data body, calculate the SM3 checksum of the original data, compare it with the checksum of the data header, and verify whether the original data has been tampered with during transmission.

[0101] Next, encryption can be performed. Specifically, the encryption operation may include the following steps: 1) Extract the pure data body, remove the temporary cache of header-level tags, and perform encryption operations only on the business data body; 2) Load the corresponding preset encryption algorithm according to the data level, and use the level-specific encryption master key MKL as the encryption key; 3) Generate a single-pass encryption random salt value and an initialization vector IV, combine them with the master key to complete block encryption, and output the basic ciphertext; 4) High-level (L3 / L4) additional integrity encapsulation: SM3 is used to generate a ciphertext fingerprint from the basic ciphertext and append it to the end of the ciphertext; L4 level additionally uses the corresponding level private key to sign the complete ciphertext packet; 5) Reassemble the structure: [Original grade label][Encrypted ciphertext packet][Encrypted verification code], to obtain the final encrypted data; 6) The total capacity of cached encrypted data is sent back to S1331 for storage area quantity calculation, forming a closed loop in the process.

[0102] Traditional solutions use a unified encryption algorithm and shared keys across multiple levels, which poses a high risk of ciphertext tampering and key reuse across domains. This step implements hierarchical keys + hierarchical encryption algorithms + two-layer signature verification, preventing tampering and unauthorized encryption across levels throughout the encryption chain. The ciphertext has its own level binding identifier, making it impossible to disguise highly sensitive ciphertext as low-level data storage.

[0103] Next, the encrypted data can be stored in the business area, and several threshold key fragments can be stored in several fragment areas respectively.

[0104] The data area can be divided into the business area and the segmented area.

[0105] Among them, the business area can be an independent storage partition corresponding to the "data storage quantity" in the division quantity, which is used to uniquely store the encrypted data of this business data; if the total data capacity exceeds the single transmission limit of the storage pool, there will be multiple consecutive business areas storing the encrypted data in segments. A sharding region can be an independent partition that corresponds one-to-one with the number of threshold key shards. A sharding region stores only a single threshold key shard, and there is no situation where multiple shards are mixed in the same region. The two types of regions share the same target storage pool, but meet three layers of isolation constraints: logical naming isolation, independent access AK / SK permission isolation, and high-sensitivity physical disk / network link isolation.

[0106] In one operating mode, writing encrypted data to the business area may include the following steps: 1) Route matching: The storage gateway reads the LevelID in the encrypted data header, matches it with the dedicated target storage pool allocated by S13 and the corresponding business area ID, forces routing, and prohibits writing to other areas; 2) Region Root Verification: Read the region integrity verification root generated during business region initialization, combine the level label, region root, and ciphertext to generate a temporary verification value, and only allow writing if the gateway verification passes; malicious cross-region injection of ciphertext is directly intercepted and discarded. 3) Segmented write adaptation: If the total ciphertext capacity exceeds the single transmission capacity of the storage pool communication protocol, the complete encrypted data will be equally divided and written to multiple business areas in sequence. Each segment of ciphertext is accompanied by a segment offset index, which is used to reassemble and restore the data during decryption. 4) Write auxiliary metadata: The business area synchronously stores and binds metadata, including data UUID, LevelID, sharded area index list, encryption algorithm identifier, and encryption timestamp. The metadata is stored independently in encrypted form and cannot be tampered with. 5) Multi-replica synchronization: After writing is completed, multiple replica isolated data domains are automatically generated. The replicas are distributed on different server nodes, and the replica domains have independent permissions to prevent the loss of encrypted data due to single node failure.

[0107] In one operating mode, writing the threshold key to a fragmented region may include the following steps: 1) Fragment integrity pre-verification: Read the HMAC-SM3 tamper-proof signature carried by each threshold key fragment, and verify the signature using the first identifier ID / second identifier ID bound to the fragment. If the signature is invalid, refuse to write and trigger a security alarm. 2) One-to-one allocation of shards: Each key shard is allocated a dedicated shard region, and the shard ID and shard region ID are mapped one-to-one to form a binding relationship; 3) The fragmentation isolation constraint is executed as follows: 3.1) Only fragment read and write permissions are allowed in the fragmented area; access to encrypted data in any business area is not permitted. 3.2) Business area access credentials do not have fragmented area read permissions, and there is one-way permission isolation; 3.3) The sharded areas corresponding to L3 / L4 confidential data are forcibly deployed in an independent encrypted HSM cluster in a dedicated data center, physically isolated from the business area network; 4) Storage of fragmented ancillary information: The fragmented area synchronously stores the fragmented recovery threshold t, the total number of fragments, the unique ID of the corresponding business data, and the key fragmentation generation time; 5) Cross-domain interception: Shards are associated with a level domain binding identifier, which prohibits them from being migrated to other storage pools or shard areas of other data levels, thus preventing key shards from being leaked across domains.

[0108] In one embodiment, a unified audit operation can be performed after storage is completed. Specifically, after all ciphertext and key fragments are written to the corresponding areas, a complete storage audit log is generated and encrypted and stored in an independent audit cluster. Specifically, it may include the following: 1. Record content: Data ID, LevelID, Target storage pool number, Business area number list, Shard area number list, Total number of shards, Encryption algorithm, Write time, Operation account; 2. Log characteristics: AES-256 encryption, cannot be deleted, cannot be rewritten, used for post-incident leakage tracing and access control auditing.

[0109] The following technical effects can be achieved by adopting the above operation: 1. Complete isolation between ciphertext and key carriers: Encrypted business data is stored uniformly in the business area, while key fragments are distributed in completely independent fragment areas. The two types of areas are isolated in terms of permissions, storage paths, and physical resources. Attackers who only have access to the business area can only obtain the ciphertext, but cannot obtain any key fragments, and therefore cannot complete decryption. 2. Key fragmentation and distributed isolation: Multiple key fragments are stored in different fragment regions. If a single fragment is leaked, the threshold number of keys required to recover the key cannot be obtained, thus blocking key recovery from a cryptographic level. 3. Forced level binding of storage layer: Ciphertext, fragments, storage areas, and access credentials are all strongly bound to data level. Low-level accounts cannot read high-level ciphertext and key fragments, solving the security defects of traditional mixed storage in the same pool and unauthorized traversal to read all ciphertext. 4. End-to-end integrity verification: Multi-layered protection including signature verification during encryption, root verification of the writing area, and HMAC signature verification of key fragments to prevent malicious tampering with ciphertext, replacement of key fragments, and illegal injection that could contaminate storage pool data.

[0110] Existing technologies only encrypt business data uniformly and store the ciphertext and key configuration in the same storage cluster directory. Once the storage-side authentication fails, attackers can obtain all the ciphertext and key at the same time and directly restore the original sensitive data.

[0111] This application employs a dual protection mechanism of hierarchical encryption and regional isolated storage: on the one hand, it uses hierarchical national cryptographic algorithms to enhance encryption security; on the other hand, it splits ciphertext and key fragments into independent data areas with access control and physical isolation. Attackers must simultaneously breach multiple isolated areas and collect a threshold number of key fragments to decrypt business data, greatly increasing the cost of data theft attacks and significantly reducing the risk of theft of highly sensitive business data such as customer ID cards, bank cards, and credit reports.

[0112] By adopting the technical solution of this application, the following technical effects can be achieved: 1. Tiered key isolation: Data of different security levels uses independent encryption master keys. The key is split into multiple fragments according to the threshold algorithm and stored in a distributed manner. An attacker can only obtain a single fragment and cannot restore the complete key, thus avoiding single point of key leakage. 2. Intelligent isolation of storage pools: Based on business characteristics, it automatically matches the storage cluster with the corresponding security specifications, and automatically allocates highly sensitive data to independent encrypted data center storage pools to isolate high and low level data at the cluster level; 3. Encryption and key domain isolation: Encrypted data and key fragments for the same business are stored in completely independent isolated areas within the storage pool. Area access permissions are unidirectionally isolated, and only the ciphertext area can be accessed but the key fragments cannot be read. 4. End-to-end anti-tampering: Data level labels and key fragments are configured with national cryptographic signature verification. Encrypted audit logs are retained throughout the entire process of classification, encryption, and storage, making operations traceable and tampering interceptable. 5. Adapt to different business scenarios: Supports two sets of key sharding calculation logic based on business ID and data capacity, adapting to various types of business data such as small-volume logs and large-volume credit reports, while taking into account storage and transmission performance and security standards.

[0113] In one operating mode, after encrypting and storing business data, the user may need to retrieve and decrypt the data. To extract and decrypt the data, as an example, decryption may include the following steps: The first step is to authenticate the decryption request and locate the ciphertext to be decrypted.

[0114] 1. Obtain a decryption application: The applicant submits the unique ID of the business data, the operation identity certificate, and a description of the purpose of decryption to the data processing platform.

[0115] 2. Platform permission verification: Verify account access permissions to confirm that the account has read permissions for the storage pool and business area corresponding to the data level; highly sensitive L3 / L4 data requires approval from two people.

[0116] 3. Locate the target storage resource, including: Based on the data UUID, query the metadata database to match the target data storage pool, business area number list, and all segmented area number list allocated during the encryption phase; Read the ciphertext header level label, verify the SM2 signature (the level label signature generated during the encryption phase), and check whether the level label and data fingerprint have been tampered with; If the signature verification fails, the decryption process will be terminated immediately, and the error will be written to the security audit log to prevent unauthorized modification of the encrypted text.

[0117] 4. Verify the binding relationship of the level domain: Extract the LevelID within the tag, verify whether the current decryption permission matches the level, and prohibit low-privilege accounts from decrypting high-level ciphertext.

[0118] The second step is to batch collect all departmental key fragments and complete fragment integrity verification. The specific steps are as follows: 1. Traverse all sharded regions of the metadata record and initiate shard read requests for each.

[0119] 2. Shard read permission verification: Each shard region has an independent AK / SK authentication. Business area access keys cannot read shards, and read will fail if there is no permission.

[0120] 3. Fragment anti-tampering verification (specifically, the above-mentioned S12 fragment signature rules), including: Each shard carries an HMAC-SM3 signature, which is bound to the first identifier ID / the second identifier ID; After reading the fragment, recalculate the HMAC checksum using the corresponding identifier ID and compare it with the fragment's built-in signature; If any fragment signature fails, it is determined that the fragment has been tampered with / replaced, the fragment is discarded, and an alarm is triggered.

[0121] 4. Effective fragment aggregation: Remove invalid, tampered, or read-failed fragments, and count the number of usable fragments.

[0122] 5. Threshold determination, as detailed below: If the number of valid fragments is less than the splitting threshold t: the encryption master key cannot be recovered, the decryption process is terminated, and an abnormal audit log is recorded. If the number of valid fragments is ≥ t: select any t compliant fragments and proceed to the key recovery step.

[0123] The third step is to reconstruct the level-specific encryption master key MK_L based on the Shamir threshold algorithm. The specific steps are as follows: 1. Extract the fragment coordinates and fragment values ​​(Shamir fragment standard parameters) from t valid fragments.

[0124] 2. Call the threshold secret sharing inverse algorithm consistent with the encryption phase, and substitute the t fragments to calculate the original encryption master key MK_L.

[0125] 3. Key domain verification: Use LevelID to execute KeyHandle = SM4 (MK_L, LevelID) and compare it with the key handle generated in the encryption stage; if the handles do not match, it means that the key is misused across levels, the decryption is deemed illegal, and the process is terminated.

[0126] 4. Key caching: The legitimate master key is temporarily stored in the HSM secure area in memory, and is prohibited from being persisted to disk. The memory key is destroyed immediately after decryption is completed.

[0127] The fourth step is to read the encrypted business data by region and assemble the complete ciphertext packet. The specific steps are as follows: 1. Access each independent business area sequentially based on the business area number recorded in the metadata.

[0128] 2. Segmented ciphertext reading: If the ciphertext is split into multiple segments due to storage pool transmission limitations during encryption, all segments are read in order according to the segment offset index.

[0129] 3. Complete ciphertext assembly: Integrate segmented data according to offset order to restore the complete encrypted data packet [level label][encrypted ciphertext packet][encrypted verification code].

[0130] 4. Ciphertext Integrity Pre-verification: Extract the SM3 checksum at the end of the ciphertext, recalculate the hash of the concatenated ciphertext body, and if the two are inconsistent, it indicates that the ciphertext transmission / storage is corrupted, and decryption is terminated.

[0131] The fifth step is hierarchical reverse decryption (matching the national cryptographic algorithm rules during the encryption stage). This involves matching the corresponding decryption algorithm based on the LevelID in the ciphertext header, and performing hierarchical reverse parsing. The specific steps are as follows: 1. L1 (Ordinary Log): SM4-128 symmetric decryption, using the restored MK_L to decrypt the ciphertext body; 2. L2 (Internal Business): SM4-256 Symmetric Decryption; 3. L3 (Sensitive Information): SM4-256 decryption → Verify the integrity fingerprint of the ciphertext SM3; 4. L4 (Confidential Credit): SM4-256 decryption → SM3 fingerprint verification → verification of the outer SM2 signature of the ciphertext using the private key.

[0132] 5. Decrypt the output, remove the header level label and the tail check code to obtain the original business data body; 6. Secondary verification of original data: Use the original data before encryption to check and compare with SM3 to confirm that the original data has not been lost or tampered with.

[0133] Step 6: Output the original business data and decrypted supplementary materials. The specific steps are as follows: 1. Strip away all encrypted encapsulation structures and output plaintext business data.

[0134] 2. Output decryption ancillary information (for auditing): data level, decryption time, operator, number of fragments collected, key recovery threshold, storage pool and area number.

[0135] 3. Highly sensitive L3 / L4 data in plaintext is only allowed to be temporarily displayed in memory and is prohibited from being downloaded locally for extended periods; additional desensitization processing is required if it needs to be exported.

[0136] Step 7: Post-decryption security cleanup and end-to-end audit retention. Specific steps are as follows: 1. Secure Destruction: Clear the encrypted master key, all shard caches, and segmented ciphertext temporarily stored in HSM memory.

[0137] 2. Persistent retention of fragmented and encrypted data: The original encrypted data and fragments in the business area and fragmented area are not deleted (to meet the data preservation requirements).

[0138] 3. Write to an independent encrypted audit cluster (in the same database as the encryption phase audit logs) to record the entire decryption process information. Details are as follows: 3.1 Data UUID, data level, operating account, decryption start and end time; 3.2 Valid number of fragments, threshold values, and key recovery results; 3.3. Verification results at all levels, whether tampering alarms occurred, and whether decryption was successful; 4. Log constraints: Audit logs are AES-256 encrypted, cannot be deleted, and cannot be tampered with, for post-incident security tracing.

[0139] Additionally, if a shard is determined to be lost or tampered with: for example, if it is determined that there are fewer than the threshold t available shards, or if decryption fails, a security alarm is triggered, and the shard storage cluster is manually checked.

[0140] If the level label verification fails: for example, if the ciphertext is maliciously downgraded or tampered with, decryption will be blocked directly and a security event will be generated; Optionally, if the key handles do not match: for example, if the key is used without authorization across levels, decryption is intercepted; In another alternative embodiment, if the ciphertext hash verification fails, for example, due to storage or transmission corruption, the encrypted backup ciphertext can be returned for retry. If the account does not have sharding area permissions: For example, if the one-way isolation mechanism is in effect, it is impossible to collect all the shards, thus preventing attackers who only have access to the business encrypted text from decrypting it.

[0141] In this embodiment, the present application provides a data isolation method based on an encryption algorithm, the advantages of which are as follows: the present application can obtain several business data to be stored, determine the data level of the business data based on the feature fields of the business data, and find the corresponding encryption master key based on the data level; call the threshold secret sharing algorithm to split each encryption master key into several threshold key fragments according to the data level; find the corresponding target data storage pool based on the feature fields of the business data, and divide multiple data areas in the target data storage pool according to the number of threshold key fragments; after encrypting the business data with the encryption master key to obtain encrypted data, store each encrypted data and the corresponding several threshold key fragments in multiple data areas, so that the several business data are stored in isolation. After acquiring different business data, this application can find the encryption master key according to the data level of the business data, and split each encryption master key into several threshold key fragments according to the data level. After encrypting the business data with the encryption master key to obtain encrypted data, each encrypted data and the corresponding several threshold key fragments are stored in multiple data areas to achieve data classification, key fragmentation, intelligent matching of storage pools, and isolated storage of ciphertext and key domains. This dual blocking of batch theft paths from the cryptographic layer and storage layer improves data security protection capabilities.

[0142] As the device embodiment is basically similar to the method embodiment, the description is relatively simple, and relevant parts can be found in the description of the method embodiment.

[0143] This application also provides a data isolation device based on an encryption algorithm, see [link to relevant documentation]. Figure 2 The diagram shows a schematic representation of a data isolation device based on an encryption algorithm provided in an embodiment of this application.

[0144] As an example, the data isolation device based on the encryption algorithm may include: The determination module 201 is used to determine the data level of the business data based on the feature fields of the business data when acquiring a number of business data to be stored, and to find the corresponding encryption master key based on the data level; The splitting module 202 is used to call the threshold secret sharing algorithm to split each of the encryption master keys into several threshold key fragments according to the data level; The partitioning module 203 is used to find the corresponding target data storage pool based on the feature fields of the business data, and to partition multiple data regions in the target data storage pool according to the number of threshold key fragments. The isolation module 204 is used to encrypt the business data using the encryption master key to obtain encrypted data, and then to fragment and store each encrypted data and the corresponding threshold keys into the multiple data areas so that the multiple business data are stored in isolation.

[0145] Optionally, the threshold secret sharing algorithm is invoked to split each of the encryption master keys into several threshold key fragments according to the data level, including: A first identifier ID is generated using the data level and the ID of the business data, and the level value of the data level is determined. The first quantity value is calculated using the number of fields of the level value and the first identifier ID. Based on the first quantity value, the threshold secret sharing algorithm is called to split the encryption master key corresponding to each business data into several first key fragments. The first identifier ID is bound to each of the first key fragments to obtain several threshold key fragments.

[0146] Optionally, the threshold secret sharing algorithm is invoked to split each of the encryption master keys into several threshold key fragments according to the data level, including: Determine the data capacity value of the business data, and generate a second identifier ID using the data capacity value and the ID of the business data; Calculate a second quantity value using the data level and the data capacity value, and then use the threshold secret sharing algorithm to split the encryption master key corresponding to each business data into several second key fragments based on the second quantity value; The second identifier ID is bound to each of the second key fragments to obtain several threshold key fragments.

[0147] Optionally, the step of finding the corresponding target data storage pool based on the feature fields of the business data, and dividing the target data storage pool into multiple data regions according to the number of threshold key shards, includes: Calculate the similarity between the feature fields of each business data and the description fields of several preset data storage pools to obtain several field similarities; Target similarities that meet preset similarity conditions are filtered from several fields of similarity, and the preset data storage pool corresponding to the target similarity is determined as the target data storage pool; The number of partitions is determined based on the number of threshold key fragments and the communication protocol of the target data storage pool; The target data storage pool is divided into multiple data regions according to the specified number of divisions.

[0148] Optionally, determining the number of partitions based on the number of threshold key fragments and the communication protocol of the target data storage pool includes: The transmission capacity of a single data transmission and the total data capacity of the service data are determined based on the communication protocol of the target data storage pool. The amount of data stored is determined based on the comparison between the transmission capacity and the total data capacity; The sum of the number of data storage units and the number of threshold key fragments is calculated to obtain the number of partitions.

[0149] Optionally, the plurality of data areas include: at least one business area for storing encrypted data and several fragment areas for storing the threshold key fragments; After encrypting the business data using the encryption master key to obtain encrypted data, each piece of encrypted data and its corresponding plurality of threshold keys are fragmented and stored in the plurality of data regions, including: The business data is encrypted using a preset encryption algorithm based on the encryption master key to obtain encrypted data; The encrypted data is stored in the business area, and the several threshold key fragments are stored in several fragment areas respectively.

[0150] This application also provides a data isolation system based on an encryption algorithm, see [link to relevant documentation]. Figure 3The diagram shows a schematic representation of a data isolation system based on an encryption algorithm provided in an embodiment of this application.

[0151] As an example, the data isolation system based on the encryption algorithm may include: a data processing platform and several data storage clusters, wherein the data processing platform is communicatively connected to each data storage cluster. The data storage cluster is suitable for the data isolation method based on encryption algorithms as described in the above embodiments.

[0152] Reference Figure 4 The present application illustrates a computer device for a data isolation method based on an encryption algorithm, which may specifically include the following: The aforementioned computer device 12 is manifested in the form of a general-purpose computing device. The components of the computer device 12 may include, but are not limited to: one or more processors or processing units 16, memory 28, and a bus 18 connecting different system components (including memory 28 and processing unit 16).

[0153] Bus 18 refers to one or more of several types of bus 18 architectures, including memory bus 18 or memory controller, peripheral bus 18, graphics acceleration port, processor, or local bus 18 using any of the various bus 18 architectures. For example, these architectures include, but are not limited to, Industry Standard Architecture (ISA) bus 18, Micro Channel Architecture (MAC) bus 18, Enhanced ISA bus 18, Audio / Video Electronics Standards Association (VESA) local bus 18, and Peripheral Component Interconnect (PCI) bus 18.

[0154] Computer device 12 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by computer device 12, including volatile and non-volatile media, removable and non-removable media.

[0155] Memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. Computer device 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, storage system 34 may be used to read and write non-removable, non-volatile magnetic media (commonly referred to as a "hard disk drive"). Figure 4As not shown, a disk drive for reading and writing to a removable non-volatile disk (such as a "floppy disk") and an optical disk drive for reading and writing to a removable non-volatile optical disk (such as a CD-ROM, DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to bus 18 via one or more data media interfaces. The memory may include at least one program product having a set (e.g., at least one) of program modules 42 configured to perform the functions of the embodiments of this application.

[0156] A program / utility 40 having a set (at least one) of program modules 42 may be stored, for example, in memory. Such program modules 42 include—but are not limited to—an operating system, one or more application programs, other program modules 42, and program data. Each or some combination of these examples may include an implementation of a network environment. Program modules 42 typically perform the functions and / or methods described in the embodiments of this application.

[0157] Computer device 12 can also communicate with one or more external devices 14 (e.g., keyboard, pointing device, display 24, camera, etc.), and with one or more devices that enable a user to interact with the computer device 12, and / or with any device that enables the computer device 12 to communicate with one or more other computing devices (e.g., network card, modem, etc.). This communication can be performed through an input / output interface (I / O interface 22). Furthermore, computer device 12 can also communicate with one or more networks (e.g., local area network (LAN)), wide area network (WAN), and / or public networks (e.g., the Internet) via network adapter 20. As shown, network adapter 20 communicates with other modules of computer device 12 via bus 18. It should be understood that, although... Figure 4 Not shown, it can be combined with computer device 12 to use other hardware and / or software modules, including but not limited to: microcode, device drivers, processing unit 16, external disk drive array, RAID system, tape drive and data backup storage system 34, etc.

[0158] The processing unit 16 executes various functional applications and data processing by running programs stored in memory 28, such as implementing the data isolation method based on encryption algorithms provided in the embodiments of this application.

[0159] That is, when the processing unit 16 executes the above program, it achieves the following: When acquiring several pieces of business data to be stored, the data level of the business data is determined based on the feature fields of the business data, and the corresponding encryption master key is found based on the data level; The threshold secret sharing algorithm is invoked to split each of the encrypted master keys into several threshold key fragments according to the data level; Based on the characteristic fields of the business data, the corresponding target data storage pool is found, and multiple data areas are divided in the target data storage pool according to the number of threshold key fragments; After encrypting the business data using the encryption master key to obtain encrypted data, each encrypted data and the corresponding threshold keys are fragmented and stored in the multiple data areas to isolate the multiple business data.

[0160] In this application embodiment, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the data isolation method based on encryption algorithms as provided in all embodiments of this application.

[0161] That is, to implement the following when the program is executed by the processor: When acquiring several pieces of business data to be stored, the data level of the business data is determined based on the feature fields of the business data, and the corresponding encryption master key is found based on the data level; The threshold secret sharing algorithm is invoked to split each of the encrypted master keys into several threshold key fragments according to the data level; Based on the characteristic fields of the business data, the corresponding target data storage pool is found, and multiple data areas are divided in the target data storage pool according to the number of threshold key fragments; After encrypting the business data using the encryption master key to obtain encrypted data, each encrypted data and the corresponding threshold keys are fragmented and stored in the multiple data areas to isolate the multiple business data.

[0162] Any combination of one or more computer-readable media may be used. A computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. A computer-readable storage medium can be, for example—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this document, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus, or device.

[0163] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including—but not limited to—electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, capable of transmitting, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device.

[0164] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof. These programming languages ​​include object-oriented programming languages—such as Java, Smalltalk, and C++—and conventional procedural programming languages—such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider). The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Similar or identical parts between embodiments can be referred to mutually.

[0165] Although preferred embodiments of the present application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present application.

[0166] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0167] The above provides a detailed description of a data isolation method, apparatus, system, device, and medium based on an encryption algorithm provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A data isolation method based on an encryption algorithm, characterized in that, The method includes: When acquiring several pieces of business data to be stored, the data level of the business data is determined based on the feature fields of the business data, and the corresponding encryption master key is found based on the data level; The threshold secret sharing algorithm is invoked to split each of the encrypted master keys into several threshold key fragments according to the data level; Based on the characteristic fields of the business data, the corresponding target data storage pool is found, and multiple data areas are divided in the target data storage pool according to the number of threshold key fragments; After encrypting the business data using the encryption master key to obtain encrypted data, each encrypted data and the corresponding threshold keys are fragmented and stored in the multiple data areas to ensure that the multiple business data are stored in isolation. The step of finding the corresponding target data storage pool based on the feature fields of the business data, and dividing the target data storage pool into multiple data regions according to the number of threshold key shards, includes: Calculate the similarity between the feature fields of each business data and the description fields of several preset data storage pools to obtain several field similarities; Target similarities that meet preset similarity conditions are filtered from several fields of similarity, and the preset data storage pool corresponding to the target similarity is determined as the target data storage pool; The number of partitions is determined based on the number of threshold key fragments and the communication protocol of the target data storage pool; The target data storage pool is divided into multiple data regions according to the specified number of divisions.

2. The data isolation method based on encryption algorithm according to claim 1, characterized in that, The threshold secret sharing algorithm splits each of the encryption master keys into several threshold key fragments according to the data level, including: A first identifier ID is generated using the data level and the ID of the business data, and the level value of the data level is determined. The first quantity value is calculated using the number of fields of the level value and the first identifier ID. Based on the first quantity value, the threshold secret sharing algorithm is called to split the encryption master key corresponding to each business data into several first key fragments. The first identifier ID is bound to each of the first key fragments to obtain several threshold key fragments.

3. The data isolation method based on encryption algorithm according to claim 1, characterized in that, The threshold secret sharing algorithm splits each encryption master key into several threshold key fragments according to the data level, including: Determine the data capacity value of the business data, and generate a second identifier ID using the data capacity value and the ID of the business data; Calculate a second quantity value using the data level and the data capacity value, and then use the threshold secret sharing algorithm to split the encryption master key corresponding to each business data into several second key fragments based on the second quantity value; The second identifier ID is bound to each of the second key fragments to obtain several threshold key fragments.

4. The data isolation method based on encryption algorithm according to claim 1, characterized in that, The determination of the number of partitions based on the number of threshold key fragments and the communication protocol of the target data storage pool includes: The transmission capacity of a single data transmission and the total data capacity of the service data are determined based on the communication protocol of the target data storage pool. The amount of data stored is determined based on the comparison between the transmission capacity and the total data capacity; The sum of the number of data storage units and the number of threshold key fragments is calculated to obtain the number of partitions.

5. The data isolation method based on encryption algorithms according to any one of claims 1-4, characterized in that, The plurality of data areas include: at least one business area for storing encrypted data and several fragment areas for storing the threshold key fragments; After encrypting the business data using the encryption master key to obtain encrypted data, each piece of encrypted data and its corresponding plurality of threshold keys are fragmented and stored in the plurality of data regions, including: The business data is encrypted using a preset encryption algorithm based on the encryption master key to obtain encrypted data; The encrypted data is stored in the business area, and the several threshold key fragments are stored in several fragment areas respectively.

6. A data isolation device based on an encryption algorithm, characterized in that, The device includes: The determination module is used to determine the data level of a business data based on the feature fields of the business data when acquiring a number of business data to be stored, and to find the corresponding encryption master key based on the data level; The splitting module is used to call the threshold secret sharing algorithm to split each of the encrypted master keys into several threshold key fragments according to the data level; The partitioning module is used to find the corresponding target data storage pool based on the feature fields of the business data, and to divide the target data storage pool into multiple data regions according to the number of threshold key fragments. An isolation module is used to encrypt the business data using the encryption master key to obtain encrypted data, and then to fragment and store each encrypted data and the corresponding threshold keys into the multiple data areas, so that the multiple business data are stored in isolation. The step of finding the corresponding target data storage pool based on the feature fields of the business data, and dividing the target data storage pool into multiple data regions according to the number of threshold key shards, includes: Calculate the similarity between the feature fields of each business data and the description fields of several preset data storage pools to obtain several field similarities; Target similarities that meet preset similarity conditions are filtered from several fields of similarity, and the preset data storage pool corresponding to the target similarity is determined as the target data storage pool; The number of partitions is determined based on the number of threshold key fragments and the communication protocol of the target data storage pool; The target data storage pool is divided into multiple data regions according to the specified number of divisions.

7. The data isolation device based on encryption algorithm according to claim 6, characterized in that, The determination of the number of partitions based on the number of threshold key fragments and the communication protocol of the target data storage pool includes: The transmission capacity of a single data transmission and the total data capacity of the service data are determined based on the communication protocol of the target data storage pool. The amount of data stored is determined based on the comparison between the transmission capacity and the total data capacity; The sum of the number of data storage units and the number of threshold key fragments is calculated to obtain the number of partitions.

8. A data isolation system based on an encryption algorithm, characterized in that, The system includes: a data processing platform and several data storage clusters, wherein the data processing platform is communicatively connected to each data storage cluster. The data storage cluster is applicable to the data isolation method based on encryption algorithms as described in any one of claims 1-5.

9. An electronic device, comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, when the processor executes the computer program, it implements the data isolation method based on an encryption algorithm as described in any one of claims 1-5.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer-executable program, which is used to cause a computer to perform the data isolation method based on the encryption algorithm as described in any one of claims 1-5.

Images