Data encryption and decryption method, device, equipment, system and storage medium

Abstract

This application provides a data encryption and decryption method, apparatus, device, system, and storage medium, belonging to the field of data processing. The encryption method includes: segmenting target binary data obtained by converting plaintext data to obtain two or more binary data segments; encrypting each binary data segment separately based on a first key to obtain two or more encrypted data segments; obtaining a target block identifier string corresponding to each encrypted data segment according to a pre-defined mapping relationship between binary data and block identifier characters; and merging the target block identifier strings to obtain target ciphertext data. This application embodiment can improve data security.

Description

Technical Field

[0001] This application belongs to the field of data processing, and in particular relates to a method, apparatus, device, system and storage medium for encrypting and decrypting data. Background Technology

[0002] As information becomes increasingly digitized, more and more information is transmitted between devices on communication networks in the form of digital data. This digital data may contain information that users do not wish to disclose, such as user privacy data. Furthermore, with the continuous development of network information technology, methods for stealing user data are also becoming more diverse. If user data is transmitted in plaintext, it is highly likely to be attacked during transmission, leading to data leakage and reducing data security. Summary of the Invention

[0003] This application provides a data encryption / decryption method, apparatus, device, system, and storage medium that can improve data security.

[0004] In a first aspect, embodiments of this application provide a data encryption method, comprising: segmenting target binary data obtained by converting plaintext data to obtain two or more binary data segments; encrypting each binary data segment based on a first key to obtain two or more encrypted data segments; obtaining a target block identifier string corresponding to each encrypted data segment according to a pre-set mapping relationship between binary data and block identifier characters; and merging the target block identifier strings to obtain target ciphertext data.

[0005] In some possible implementations, the target binary data obtained by converting plaintext data is segmented to obtain two or more binary data segments, including: dividing the target binary data into two or more binary data segments on an average basis according to the number of bits in the target binary data; or, determining the segmentation ratio data based on at least a portion of the binary data in the target binary data, and dividing the target binary data into two or more binary data segments on an average basis according to the segmentation ratio data.

[0006] In some possible implementations, the segmentation ratio data is determined based on the sum of the last N bits of binary data in the target binary data, where N is an integer greater than 1.

[0007] In some possible implementations, different encryption algorithms are used for different binary data segments.

[0008] In some possible implementations, each M bits of binary data corresponds to a block identifier character, where M is a positive integer.

[0009] In some possible implementations, the target ciphertext data includes segmentation ratio data, which characterizes the segmentation ratio of the target binary data into binary data segments.

[0010] In some possible implementations, data encryption methods are applied to network edge devices.

[0011] Secondly, embodiments of this application provide a data decryption method, comprising: identifying two or more target block identifier strings from target ciphertext data; restoring the target block identifier strings to corresponding encrypted data segments according to a pre-defined mapping relationship between binary data and block identifier characters; decrypting the two or more encrypted data segments respectively based on a second key to obtain two or more binary data segments, wherein the second key is a key paired with the first key required for encrypting the target ciphertext data; merging the two or more binary data segments and converting the merged binary data segments into plaintext data.

[0012] In some possible implementations, the target ciphertext data includes segmentation ratio data, which characterizes the segmentation ratio of the target binary data into binary data segments;

[0013] The process involves identifying two or more target block identifier strings from the target ciphertext data, including: segmenting the target ciphertext data according to the segmentation ratio represented by the segmentation ratio data to obtain the target block identifier strings.

[0014] In some possible implementations, the segmentation ratio data is determined based on the number of binary data segments obtained by average segmentation of the target binary data; or, the segmentation ratio data is determined based on at least a portion of the binary data in the target binary data.

[0015] In some possible implementations, the segmentation ratio data is determined based on the sum of the last N bits of binary data in the target binary data, where N is an integer greater than 1.

[0016] In some possible implementations, different decryption algorithms are used for different encrypted data segments.

[0017] In some possible implementations, each M bits of binary data corresponds to a block identifier character, where M is a positive integer.

[0018] Thirdly, embodiments of this application provide a data encryption device, comprising: a segmentation module for segmenting target binary data obtained by converting plaintext data to obtain two or more binary data segments; an encryption module for encrypting each binary data segment based on a first key to obtain two or more encrypted data segments; a first mapping module for obtaining a target block identifier string corresponding to each encrypted data segment according to a pre-set mapping relationship between binary data and block identifier characters; and a first merging module for merging the target block identifier strings to obtain target ciphertext data.

[0019] Fourthly, embodiments of this application provide a data decryption apparatus, comprising: an identification module for identifying two or more target block identifier strings from target ciphertext data; a second mapping module for restoring the target block identifier strings to corresponding encrypted data segments according to a pre-set mapping relationship between binary data and block identifier characters; a decryption module for decrypting the two or more encrypted data segments respectively based on a second key to obtain two or more binary data segments, wherein the second key is a key paired with the first key required for encrypting the target ciphertext data; and a second merging module for merging the two or more binary data segments and converting the merged binary data segments into plaintext data.

[0020] Fifthly, embodiments of this application provide a data encryption device, including: a processor and a memory storing computer program instructions; the processor reads and executes the computer program instructions to implement the data encryption method of the first aspect.

[0021] In a sixth aspect, embodiments of this application provide a data decryption device, including: a processor and a memory storing computer program instructions; the processor reads and executes the computer program instructions to implement the data decryption method of the second aspect.

[0022] In a seventh aspect, embodiments of this application provide a data encryption and decryption system, including: a data encryption device according to the fifth aspect; and a data decryption device according to the sixth aspect.

[0023] Eighthly, embodiments of this application provide a computer-readable storage medium storing computer program instructions, which, when executed by a processor, implement the data encryption method of the first aspect or the data decryption method of the second aspect.

[0024] Ninthly, embodiments of this application provide a computer program product, including a computer program, which, when executed by a processor, implements a data encryption method of the first aspect or a data decryption method of the second aspect.

[0025] This application provides a data encryption and decryption method, apparatus, device, system, and storage medium. Plaintext data is converted into binary data, and the binary data is divided into multiple binary data segments. Each binary data segment is encrypted separately to obtain multiple encrypted data segments. Then, based on the mapping relationship between binary data and block identifier characters, each encrypted data segment is converted into a target block identifier string. The target block strings are merged to obtain the target ciphertext data. Through segmentation, individual encryption, and block identifier character conversion processes in the obtained target ciphertext data, multi-layered protection of the plaintext data is achieved, increasing the degree of diffusion and obfuscation. Even if the target ciphertext data is obtained by malicious attackers, it is difficult to decipher, thereby improving data security. Attached Figure Description

[0026] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0027] Figure 1 A flowchart illustrating a data encryption method provided in an embodiment of this application;

[0028] Figure 2 A schematic diagram illustrating an example of a network edge device provided in an embodiment of this application;

[0029] Figure 3 A flowchart illustrating a data decryption method provided in an embodiment of this application;

[0030] Figure 4 A schematic diagram illustrating an example of a network center device provided in an embodiment of this application;

[0031] Figure 5 This is a schematic diagram of the structure of a data encryption device provided in an embodiment of this application;

[0032] Figure 6 A schematic diagram of the structure of a data decryption device provided in an embodiment of this application;

[0033] Figure 7 This is a schematic diagram of the structure of a data encryption device provided in an embodiment of this application;

[0034] Figure 8 This is a schematic diagram of the structure of a data encryption and decryption system provided in an embodiment of this application. Detailed Implementation

[0035] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples.

[0036] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes said element.

[0037] As information becomes increasingly digitized, more and more information is transmitted between devices on communication networks in the form of digital data. This digital data may contain information that users do not wish to disclose, such as user privacy data. Furthermore, with the continuous development of network information technology, methods for stealing user data are also becoming more diverse. If user data is transmitted in plaintext, it is highly likely to be attacked during transmission, leading to data leakage and reducing data security.

[0038] This application provides a data encryption and decryption method, apparatus, device, system, and storage medium capable of converting plaintext data into binary data, segmenting the binary data, encrypting each segment separately, and converting the encrypted segments into strings based on the mapping relationship between binary data and characters, and merging the strings to obtain ciphertext data. Through multi-layered protection, the degree of diffusion and obfuscation is increased, making the final ciphertext data difficult to decipher. Even if the data is obtained by a malicious attacker, it is difficult for them to decipher the ciphertext data, thereby improving data security.

[0039] The encryption and decryption methods, devices, equipment, systems, storage media, and program products provided in this application are described below.

[0040] This application provides a data encryption method, which can be executed by a data encryption device, equipment, etc., and is not limited thereto. Figure 1 A flowchart of a data encryption method provided in an embodiment of this application is shown below. Figure 1 As shown, the encryption method for this data may include steps S101 to S104.

[0041] In step S101, the target binary data obtained from the conversion of plaintext data is segmented to obtain two or more binary data segments.

[0042] The plaintext data can first be encoded using an encoding algorithm to obtain the target encoding. Then, the target encoding can be converted into binary form to obtain the target binary data. The target binary data includes the binary data obtained from the conversion of the plaintext data. The characters in the target encoding can be converted into binary data sequentially. Specifically, the binary data obtained from converting each character in the plaintext data can be combined according to the character order to obtain the target binary data. This does not limit the type of encoding algorithm. For example, the encoding algorithm can be the Unicode encoding algorithm. The plaintext data is "HELLO". The "H" can be encoded as Unicode 0x48, which is then converted to binary data "1001000". The "E" can be encoded as Unicode 0x45, which is then converted to binary data "1000101". The "L" can be encoded as Unicode 0x4C, which is then converted to binary data "1001100". The "O" can be encoded as Unicode 0x4F, which is then converted to binary data "1001111". Correspondingly, the target binary data obtained by converting the plaintext data "HELLO" can be "10010001000101100110010011001001111".

[0043] The target binary data may include multiple bits of binary data. These multiple bits of binary data can be split into multiple binary data segments, each of which may include one or more bits of binary data. In some examples, the target binary data can be split into two binary data segments.

[0044] In step S102, each binary data segment is encrypted based on the first key to obtain two or more encrypted data segments.

[0045] The first key can be a public key. Based on the first key, each binary data segment can be encrypted individually using an encryption algorithm. Each binary data segment corresponds to one encrypted data segment. Different binary data segments can be encrypted using the same encryption algorithm or different encryption algorithms. When different encryption algorithms are used for different binary data segments, the difference in encryption algorithms can refer to using the same type of encryption algorithm, but with different encryption functions; it can also refer to using different types of encryption algorithms. For example, if the target binary data is divided into two binary data segments, the Rivest-Shamir-Adleman (RSA) algorithm can be used to encrypt the two binary data segments separately. The RSA algorithm converts the data to be encrypted into ciphertext using a secure function based on the large number factorization problem. This secure function can be considered as the encryption function. The secure functions in the RSA algorithm used to encrypt the two binary data segments are different. For example, the target binary data is divided into two binary data segments. One binary data segment is encrypted using the RSA algorithm, and the other binary data segment is encrypted using the Advanced Encryption Standard (AES) algorithm. The encryption algorithms in the embodiments of this application may include symmetric encryption algorithms or asymmetric encryption algorithms. For example, the encryption algorithms in the embodiments of this application may include, but are not limited to, the RSA algorithm, the AES algorithm, the Data Encryption Standard (DES) algorithm, the Triple Data Encryption Standard (3DES) algorithm, the Elliptic Curve Cryptography (ECC) algorithm, etc.

[0046] In step S103, the target block identifier string corresponding to each encrypted data segment is obtained according to the pre-set mapping relationship between binary data and block identifier characters.

[0047] The mapping relationship can include the correspondence between binary data and block identifier characters. Block identifier characters can be set first, and then the binary data mapped to them can be set according to the number of block identifier characters. Alternatively, the number of bits in the binary data corresponding to each block identifier character can be set first, and then the block identifier characters mapped to the binary data can be set according to the fixed number of bits of binary data. In some examples, every M bits of binary data corresponds to one block identifier character, where M is a positive integer. The value of M can be set according to the scenario, requirements, experience, etc., and is not limited here. Similarly, the number of block identifier characters corresponding to M bits of binary data can be set according to the scenario, requirements, experience, etc. For example, the number of block identifier characters can be 2. MThat is, 2 to the power of M. For example, if the block identifier character is a letter, each two binary digits correspond to one block identifier character: 00 corresponds to A, 01 to B, 10 to C, and 11 to D. There are four block identifier characters in total. As another example, if the block identifier character is a letter, each three binary digits correspond to one block identifier character: 000 corresponds to A, 001 to B, 010 to C, 011 to D, 100 to E, 101 to F, 110 to G, and 111 to H. There are eight block identifier characters in total.

[0048] Each encrypted data segment corresponds to a target block identifier string. An encrypted data segment may include multiple bits of binary data, and the target block identifier string may include at least one block identifier character. For example, there are two encrypted data segments, with each two bits of binary data corresponding to a block identifier character: 00 corresponds to A, 01 to B, 10 to C, and 11 to D. One encrypted data segment is 00100101, and its corresponding target block identifier string is ACBB. The other encrypted data segment is 10111000, and its corresponding target block identifier string is CDCA.

[0049] In step S104, the target block identifier strings are merged to obtain the target ciphertext data.

[0050] Based on the order of the binary data segments corresponding to the encrypted data segments in the plaintext data, all the obtained target table identifier strings are merged to obtain the target ciphertext data. For example, if there are two target block identifier strings, one is ACBB and the other is CDCA, then the target ciphertext data can be ACBBCDCA.

[0051] In this embodiment, plaintext data is converted into binary data, and the binary data is divided into multiple binary data segments. Each binary data segment is encrypted to obtain multiple encrypted data segments. Then, based on the mapping relationship between binary data and block identifier characters, each encrypted data segment is converted into a target block identifier string. The target block strings are merged to obtain the target ciphertext data. Through segmentation, individual encryption, and block identifier character conversion in the obtained target ciphertext data, multi-layered protection of the plaintext data is achieved, increasing the degree of diffusion and obfuscation. Even if the target ciphertext data is obtained by malicious attackers, it is difficult to decipher, thereby improving data security.

[0052] In some embodiments, the target binary data can be segmented using an average segmentation method. Specifically, the target binary data can be divided into two or more binary data segments based on the number of bits. The number of binary data segments can be preset, and the target binary data can be divided into a preset number of binary data segments based on the number of binary data segments. If the number of bits in the target binary data is not divisible by the number of binary data segments, the number of bits in one of the binary data segments can be a remainder. In some examples, the target binary data is divided into two binary data segments. If the number of bits in the target binary data is odd, the first binary data segment has one more bit than the second binary data segment. For example, if the target binary data has 25 bits, dividing it into two binary data segments results in the first binary data segment having 13 bits and the second binary data segment having 12 bits. The target binary data can also be divided into more than two binary data segments, which will not be elaborated further here. It should be noted that when the target binary data is divided into X binary data segments on average, the segmentation ratio of the target binary data into binary data segments can be regarded as 1 / X.

[0053] In some embodiments, the segmentation method for segmenting the target binary data can be determined based on the binary data in the target binary data. Specifically, a segmentation ratio can be determined based on at least a portion of the binary data in the target binary data, and the target binary data can be equally segmented into two or more binary data segments according to the segmentation ratio. The segmentation ratio can characterize the segmentation ratio of the target binary data into binary data segments. The segmentation ratio can be determined based on the sum of at least a portion of the binary data in the target binary data, or other algorithms can be used to determine the segmentation ratio based on at least a portion of the binary data in the target binary data. The algorithm for determining the segmentation ratio that requires operations on at least a portion of the binary data is not limited here. The at least a portion of the binary data can be binary data of a predetermined number of bits in the target binary data. In some examples, the segmentation ratio is determined based on the sum of the last N bits of the target binary data, where N is an integer greater than 1. For example, if the target binary data is segmented into two binary data segments, and the sum of the last N bits of the target binary data is S, then the segmentation ratio characterized by the segmentation ratio is (S × 10)%. For example, when dividing a target binary number into two segments, N=5, if the sum of the last 5 bits of the target binary number is 5, then the segmentation ratio represents a 50% segmentation ratio, meaning the first segment accounts for 50% of the target binary number, and the second segment accounts for 50% of the target binary number. If the sum of the last 5 bits of the target binary number is 4, then the segmentation ratio represents a 40% segmentation ratio, meaning the first segment accounts for 40% of the target binary number, and the second segment accounts for 60% of the target binary number. In some examples, if the sum of the last N bits of the target binary number is 0, the value of N can be increased until the sum of the last N bits of the target binary number is greater than 0.

[0054] In some embodiments, the target binary data may not be segmented. For example, if the sum of the last N bits of the target binary data is equal to 0, then the target binary data is not segmented. If the target binary data is not segmented, it can be encrypted based on the first key to obtain an encrypted data segment; the target block identifier string corresponding to this encrypted data segment can be obtained from the mapping relationship between binary data and block identifier characters; and the target ciphertext data can be obtained based on the target block identifier string.

[0055] In some embodiments, the target ciphertext data includes segmentation ratio data, which represents the segmentation ratio of the target binary data into binary data segments. The segmentation ratio data can be added at a specified position in the target ciphertext data; for example, it can be located at the end of the target ciphertext data. When decrypting the target ciphertext data, the identifier string of each target block can be quickly identified based on the segmentation ratio data, thereby enabling decryption. The segmentation ratio data can be implemented as characters; without obtaining the association between the characters and the segmentation ratio, malicious attackers cannot obtain the segmentation ratio and therefore cannot crack the target ciphertext data.

[0056] The data encryption method in this application embodiment can be applied to various devices that require data encryption. In some embodiments, the data encryption method in this application embodiment can be applied to network edge devices, that is, the data encryption method can be executed by the network edge device. Network edge devices can perform edge computing, a distributed computing model that pushes data processing, application execution, and service deployment from a centralized cloud platform to the edge of the network. The network edge is the location closest to the data generation source or user terminal. Edge computing by network edge devices can shorten the data transmission distance in the network, thereby optimizing data processing efficiency, reducing latency, and improving user experience. Edge computing is suitable for application scenarios with stricter real-time requirements. The data encryption method in this application embodiment is simpler to operate, requires less computing power, and is more performance-friendly to the Central Processing Unit (CPU), making it suitable for network edge devices with limited local computing power. Network edge devices may include, but are not limited to, gateway devices. Figure 2 A schematic diagram illustrating an example of a network edge device provided in an embodiment of this application, such as... Figure 2As shown, the network edge device 20 may include an interface control layer 21, an intermediate distribution layer 22, and a core function layer 23. The interface control layer 21 can perform business and application deployment functions. The intermediate distribution layer 22 can perform common library and intermediate adaptation functions. The core function layer 23 may include network configuration 231, database 232, virtual storage 233, core software library 234, network functions 2351 and storage functions 2352 in hardware resource management 235, database system 2361, permission management 2362 and core library open authorization 2363 in general software resource management 236, business applications 2371, network applications 2372, secondary development 2373 and communication applications 2374 in application resource management 237, and configuration management database (CMDB) 2375. The data encryption method in this embodiment can be executed in the core functional layer 23 of the network edge device 20, specifically in the database 232 of the core functional layer 23. It can encrypt data before it is physically accessed, further reducing the possibility of plaintext data leakage. The data encryption method in this embodiment has strong performance, and encryption does not affect the original data functions of the database management system, thus achieving seamless coupling between the data encryption function and the management system. The data encryption method in this embodiment requires less computing power and has a smaller impact on the computing power of the network edge device.

[0057] This application may also provide a data decryption method, which may be executed by a data decryption device, equipment, etc., and is not limited thereto. Figure 3 A flowchart of a data decryption method provided in an embodiment of this application is shown below. Figure 3 As shown, the decryption method for this data may include steps S301 to S304.

[0058] In step S301, two or more target block identifier strings are identified from the target ciphertext data.

[0059] The target ciphertext data can be obtained by merging two or more target block identifier strings. The specific content of the target ciphertext data can be found in the relevant descriptions in the above embodiments, and will not be repeated here. During the decryption process, the target block identifier string can be identified from the target ciphertext data. The process of identifying the target block identifier string from the target ciphertext data is the reverse process of merging the target block identifier strings in the above data encryption method embodiments; the specific details can be found in the relevant descriptions in the above embodiments.

[0060] In step S302, the target block identifier string is restored to the corresponding encrypted data segment according to the pre-set mapping relationship between binary data and block identifier characters.

[0061] The details of the mapping relationship can be found in the descriptions in the above embodiments, and will not be repeated here. Based on this mapping relationship, each block identifier character in the target block identifier string can be restored to its corresponding binary data in the mapping relationship to obtain an encrypted data segment. One target block identifier string corresponds to one encrypted data segment. The process of restoring the target block identifier string to its corresponding encrypted data segment is the reverse process of obtaining the target block identifier string from the encrypted data segment in the above data encryption method embodiments; for details, please refer to the descriptions in the above embodiments.

[0062] In some examples, each M bits of binary data corresponds to a block identifier character, where M is a positive integer. For details, please refer to the relevant descriptions in the above embodiments, which will not be repeated here.

[0063] In step S303, based on the second key, two or more encrypted data segments are decrypted to obtain two or more binary data segments.

[0064] The second key is the key paired with the first key required to encrypt the target ciphertext data. If the first key is a public key, then the second key is a private key. The decryption algorithm for decrypting the encrypted data segment corresponds to the encryption algorithm used to encrypt the binary data segment in the above encryption method. If different encrypted data segments are encrypted using the same encryption algorithm, then the same decryption algorithm is used to decrypt them. If different encrypted data segments are encrypted using different encryption algorithms, then different decryption algorithms are used for them. Decrypting an encrypted data segment yields a binary data segment.

[0065] In step S304, two or more binary data segments are merged, and the merged binary data segments are converted into plaintext data.

[0066] Based on the order of the target block identifier string corresponding to the encrypted data segment in the target ciphertext data, the binary data segments obtained from decrypting the encrypted data segments are merged. The resulting binary data is then converted into the target encoding. Finally, according to the inverse algorithm of the encoding algorithm in the encryption method, the target encoding is converted into plaintext data. For example, if the encoding algorithm for plaintext data in the encryption method is the Unicode encoding algorithm, then the binary data obtained from merging the binary data segments is converted into Unicode encoding, and then the Unicode encoding is converted into plaintext data.

[0067] In this embodiment, multiple target block identifier strings are identified from the target ciphertext data. Based on the mapping relationship between binary data and block identifier characters, the target block identifier strings are restored to encrypted data segments. The encrypted data segments are decrypted to obtain the corresponding binary data segments. The binary data segments are then merged and converted into plaintext data. The mapping relationship, encryption algorithm, and binary data segmentation method in this decryption process all enhance data security. Malicious attackers cannot obtain the mapping relationship, encryption algorithm, or binary data segmentation method, and even if they obtain the target ciphertext data, they cannot crack it, thus improving data security.

[0068] In some embodiments, the target ciphertext data includes segmentation ratio data, which represents the segmentation ratio of the target binary data into binary data segments. For details, please refer to the relevant descriptions in the above embodiments, which will not be repeated here. Since the encrypted data segment is obtained based on the binary data segment, and the target block identifier string is obtained based on the encrypted data segment, the proportion of the target block identifier string to the target ciphertext data can also be obtained from the segmentation ratio data. The target ciphertext data can be segmented according to the segmentation ratio represented by the segmentation ratio data to obtain the target block identifier string.

[0069] In some embodiments, the segmentation ratio data is determined based on the number of binary data segments obtained by average segmentation of the target binary data. In other words, the segmentation ratio data represents the segmentation ratio determined based on the number of binary data segments obtained by average segmentation of the target binary data. For details, please refer to the relevant descriptions in the above embodiments, which will not be repeated here.

[0070] In some embodiments, the segmentation ratio data is determined based on at least a portion of the binary data in the target binary data. Alternatively, the segmentation ratio data represents a segmentation ratio determined based on at least a portion of the binary data in the target binary data. For details, please refer to the relevant descriptions in the above embodiments, which will not be repeated here. In some examples, the segmentation ratio data is determined based on the sum of the last N bits of the target binary data, where N is an integer greater than 1. For details, please refer to the relevant descriptions in the above embodiments, which will not be repeated here.

[0071] In some embodiments, the data decryption method can be applied to a network center device. The network center device may include, but is not limited to, core network devices, cloud devices, etc. For example, Figure 4 A schematic diagram illustrating an example of a network center device provided in an embodiment of this application, such as... Figure 4As shown, the network center device may include an application system 41, which contains an application development tool 42. The application development tool 42 has a database management system (DBMS) 43, which may be implemented based on an operating system (OS) 44 and hardware 45. The data decryption method in this embodiment may be set to be executed by the database management system 43.

[0072] This application also provides a data encryption device. Figure 5 This is a schematic diagram of the structure of a data encryption device provided in an embodiment of this application, as shown below. Figure 5 As shown, the data encryption device 500 may include a segmentation module 501, an encryption module 502, a first mapping module 503, and a first merging module 504.

[0073] The segmentation module 501 can be used to segment the target binary data obtained by converting plaintext data to obtain two or more binary data segments.

[0074] The encryption module 502 can be used to encrypt each binary data segment based on the first key, resulting in two or more encrypted data segments.

[0075] The first mapping module 503 can be used to obtain the target block identifier string corresponding to each encrypted data segment according to the pre-set mapping relationship between binary data and block identifier characters.

[0076] The first merging module 504 can be used to merge the target block identifier string to obtain the target ciphertext data.

[0077] In some embodiments, the segmentation module 501 may be specifically used to: divide the target binary data into two or more binary data segments on an average basis according to the number of binary bits in the target binary data; or, determine the segmentation ratio data based on at least a portion of the binary data in the target binary data, and divide the target binary data into two or more binary data segments on an average basis according to the segmentation ratio data.

[0078] In some examples, the segmentation ratio is determined based on the sum of the last N bits of the target binary data, where N is an integer greater than 1.

[0079] In some embodiments, different encryption algorithms are used for different binary data segments.

[0080] In some embodiments, each M bits of binary data corresponds to a block identifier character, where M is a positive integer.

[0081] In some embodiments, the target ciphertext data includes segmentation ratio data, which characterizes the segmentation ratio of the target binary data into binary data segments.

[0082] In some embodiments, the encryption device for the data may be implemented as a network edge device.

[0083] It should be noted that the data encryption device 500 is a device corresponding to the above data encryption method. All implementation methods in the above method embodiments are applicable to the embodiments of this device and can achieve the same technical effect.

[0084] This application also provides a data decryption device. Figure 6 This is a schematic diagram of the structure of a data decryption device provided in an embodiment of this application, as shown below. Figure 6 As shown, the data decryption device 600 may include an identification module 601, a second mapping module 602, a decryption module 603, and a second merging module 604.

[0085] The identification module 601 can be used to identify two or more target block identifier strings from the target ciphertext data.

[0086] The second mapping module 602 can be used to restore the target block identifier string into the corresponding encrypted data segment according to the pre-set mapping relationship between binary data and block identifier characters.

[0087] The decryption module 603 can be used to decrypt two or more encrypted data segments based on a second key, obtaining two or more binary data segments. The second key is a key paired with the first key required to encrypt the target ciphertext data.

[0088] The second merging module 604 can be used to merge two or more binary data segments and convert the merged binary data segments into plaintext data.

[0089] In some embodiments, the target ciphertext data includes segmentation ratio data, which represents the segmentation ratio of the target binary data into binary data segments. The identification module 601 can be specifically used to: segment the target ciphertext data according to the segmentation ratio represented by the segmentation ratio data to obtain a target block identifier string.

[0090] In some examples, the segmentation ratio is determined based on the number of binary data segments obtained by average segmentation of the target binary data; or, the segmentation ratio is determined based on at least a portion of the binary data in the target binary data.

[0091] In some examples, the segmentation ratio is determined based on the sum of the last N bits of the target binary data, where N is an integer greater than 1.

[0092] In some embodiments, different decryption algorithms are used for different encrypted data segments.

[0093] In some embodiments, each M bits of binary data corresponds to a block identifier character, where M is a positive integer.

[0094] In some embodiments, the data decryption device 600 may be implemented as a network center device.

[0095] It should be noted that the data decryption device 600 is a device corresponding to the data decryption method described above. All implementation methods in the above method embodiments are applicable to the embodiments of this device and can achieve the same technical effect.

[0096] This application also provides a data encryption device. Figure 7 This is a schematic diagram of the structure of a data encryption device provided in an embodiment of this application, as shown below. Figure 7 As shown, the data encryption device 700 includes a memory 701, a processor 702, and a computer program stored on the memory 701 and executable on the processor 702.

[0097] In some examples, the processor 702 described above may include a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or one or more integrated circuits that may be configured to implement the embodiments of this application.

[0098] Memory 701 may include read-only memory (ROM), random access memory (RAM), disk storage media device, optical storage media device, flash memory device, electrical, optical, or other physical / tangible memory storage device. Therefore, typically, memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described in the encryption method for data according to embodiments of this application.

[0099] The processor 702 runs a computer program corresponding to the executable program code by reading the executable program code stored in the memory 701, so as to implement the data encryption method in the above embodiments.

[0100] In some examples, the data encryption device 700 may also include a communication interface 703 and a bus 704. For example, Figure 7As shown, the memory 701, processor 702, and communication interface 703 are connected through bus 704 and complete communication with each other.

[0101] The communication interface 703 is mainly used to enable communication between various modules, devices, units, and / or equipment in the embodiments of this application. Input devices and / or output devices can also be connected through the communication interface 703.

[0102] Bus 704 includes hardware, software, or both, that couples the components of data encryption device 700 together. For example, and not limitingly, bus 704 may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-E) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 704 may include one or more buses. Although specific buses are described and illustrated in the embodiments of this application, this application considers any suitable bus or interconnection.

[0103] This application also provides a data decryption device, which may include a memory, a processor, and a computer program stored in the memory and executable on the processor.

[0104] The memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform operations described with reference to the decryption method of data according to embodiments of this application.

[0105] The processor runs a computer program corresponding to the executable program code by reading the executable program code stored in the memory, in order to implement the data decryption method in the above embodiments.

[0106] In some examples, the data decryption device may also include a communication interface and a bus, with the memory, processor, and communication interface connected via the bus to communicate with each other.

[0107] The connections between the memory, processor, communication interface, and bus in the data decryption device, as well as the specific implementation methods, can be found in the relevant descriptions in the embodiments of the data encryption device described above, and will not be repeated here.

[0108] This application also provides a data encryption and decryption system. Figure 8 This is a schematic diagram of the structure of a data encryption and decryption system provided in an embodiment of this application, as shown below. Figure 8 As shown, the data encryption and decryption system may include a data encryption device 700 and a data decryption device 800 as described in the above embodiments. The data encryption device 700 can communicate and interact with the data decryption device 800. The data encryption device 700 can execute the data encryption method described in the above embodiments, and the data decryption device 800 can execute the data decryption method described in the above embodiments. For details, please refer to the relevant descriptions in the above embodiments, which will not be repeated here. In some examples, the data encryption device 700 may be a network edge device, and the data decryption device 800 may be a network center device.

[0109] This application also provides a computer-readable storage medium storing computer program instructions. When executed by a processor, these computer program instructions can implement the data encryption or decryption methods described in the above embodiments, achieving the same technical effect. To avoid repetition, further details are omitted here. The aforementioned computer-readable storage medium may include non-transitory computer-readable storage media, such as read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks, etc., and is not limited thereto.

[0110] This application may also provide a computer program product, which may include a computer program. When the computer program is executed by a processor, it implements the data encryption method or data decryption method in the above embodiments and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0111] It should be clarified that the various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. For the device embodiments, equipment embodiments, system embodiments, computer-readable storage medium embodiments, and computer program product embodiments, the relevant parts can be referred to the description section of the method embodiments. This application is not limited to the specific steps and structures described above and shown in the figures. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application. Furthermore, for the sake of brevity, detailed descriptions of known methods and techniques are omitted here.

[0112] The aspects of this application have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by dedicated hardware performing the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

[0113] Those skilled in the art will understand that the above embodiments are exemplary and not restrictive. Different technical features appearing in different embodiments can be combined to achieve beneficial effects. Based on a study of the drawings, specification, and claims, those skilled in the art should be able to understand and implement other variations of the disclosed embodiments. In the claims, the term "comprising" does not exclude other means or steps; the quantifier "a" does not exclude a plurality; the terms "first" and "second" are used to identify names and not to indicate any particular order. No reference numerals in the claims should be construed as limiting the scope of protection. The functionality of multiple parts appearing in the claims can be implemented by a single hardware or software module. The appearance of certain technical features in different dependent claims does not mean that these technical features cannot be combined to achieve beneficial effects.

Claims

1. A method for encrypting data, characterized in that, include: The target binary data obtained from the conversion of plaintext data is segmented to obtain two or more binary data segments. Based on the first key, each of the binary data segments is encrypted to obtain two or more encrypted data segments; Based on the pre-defined mapping relationship between binary data and block identifier characters, obtain the target block identifier string corresponding to each encrypted data segment; The target block identifier strings are merged to obtain the target ciphertext data.

2. The method according to claim 1, characterized in that, The process of segmenting the target binary data obtained from the conversion of plaintext data to obtain two or more binary data segments includes: Based on the number of binary bits in the target binary data, the target binary data is divided into two or more binary data segments on an average basis; or, Based on at least a portion of the binary data in the target binary data, a segmentation ratio is determined, and the target binary data is divided into two or more binary data segments on an average basis according to the segmentation ratio.

3. The method according to claim 2, characterized in that, The segmentation ratio data is determined based on the sum of the last N bits of binary data in the target binary data, where N is an integer greater than 1.

4. The method according to claim 1, characterized in that, Different binary data segments employ different encryption algorithms.

5. The method according to claim 1, characterized in that, Each M bits of binary data corresponds to a block identifier character, where M is a positive integer.

6. The method according to claim 1, characterized in that, The target encrypted data includes segmentation ratio data, which represents the segmentation ratio of the target binary data to obtain the binary data segments.

7. The method according to any one of claims 1 to 6, characterized in that, The data encryption method is applied to network edge devices.

8. A data decryption method, characterized in that, include: Two or more target block identifier strings are identified from the target ciphertext data; Based on the pre-defined mapping relationship between binary data and block identifier characters, the target block identifier string is restored to the corresponding encrypted data segment; Based on the second key, two or more of the encrypted data segments are decrypted to obtain two or more binary data segments, wherein the second key is a key that is paired with the first key required to encrypt the target ciphertext data; Merge two or more binary data segments and convert the merged binary data segments into plaintext data.

9. The method according to claim 8, characterized in that, The target ciphertext data includes segmentation ratio data, which represents the segmentation ratio of the target binary data to obtain the binary data segments, and the target binary data is obtained by converting the plaintext data; The step of identifying two or more target block identifier strings from the target ciphertext data includes: Based on the segmentation ratio represented by the segmentation ratio data, the target ciphertext data is segmented to obtain the target block identifier string.

10. The method according to claim 9, characterized in that, The segmentation ratio data is determined based on the number of binary data segments obtained by average segmentation of the target binary data; or, The segmentation ratio data is determined based on at least a portion of the binary data in the target binary data.

11. The method according to claim 10, characterized in that, The segmentation ratio data is determined based on the sum of the last N bits of binary data in the target binary data, where N is an integer greater than 1.

12. The method according to claim 8, characterized in that, Different encrypted data segments employ different decryption algorithms.

13. The method according to claim 8, characterized in that, Each M bits of binary data corresponds to a block identifier character, where M is a positive integer.

14. A data encryption device, characterized in that, include: The segmentation module is used to segment the target binary data obtained from the conversion of plaintext data into two or more binary data segments. An encryption module is used to encrypt each of the binary data segments based on a first key, thereby obtaining two or more encrypted data segments. The first mapping module is used to obtain the target block identifier string corresponding to each encrypted data segment according to the pre-set mapping relationship between binary data and block identifier characters; The first merging module is used to merge the target block identifier string to obtain the target ciphertext data.

15. A data decryption device, characterized in that, include: The identification module is used to identify two or more target block identifier strings from the target ciphertext data; The second mapping module is used to restore the target block identifier string into the corresponding encrypted data segment according to the pre-set mapping relationship between binary data and block identifier characters; The decryption module is used to decrypt two or more of the encrypted data segments based on a second key to obtain two or more binary data segments, wherein the second key is a key that is paired with the first key required to encrypt the target ciphertext data; The second merging module is used to merge two or more binary data segments and convert the merged binary data segments into plaintext data.

16. A data encryption device, characterized in that, include: Processor, and memory storing computer program instructions; The processor reads and executes the computer program instructions to implement the data encryption method as described in any one of claims 1 to 7.

17. A data decryption device, characterized in that, include: Processor, and memory storing computer program instructions; The processor reads and executes the computer program instructions to implement the data decryption method as described in any one of claims 8 to 13.

18. A data encryption and decryption system, characterized in that, include: The data encryption device as described in claim 16; The data decryption device as described in claim 17.

19. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the data encryption method as described in any one of claims 1 to 7 or the data decryption method as described in any one of claims 8 to 13.

20. A computer program product, characterized in that, It includes a computer program that, when executed by a processor, implements the data encryption method according to any one of claims 1 to 7 or the data decryption method according to any one of claims 8 to 13.

Images