Data encryption method and apparatus, and device, storage medium and product

Abstract

The present disclosure relates to the technical field of computers, and particularly relates to a data encryption method and apparatus, and a device, a storage medium and a product. The method comprises: in response to a data encryption request triggered by a user, collecting information to be authenticated of the user; performing security verification processing on said information, so as to obtain a security authentication result corresponding to said information, wherein the security authentication result indicates that the security authentication is successful or the security authentication fails; in response to the security authentication result indicating that the security authentication is successful, acquiring a target key for which the user has a usage permission; on the basis of the target key, performing encryption processing on a data stream to be encrypted of the user, so as to obtain encrypted ciphertext; and sending the encrypted ciphertext to a cloud server. The technical solution of the present disclosure improves the security of data encryption.

Description

Data encryption method, device, equipment, storage medium and product

[0001] Cross-reference to related applications

[0002] The present disclosure is based on and claims priority to Chinese Patent Application No. 202411327481.7, filed on September 23, 2024, the entire contents of which are incorporated herein by reference. TECHNICAL FIELD

[0003] The present disclosure relates to the technical field of computers, and in particular to a data encryption method, device, equipment, storage medium and product. BACKGROUND

[0004] In a cloud storage system, data encryption technology has been widely used to protect the privacy and security of user data during transmission and storage. The current common data encryption technology is generally through software encryption. For example, using encryption algorithms such as Advanced Encryption Standard (AES), Rivest-Shamir-Adleman algorithm (RSA), etc. to encrypt the data that the user needs to upload to the cloud.

[0005] However, the current encryption algorithm is generally common for all users. The more widely the encryption algorithm is applied, the worse the security of the encryption algorithm, and the encrypted data is extremely easy to be cracked, and the security of the data is low. SUMMARY

[0006] The present disclosure is proposed in view of the above problems. The present disclosure provides a data encryption method, device, equipment, storage medium and product.

[0007] According to one aspect of the present disclosure, a data encryption method is provided, applied to a programmable user device, the method comprising:

[0008] In response to a data encryption request triggered by a user, collecting authentication information of the user to be authenticated;

[0009] Performing security verification processing on the authentication information to be authenticated to obtain a security authentication result corresponding to the authentication information to be authenticated, the security authentication result being security authentication passed or security authentication failed;

[0010] In response to the security authentication result being security authentication passed, obtaining a target secret key possessed by the user;

[0011] According to the target secret key, performing encryption processing on the data stream to be encrypted of the user to obtain encrypted ciphertext; and

[0012] sending the encrypted ciphertext to a cloud server.

[0013] According to one or more embodiments of the present disclosure, the to-be-authenticated information includes a biometric feature of the user, and the security verification process on the to-be-authenticated information to obtain a security authentication result corresponding to the to-be-authenticated information includes:

[0014] According to a preset biometric recognition algorithm, identity authentication is performed on the biometric feature of the user to obtain a security authentication result of the user.

[0015] According to one or more embodiments of the present disclosure, the target key with which the user has a use right is obtained in response to the security authentication result being a security authentication pass, including:

[0016] In response to the security authentication result being a security authentication pass, the access right of the user to the storage component of the user equipment is enabled; and

[0017] The target key is read from the storage component.

[0018] According to one or more embodiments of the present disclosure, the target key includes a plurality of sub-keys, and the plurality of sub-keys are respectively stored in a plurality of storage components of the user equipment. The target key with which the user has a use right is obtained, including:

[0019] A plurality of storage components corresponding to a plurality of sub-keys included in the target key with which the user has a use right are obtained, so as to read the plurality of sub-keys from the plurality of storage components; and

[0020] The plurality of sub-keys are subjected to key restoration processing to obtain the target key.

[0021] According to one or more embodiments of the present disclosure, the method further includes:

[0022] The target key of the user is divided into the plurality of sub-keys by a secret sharing algorithm;

[0023] The plurality of sub-keys are respectively stored in the plurality of storage components;

[0024] The plurality of sub-keys are subjected to key restoration processing to obtain the target key, including:

[0025] The plurality of sub-keys are subjected to key restoration processing to obtain the target key, including:

[0026] According to one or more embodiments of the present disclosure, the encrypting the data stream to be encrypted of the user according to the target key comprises:

[0027] determining an algorithm library in an encryption engine of the user equipment, the algorithm library comprising at least one encryption algorithm;

[0028] determining a target encryption algorithm required by the user from the at least one encryption algorithm; and

[0029] encrypting the data stream to be encrypted of the user according to the target encryption algorithm and the target key to obtain the encrypted ciphertext.

[0030] According to one or more embodiments of the present disclosure, the determining a target encryption algorithm required by the user from the at least one encryption algorithm comprises:

[0031] collecting encryption environment information in which the user is located;

[0032] determining an encryption level required by the user according to the encryption environment information;

[0033] inputting the encryption level into a dynamic scheduler in the encryption engine, the dynamic scheduler being configured to schedule a target encryption algorithm matching the encryption level from the at least one encryption algorithm;

[0034] obtaining the target encryption algorithm output by the dynamic scheduler.

[0035] According to one or more embodiments of the present disclosure, the data stream to be encrypted comprises a plurality of data streams, and the encrypting the data stream to be encrypted of the user according to the target encryption algorithm and the target key to obtain the encrypted ciphertext comprises:

[0036] determining an encryption processor of the user equipment;

[0037] inputting the target encryption algorithm and the target key and the plurality of data streams to be encrypted into the encryption processor, the encryption processor being configured to perform parallel encryption processing on the plurality of data streams to be encrypted using the target encryption algorithm and the target key; and

[0038] obtaining encrypted ciphertext obtained by the encryption processor performing parallel encryption processing on the plurality of data streams to be encrypted.

[0039] According to one or more embodiments of the present disclosure, the method further comprises:

[0040] in response to an algorithm selection operation of the user on at least one encryption algorithm in the algorithm library in the encryption engine, determining a first encryption algorithm corresponding to the algorithm selection operation; and

[0041] In response to a trigger operation performed by the user on the first encryption algorithm, an operation result of the first encryption algorithm is obtained, and the trigger operation includes a modification operation or a deletion operation.

[0042] According to one or more embodiments of the present disclosure, further comprising:

[0043] In response to an algorithm addition operation performed by the user on the algorithm library in the encryption engine, a second encryption algorithm corresponding to the algorithm addition operation is obtained; and

[0044] The second encryption algorithm is added to the algorithm library.

[0045] According to one or more embodiments of the present disclosure, a plurality of secret keys of the user are stored in the user device, and the method further comprises:

[0046] A target power consumption level of the user device is detected;

[0047] The target secret key for which the user has a use permission is obtained, including:

[0048] A target secret key matching the target power consumption level is selected from the plurality of secret keys of the user stored in the user device; and

[0049] The target encryption algorithm required by the user is determined from the at least one encryption algorithm, including:

[0050] A target encryption algorithm matching the target power consumption level is selected from the at least one encryption algorithm.

[0051] According to one or more embodiments of the present disclosure, the power consumption level of the user device is inversely proportional to the encryption strength of each secret key, and the power consumption level of the user device is inversely proportional to the calculation complexity of each encryption algorithm.

[0052] According to one or more embodiments of the present disclosure, further comprising:

[0053] An encryption load required by the encryption module of the user device to perform encryption calculation through the target secret key and the target encryption algorithm is calculated; and

[0054] According to the encryption load required by the encryption module, a dynamic scheduling process is performed on the power resources of the user device to obtain a target power resource of the encryption module, and the target power resource is used by the encryption module to use the target encryption algorithm and the target secret key to perform encryption processing on the to-be-encrypted data stream of the user, and obtain the encryption ciphertext.

[0055] According to one or more embodiments of the present disclosure, the computing the encryption load required by the encryption module of the user equipment through the target key and the target encryption algorithm comprises:

[0056] determining a first power consumption parameter corresponding to the security check processing performed by the user equipment on the to-be-authenticated information;

[0057] determining a second power consumption parameter required by the user equipment for performing the encryption calculation using the target encryption algorithm and the target key;

[0058] determining a third power consumption parameter required by the user equipment for encrypting the to-be-encrypted data stream; and

[0059] adding the first power consumption parameter, the second power consumption parameter and the third power consumption parameter to obtain the encryption load required by the encryption module of the user equipment.

[0060] According to one or more embodiments of the present disclosure, the dynamic scheduling processing of the power resource of the user equipment according to the encryption load required by the encryption module comprises:

[0061] determining an encryption weight required by the encryption module according to the encryption load required by the encryption module; and

[0062] calculating a target power resource allocated to the encryption module by the user equipment according to the encryption weight and the weight of other modules of the user equipment.

[0063] According to one or more embodiments of the present disclosure, the dynamic scheduling processing of the power resource of the user equipment according to the encryption load required by the encryption module comprises:

[0064] calculating a voltage variation of the encryption module according to the encryption load, a maximum encryption load of the user equipment, and a preset voltage adjustment range; and

[0065] adding the voltage variation to a preset basic working voltage of the encryption module to obtain a target working voltage of the encryption module.

[0066] According to one or more embodiments of the present disclosure, the method further comprises:

[0067] generating the secret key of the user based on a quantum random number generation algorithm; and

[0068] storing the secret key of the user in a storage component of the user equipment.

[0069] According to one or more embodiments of the present disclosure, the generating the secret key of the user based on the quantum random number generation algorithm comprises:

[0070] generating a quantum random number based on a preset quantum random number generator;

[0071] obtaining secret key information of the user; and

[0072] performing hash calculation on the quantum random number and the secret key information to obtain a secret key of the user.

[0073] According to one or more embodiments of the present disclosure, the programmable user device is a field programmable gate array (FPGA) based user device.

[0074] According to another aspect of the present disclosure, a data encryption apparatus is provided, which is applied to a programmable user device, and the apparatus comprises:

[0075] a request response unit configured to collect to-be-authenticated information of a user in response to a data encryption request triggered by the user;

[0076] a security check unit configured to perform security check processing on the to-be-authenticated information to obtain a security authentication result corresponding to the to-be-authenticated information, the security authentication result being security authentication passed or security authentication failed;

[0077] a secret key obtaining unit configured to obtain a target secret key to which the user has a use right in response to the security authentication result being security authentication passed;

[0078] an encryption calculation unit configured to perform encryption processing on to-be-encrypted data stream of the user according to the target secret key to obtain encrypted ciphertext;

[0079] a ciphertext sending unit configured to send the encrypted ciphertext to a cloud server.

[0080] According to still another aspect of the present disclosure, a programmable user device is provided, which comprises a memory, a processor, and a computer program stored in the memory, and the processor executes the computer program to implement the steps of the data encryption method described in any of the above aspects.

[0081] According to still another aspect of the present disclosure, a computer readable storage medium is provided, which stores a computer program / instruction, and the computer program / instruction is executed by a processor to implement the steps of the data encryption method described in any of the above aspects.

[0082] According to still another aspect of the present disclosure, a computer program product is provided, which comprises a computer program / instruction, and the computer program / instruction is executed by a processor to implement the steps of the data encryption method described in any of the above aspects.

[0083] As will be described in detail below, according to the data encryption method of the embodiments of the present disclosure, the programmable user device can collect the to-be-authenticated information of the user in response to a data encryption request triggered by the user. By performing security check processing on the to-be-authenticated information, a security authentication result corresponding to the to-be-authenticated information can be obtained. The security authentication result is either a security authentication pass or a security authentication fail. In the case where the security authentication result is a security authentication pass, a target key with which the user has a use right can be obtained. That is, the present disclosure needs to perform security authentication on the identity of the user before obtaining the key, thereby achieving strict use control of the key. Only the user who has passed the security authentication can use the target key, thereby improving the security of key management, avoiding the possibility of misuse of the key at the software level, and improving the security of the data encryption process.

[0084] It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only, and are intended to provide further explanation of the technology claimed. BRIEF DESCRIPTION OF DRAWINGS

[0085] The foregoing and other objects, features and advantages of the present disclosure will become more apparent from the following detailed description, which proceeds with reference to the accompanying drawings. The drawings are provided to illustrate embodiments of the present disclosure and, together with the detailed description, serve to explain the present disclosure. The drawings are not intended to limit the present disclosure, and are provided only to illustrate embodiments of the present disclosure. In the drawings, the same reference numbers generally refer to the same components or steps throughout the drawings.

[0086] FIG. 1 is a flowchart illustrating a data encryption method according to an embodiment of the present disclosure;

[0087] FIG. 2 is an example diagram illustrating a security authentication according to an embodiment of the present disclosure;

[0088] FIG. 3 is an example diagram illustrating a key storage according to an embodiment of the present disclosure;

[0089] FIG. 4 is a flowchart further illustrating a data encryption method according to an embodiment of the present disclosure;

[0090] FIG. 5 is a block diagram illustrating a data encryption apparatus according to an embodiment of the present disclosure;

[0091] FIG. 6 is a hardware block diagram of a programmable user device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0092] In order to make the purposes, technical solutions and advantages of the present disclosure more obvious, the following will describe the example embodiments according to the present disclosure in detail with reference to the drawings. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all embodiments of the present disclosure, and it should be understood that the present disclosure is not limited by the example embodiments described herein.

[0093] The technical solution of the present disclosure can be applied to a computing field. By performing security authentication on a programmable user device first, and then obtaining a target key with which the user has a use permission, strict use control of the key is realized. Only the user who has passed the security authentication can use the target key, thereby improving the security of key management, avoiding the possibility of key abuse at the software level, and improving the security of the data encryption process.

[0094] FIG. 1 is a flowchart of a data encryption method provided by an embodiment of the present disclosure. The data encryption method can be applied to a programmable user device. The data encryption method can include the following steps S101-S105.

[0095] S101, in response to a data encryption request triggered by a user, collecting to-be-authenticated information of the user.

[0096] Optionally, the execution subject of the present disclosure can be a programmable user device. The programmable user device can be a user device based on a field programmable gate array (FPGA, Field Programmable Gate Array).

[0097] The programmable user device can display a data encryption page. The data encryption page can provide a corresponding data encryption control. A trigger operation performed by the user on the data encryption control is detected. The data encryption request triggered by the user is determined according to the detected trigger operation.

[0098] The to-be-authenticated information of the user can be related information for user identity authentication, such as a biological feature of the user and login information of the user. For example, the login information of the user can be an account and a password of the user.

[0099] For example, an input control of the user login information can be provided in the data encryption page. An input operation performed by the user on the input control is detected. The login information input by the user can be obtained according to the detected input operation.

[0100] S102, performing security check processing on the to-be-authenticated information to obtain a security authentication result corresponding to the to-be-authenticated information. The security authentication result is security authentication passed or security authentication failed.

[0101] Optionally, performing security check processing on the to-be-authenticated information to obtain the security authentication result of the to-be-authenticated information can include performing security check processing on the login information of the user to obtain the security authentication result of the to-be-authenticated information. Specifically, the login information of the user is compared with locally stored login information to obtain the security authentication result of the login information of the user.

[0102] In the embodiments of the present disclosure, the security authentication result can be security authentication pass or security authentication fail. Exemplarily, the security authentication result can be represented by using a 1-bit parameter, where the parameter takes a value of 1 or True (true), indicating that the security authentication passes, and the parameter takes a value of 0 or False (false), indicating that the security authentication fails.

[0103] S103, in response to the security authentication result being security authentication pass, obtaining a target key with which the user has a use permission.

[0104] Optionally, obtaining the target key with which the user has the use permission can include: obtaining the target key pre-associated with user information of the user. The user information of the user can be, for example, user identification, user number, user name, and the like.

[0105] It should be noted that the user information involved in the present disclosure is all related information authorized by the user, and does not involve user privacy information, which complies with relevant national laws and regulations.

[0106] Optionally, the user device can pre-store the target key with which the user has the use permission, and establish an association between the user information and the target key.

[0107] S104, encrypting the to-be-encrypted data stream of the user according to the target key to obtain an encrypted ciphertext.

[0108] Optionally, before S104, the method of the present disclosure can further include receiving the to-be-encrypted data stream to perform S104.

[0109] Specifically, the to-be-encrypted user device can establish a communication connection with the electronic device, the data stream to be uploaded to the cloud by the user can be stored in the electronic device, and the electronic device can send the data stream to be uploaded to the cloud to the user device under the operation of the user.

[0110] Optionally, after the user device encrypts the to-be-encrypted data stream, the encrypted ciphertext can be uploaded to the cloud server. For example, the user device can display a transmission program of the cloud server, such as a cloud service program, and send the encrypted ciphertext to the cloud server through the operation of the transmission program.

[0111] Optionally, the electronic device can also receive the encrypted ciphertext sent by the user device, and the electronic device sends the encrypted ciphertext to the cloud server. For example, the electronic device can also display a transmission program of the cloud server, such as a cloud service program, and send the encrypted ciphertext to the cloud server through the operation of the transmission program.

[0112] S105, sending the encrypted ciphertext to the cloud server.

[0113] Optionally, the sending of the encrypted ciphertext to the cloud server can comprise, in the case that the connection with the cloud server is successful, sending the encrypted ciphertext to the cloud server.

[0114] Optionally, in the case that the encrypted ciphertext comprises a plurality, the sending of the encrypted ciphertext to the cloud server can comprise: sending the plurality of encrypted ciphertexts to the cloud server.

[0115] In the technical solution of the present disclosure, the programmable user device can collect the to-be-authenticated information of the user in response to a data encryption request triggered by the user. Through security verification processing on the to-be-authenticated information, a security authentication result corresponding to the to-be-authenticated information can be obtained. The security authentication result is either a security authentication pass or a security authentication fail. In the case that the security authentication result is a security authentication pass, a target key with which the user has a use right can be obtained. Before obtaining the target key, the present disclosure needs to first perform security authentication on the identity of the user, thereby achieving strict use control on the target key. Only the user who has passed the security authentication can use the target key, thereby improving the security of key management, avoiding the possibility of key abuse at the software level, and improving the security of the data encryption process.

[0116] In a possible design, the to-be-authenticated information can comprise a biological feature of the user. In step 102, the biological feature of the user can be authenticated according to a preset biological recognition algorithm, and a security authentication result of the user can be obtained.

[0117] For ease of understanding, FIG. 2 shows an example diagram of security authentication. As shown in FIG. 2, the programmable user device can comprise a biological recognition module 201, which can be configured with a feature collection device that can collect the biological feature of the user. The programmable user device can further comprise an identity authentication module 202, which can be pre-configured with a biological recognition algorithm. The biological recognition module 201 can input the collected biological feature to the identity authentication module 202. The identity authentication module 202 can authenticate the biological feature of the user by using the biological recognition algorithm, and obtain a security authentication result of the user.

[0118] Optionally, according to the preset biological recognition algorithm, the biological feature of the user can be authenticated, and a security authentication result of the user can be obtained. This can comprise: obtaining a feature template of the user, matching the biological feature of the user with the feature template, determining a security authentication pass as the security authentication result if the matching is successful, and determining a security authentication fail as the security authentication result if the matching fails.

[0119] Exemplarily, the formula of the biological recognition algorithm is as follows: P acess = Match (B user , B template )

[0120] wherein P acess is the security authentication result, B user is the user's biometric feature, B template is the feature template.

[0121] In the data encryption method provided by the embodiments of the present disclosure, the identity of the user is authenticated in a biometric recognition manner, so that only the user who has passed the biometric authentication can access and use the secret key, and the security of the secret key management is further improved.

[0122] In another possible design, in response to the security authentication result being a security authentication pass, the target secret key possessed by the user is obtained, including: in response to the security authentication result being a security authentication pass, enabling the access right of the user to the storage component of the user equipment; and reading the target secret key from the storage component.

[0123] In another possible design, in response to the security authentication result being a security authentication fail, a prompt information of authentication exception is output, and the data encryption process is terminated.

[0124] For ease of understanding, in FIG. 2, the programmable user equipment can further include an access control unit 203, which enables the access right of the user to the storage component of the user equipment in the case that the identity authentication module 202 determines that the security authentication result is a security authentication pass, and then enables the access control of the secret key through the secret key access control module 204.

[0125] Exemplarily, the formula for obtaining the target secret key is as follows:

[0126] wherein A key is the target secret key, K is the decrypted secret key, and 0 represents a security authentication fail.

[0127] Optionally, enabling the access right of the user to the storage component can mean turning on the access switch of the access component. For example, a physical switch can be set for the storage component. In the case that the security authentication result is a security authentication pass, the physical switch of the storage component can be turned on, and then the access right of the user to the storage component of the user equipment is enabled.

[0128] For example, the normal value or the abnormal value of the access parameter can also be set for the storage component. In the case that the security authentication result is a security authentication pass, the value of the access parameter can be set as the normal value, and in the case that the value of the access parameter is detected as the normal value, the access right of the user to the storage component of the user equipment is enabled.

[0129] In the technical solution of the present disclosure, the access permission of the user to the storage component is started from the hardware when the user security authentication is passed, strict access control of the secret key is realized from the hardware, direct secret key leakage from the software layer is effectively prevented, and the access security of the secret key is improved.

[0130] The target secret key can be distributed and stored in multiple storage components of the user equipment. As an embodiment, the method further comprises: dividing the target secret key of the user into multiple sub-secret keys through a secret sharing algorithm; and storing the multiple sub-secret keys in the multiple storage components respectively; and performing secret key restoration processing on the multiple sub-secret keys to obtain the target secret key, comprising: performing secret key reorganization calculation on the multiple sub-secret keys through a Lagrange interpolation algorithm to obtain the target secret key.

[0131] FIG. 3 shows an example diagram of secret key storage. For example, the target secret key can be divided into sub-secret key 1, sub-secret key 2 and sub-secret key 3, wherein the sub-secret key 1 is stored in the storage component a, the sub-secret key 2 is stored in the storage component b, and the sub-secret key 3 can be stored in the storage component c.

[0132] The secret sharing algorithm can be, for example, Shamir's secret sharing algorithm.

[0133] Optionally, the secret key reorganization calculation on the multiple sub-secret keys through the Lagrange interpolation algorithm to obtain the target secret key can comprise: multiplying each sub-secret key and the Lagrange difference value of each sub-secret key to obtain first data of each sub-secret key, and splicing or adding the first data of each sub-secret key to obtain the target secret key.

[0134] The calculation formula of the secret key reorganization calculation on the multiple sub-secret keys through the Lagrange interpolation algorithm to obtain the target secret key is as follows:

[0135] wherein S is the target secret key, S i is the i-th sub-secret key, L i (x) is the i-th Lagrange interpolation polynomial.

[0136] Optionally, the storage component can refer to a component for storing data in the user equipment, such as a memory, a hard disk, a processor, a disk, etc., and the multiple storage components of the user equipment can comprise multiple of the memory, the hard disk, the storage, and the disk.

[0137] In a possible design, one storage component can store one or more sub-secret keys. For security considerations, one storage component can also store only one sub-secret key.

[0138] In the embodiments of the present disclosure, the user equipment can record the storage association relationship between each sub-key and the storage component where the sub-key is stored, so that the user equipment queries the stored sub-key from each storage component according to the storage association relationship between the sub-key and the storage component, and then obtains the plurality of sub-keys.

[0139] Further, after obtaining the plurality of sub-keys from the plurality of storage components, the key integrity of the plurality of sub-keys can be detected, such as the number of sub-keys stored in the user equipment. If the number of keys of the plurality of sub-keys read is the same as the number of stored sub-keys, it is determined that the reading is successful, and the subsequent key restoration process can be performed. If the number of keys of the plurality of sub-keys read is different from the number of stored sub-keys, it is determined that the reading fails, and the plurality of sub-keys needs to be read again.

[0140] In addition, if the reading fails multiple times, that is, the number of reading failures exceeds a preset number threshold, a prompt information of key reading exception can be output. The data encryption process is terminated.

[0141] In the embodiments of the present disclosure, the target key of the user is divided into a plurality of sub-keys by a password sharing algorithm, and the plurality of sub-keys are stored in a plurality of storage components. By storing each fragment independently, the security of the key is enhanced, that is, even if the attacker obtains part of the sub-key, the entire key cannot be cracked, which greatly reduces the success rate of the attack.

[0142] In order to normally use the target key, the plurality of sub-keys of the target key need to be read from the plurality of storage components first, and then the plurality of sub-keys are restored to obtain the target key. Therefore, as another embodiment, the target key includes a plurality of sub-keys, and the plurality of sub-keys are respectively stored in a plurality of storage components of the user equipment. The target key with use permission of the user is obtained, including: obtaining a plurality of storage components corresponding to a plurality of sub-keys of the target key with use permission of the user, to read the plurality of sub-keys from the plurality of storage components; and performing key restoration processing on the plurality of sub-keys to obtain the target key.

[0143] Optionally, the key restoration processing on the plurality of sub-keys to obtain the target key can include: performing key reorganization on the plurality of sub-keys to obtain the target key.

[0144] Optionally, during the key restoration processing on the plurality of sub-keys, the key restoration time can be calculated, and the key restoration time can be displayed.

[0145] Further, the calculation of the key restoration time can include: determining the time of obtaining the plurality of sub-keys, and adding the time of obtaining the plurality of sub-keys and the reorganization calculation time to obtain the key restoration time.

[0146] The calculation formula of the key recovery time is as follows:

[0147] T reconstruction is the key recovery time, T i,fetch is the time of obtaining the i th sub-key, T compute is the reorganization calculation time.

[0148] In the embodiments of the present disclosure, the plurality of sub-keys of the target key are distributed and stored in the plurality of storage components, and when the key is recovered, the plurality of sub-keys need to be read from each storage component first, and then the plurality of sub-keys can be subjected to key recovery processing to obtain the target key. Through the collection of sub-keys and the recovery of the key, the user device can access and reorganize the key, thereby improving the security of key access.

[0149] As an embodiment, according to the target key, the encryption processing is performed on the to-be-encrypted data stream of the user to obtain an encrypted ciphertext, including:

[0150] determining an algorithm library in an encryption engine of the user device, the algorithm library including at least one encryption algorithm;

[0151] determining a target encryption algorithm required by the user from the at least one encryption algorithm; and

[0152] performing encryption processing on the to-be-encrypted data stream of the user according to the target encryption algorithm and the target key to obtain an encrypted ciphertext.

[0153] Optionally, the algorithm library can include at least one of the following encryption algorithms: AES (Advanced Encryption Standard), ChaCha20, RSA (Rivest-Shamir-Adleman algorithm), ECC (Error Checking and Correcting), DSA (Digital Signature Algorithm), DES (Data Encryption Standard), etc. The number and type of encryption algorithms are not limited in the embodiment.

[0154] In the embodiments of the present disclosure, the encryption engine is added to the user device, at least one encryption algorithm in the algorithm library is scheduled through the encryption engine, thereby obtaining the target encryption algorithm, so that the user device can dynamically schedule each encryption algorithm through the encryption engine, so that the encryption process can adapt to different security requirements, thereby being able to quickly respond to different security threats, and improving the encryption effect.

[0155] In one possible design, determining a target encryption algorithm required by a user from at least one encryption algorithm includes: collecting encryption environment information in which the user is located; determining an encryption level required by the user according to the encryption environment information; inputting the encryption level to a dynamic scheduler in an encryption engine, where the dynamic scheduler is configured to schedule a target encryption algorithm matching the encryption level from the at least one encryption algorithm; and obtaining the target encryption algorithm output by the dynamic scheduler.

[0156] Optionally, the encryption environment information may refer, for example, to relevant information of a network environment in which the user is located, such as a network type, network status information, a location of a user device, a cell or a base station accessed, and the like.

[0157] Optionally, determining the encryption level required by the user according to the encryption environment information can include: obtaining an association between preset environment information and encryption levels, querying an encryption level associated with the encryption environment information in which the user is located in the association, and obtaining the encryption level required by the user.

[0158] Optionally, the dynamic scheduler can be a machine learning model obtained through training, and can schedule at least one encryption algorithm in an algorithm library according to an input encryption level, and output a corresponding target encryption algorithm.

[0159] For example, a scheduling formula of the dynamic scheduler is as follows: A selected = SelectAlgorithm(T threat , D type )

[0160] Wherein, A selected is a selected encryption algorithm, T threat is an encryption level, and D type is a data type.

[0161] In the technical solution of the present disclosure, the encryption environment information is collected, the encryption level required by the user is determined according to the encryption environment information, the encryption level of the user is confirmed through changes in the external environment, and thus the encryption algorithm is switched quickly and accurately dynamically in response to real-time encryption requirements, ensuring that the optimal security performance can be provided in any case.

[0162] In another possible design, the data stream to be encrypted includes multiple data streams, and encryption processing is performed on the data streams to be encrypted of the user according to the target encryption algorithm and the target key to obtain encrypted ciphertext, including: determining an encryption processor of a user device; inputting the target encryption algorithm and the target key, and the multiple data streams to be encrypted to the encryption processor, where the encryption processor is configured to perform parallel encryption processing on the multiple data streams to be encrypted using the target encryption algorithm and the target key; and obtaining the encrypted ciphertext obtained by the encryption processor through the parallel encryption processing on the multiple data streams to be encrypted.

[0163] Optionally, the encryption processor of the user equipment can be a processor element for processing encryption calculation, such as a MCU (Microcontroller Unit), a CPU (Central Processing Unit), etc.

[0164] The encryption processor can establish a plurality of threads, each of which can invoke a target encryption algorithm, input a target key and an encrypted data stream to the target encryption algorithm, perform encryption calculation on the input target key and encrypted data stream through the target encryption algorithm in the thread, and obtain an encrypted ciphertext.

[0165] Wherein, C is the output encrypted ciphertext, K is the target key, P is the input encrypted data stream, IV is the initialization vector, and A is the additional authentication data.

[0166] Optionally, IV and A are known data.

[0167] In the technical solution of the present disclosure, the encryption processor is provided in the user equipment, so that the encryption processor uses the target encryption algorithm and the target key to perform parallel encryption processing on a plurality of encrypted data streams, realizes simultaneous processing of multiple data streams, and effectively improves the data encryption efficiency.

[0168] As an embodiment, further comprising: in response to an algorithm selection operation of a user on at least one encryption algorithm in the algorithm library of the encryption engine, determining a first encryption algorithm corresponding to the algorithm selection operation; and in response to a trigger operation performed by the user on the first encryption algorithm, obtaining an operation result of the first encryption algorithm, the trigger operation including a modification operation or a deletion operation.

[0169] Optionally, the modification operation on the first encryption algorithm can be, for example, a modification operation on the algorithm name, parameters, etc. of the first encryption algorithm.

[0170] Optionally, when the trigger operation is a modification operation, the operation result includes a modification success or a modification failure. Or, when the trigger operation is a deletion operation, the operation result includes a deletion success or a deletion failure.

[0171] The first encryption algorithm can be any encryption algorithm in the algorithm library, which is not limited in the embodiment.

[0172] In the embodiment of the present disclosure, the algorithm library of the encryption engine integrates at least one encryption algorithm, which can be subjected to a modification operation or a deletion operation, can realize dynamic management of the algorithm, and can ensure that the encryption algorithm in the algorithm library can be quickly and efficiently updated.

[0173] As a further example, the method further includes, in response to a user operation of adding an algorithm to the algorithm library in the encryption engine, obtaining a second encryption algorithm corresponding to the algorithm adding operation; and adding the second encryption algorithm to the algorithm library.

[0174] Optionally, the second encryption algorithm can be any algorithm different from the algorithm library or an algorithm with version update, and the embodiment is not limited thereto.

[0175] In the embodiment of the present disclosure, the algorithm library of the encryption engine integrates at least one encryption algorithm, and the encryption algorithm can be added to the algorithm library, so that the addition management of the algorithm is realized, and the encryption algorithm in the algorithm library can be updated as needed.

[0176] In actual application, the selection of the target key can be related to the power consumption of the user device.

[0177] In another possible design, the storage component of the user device stores a plurality of keys of the user, and the method further includes: detecting a target power consumption level of the user device; obtaining a target key of the user with a use permission, including: selecting a target key matching the target power consumption level from the plurality of keys of the user stored in the user device; and determining a target encryption algorithm required by the user from the at least one encryption algorithm, including: selecting a target encryption algorithm matching the target power consumption level from the at least one encryption algorithm.

[0178] Optionally, the power consumption level of the user device is inversely proportional to the encryption strength of each key, and the power consumption level of the user device is inversely proportional to the calculation complexity of each encryption algorithm.

[0179] In some embodiments, the target power consumption level can be a power consumption level determined according to the current power consumption of the user device, and the target power consumption level of the user device is determined from a plurality of power consumption levels.

[0180] Exemplarily, a plurality of power consumption levels can be set in advance, and each power consumption level is associated with a corresponding power consumption value range. After obtaining the current power consumption of the user device, the power consumption value range in which the current power consumption is located can be determined, and the power consumption level associated with the power consumption value range is determined as the target power consumption level.

[0181] Optionally, detecting the target power consumption level of the user device can include calculating the current power consumption of the user device and determining the target power consumption level according to the current power consumption. Specifically, a plurality of power consumption ranges and the association between each power consumption range and the power consumption level can be set in advance. In the case of power consumption determination, the target power consumption range in which the power consumption is located can be determined from the plurality of power consumption ranges, and the target power consumption level associated with the target power consumption range is obtained.

[0182] Exemplarily, when it is detected that the user equipment is currently in a high power consumption level, a low-strength key can be selected, a relatively simple encryption algorithm (such as AES-128) is selected, and local encryption processing is performed on the data, which is then uploaded to the cloud server.

[0183] Alternatively, when it is detected that the user equipment is currently in a medium power consumption level, a medium-strength key can be selected, a medium-complexity encryption algorithm (such as AES-256) is selected, and the data is locally encrypted by combining the real-time password input by the user or the random number generated in real time, which is then uploaded to the cloud server.

[0184] Alternatively, when it is detected that the user equipment is currently in a low power consumption level, a high-strength key can be selected, a high-complexity encryption algorithm is selected, and the data is locally encrypted by combining the current input behavior mode of the user (for example, currently manually operating a keyboard, voice input, facial expression operation, etc.), and obtaining the biological information (for example, fingerprint information, voiceprint information, iris / expression information) corresponding to the input behavior, which is then uploaded to the cloud server.

[0185] The power management unit allocates more power to other modules, such as a network interface, a storage controller, or an encryption processor, to prolong the endurance time of the device.

[0186] In the embodiments of the present disclosure, the user equipment can have a power management function. By detecting the current target power consumption level of the user equipment, a target key and a target encryption algorithm can be selected according to the target power consumption level, so that the encryption power consumption can be related to the current target power consumption level of the user, thereby improving the utilization efficiency of the power resources of the user equipment and prolonging the endurance time of the device.

[0187] Further, optionally, the method further includes: calculating an encryption load required by the encryption module of the user equipment to perform encryption calculation by using the target key and the target encryption algorithm; and performing dynamic scheduling processing on the power resources of the user equipment according to the encryption load required by the encryption module, to obtain a target power resource of the encryption module, the target power resource being used by the encryption module to encrypt the data stream to be encrypted of the user by using the target encryption algorithm and the target key, to obtain an encrypted ciphertext.

[0188] The encryption load can refer to the power consumption required by the encryption module to perform encryption calculation on the data stream to be encrypted by using the target key and the target encryption algorithm.

[0189] In the embodiments of the present disclosure, after the target key and the target encryption algorithm are obtained, the encryption load required for the encryption module to perform encryption calculation through the target key and the target encryption algorithm can be calculated, and then the power resource of the encryption module is determined through the encryption load, so as to realize dynamic scheduling of the power resource of the power equipment, and further ensure that sufficient power resource is provided for the encryption module, thereby improving the security of the encryption operation.

[0190] Further, optionally, the encryption load required for the encryption module of the user equipment to perform encryption calculation through the target key and the target encryption algorithm includes: determining a first power consumption parameter corresponding to the security check processing of the user equipment on the to-be-authenticated information; determining a second power consumption parameter required for the user equipment to perform encryption calculation using the target encryption algorithm and the target key; determining a third power consumption parameter required for the user equipment to encrypt the to-be-encrypted data stream; and adding the first power consumption parameter, the second power consumption parameter and the third power consumption parameter to obtain the encryption load required for the encryption module of the user equipment.

[0191] Optionally, the calculation formula of the encryption load is as follows: L current = α · C input + β · P process + γ · S data

[0192] wherein, L current is the encryption load required for the encryption module, C input is the first power consumption parameter, P process is the second power consumption parameter, and S data is the third power consumption parameter.

[0193] The first power consumption parameter can be the complexity of the biological feature input by the user, such as the fingerprint feature, the iris feature, and the high-complexity password login feature. The second power consumption parameter is the complexity of the encryption process, that is, the calculation amount required by the selected encryption algorithm. The third power consumption parameter can be the data amount of the data stream to be encrypted. α, β and γ are adjustment parameters, which can be used to balance the influence of each power consumption parameter on the load, and these adjustment parameters can be obtained by pre-setting.

[0194] In the embodiments of the present disclosure, when the encryption load of the target key and the target encryption module is calculated, the first power consumption parameter of the security check processing and the second power consumption parameter of the encryption calculation, and the third power consumption parameter of the data encryption can be calculated first, and then the encryption load required for the encryption module is calculated from three dimensions, so as to realize dynamic scheduling of power management and ensure efficient operation of power resource.

[0195] Further, the power resource of the user equipment is dynamically scheduled according to the encryption load required by the encryption module, including: determining the encryption weight required by the encryption module according to the encryption load required by the encryption module; and calculating the target power resource of the user equipment allocated to the encryption module according to the encryption weight and the weight of other modules of the user equipment.

[0196] Optionally, determining the encryption weight required by the encryption module according to the encryption load can include: querying the encryption weight associated with the encryption load.

[0197] Optionally, the encryption weight of the encryption module and the weight of other modules of the user equipment can be obtained in advance.

[0198] Optionally, calculating the target power resource of the user equipment allocated to the encryption module according to the encryption weight and the weight of other modules of the user equipment can include: scheduling the power resource of the user equipment according to the encryption weight of the encryption module and the weight of other modules of the user equipment to obtain the target power resource of the user equipment allocated to the encryption module.

[0199] The calculation formula of the target power resource of the encryption module is as follows:

[0200] Wherein, P allocated is the target power resource of the encryption module, P total is the total power resource of the system, W module is the encryption weight, W i is the weight of other modules, and δ is the power buffer reserved by the system, which can avoid excessive allocation and can be obtained in advance.

[0201] The power resource can refer to the related resources of the power that the user equipment can provide, such as power consumption or power consumption.

[0202] In the embodiments of the present disclosure, the encryption weight required by the encryption module can be determined according to the encryption load, and the power resource can be allocated on demand according to the encryption weight and the weight of other modules of the user equipment, which guarantees the accuracy of the allocation of the power resource and improves the utilization efficiency of the power resource.

[0203] Further, the power resource of the user equipment is dynamically scheduled according to the encryption load required by the encryption module, including: determining the encryption weight required by the encryption module according to the encryption load required by the encryption module; and calculating the target power resource of the user equipment allocated to the encryption module according to the encryption weight and the weight of other modules of the user equipment.

[0204] Optionally, the calculating the voltage variation of the encryption module according to the encryption load, the maximum encryption load of the user equipment, and the preset voltage adjustment range can include: calculating a quotient of the encryption load and the maximum encryption load of the user equipment to obtain a first value, and calculating a product of the first value and the preset voltage adjustment range to obtain the voltage variation of the encryption module.

[0205] Optionally, the base working voltage of the encryption module can be obtained by presetting.

[0206] The calculation formula of the target working voltage of the encryption module is as follows:

[0207] wherein, V module is the target working voltage of the encryption module, V base is the base working voltage of the encryption module, ΔV is the voltage adjustment range, L current is the encryption load, L max is the maximum encryption load.

[0208] In the embodiments of the present disclosure, when the power resources of the user equipment are dynamically scheduled, the voltage variation of the encryption module can be calculated, the target working voltage of the encryption module can be obtained by adding the voltage variation and the base working voltage, and the efficient management of the voltage resources is realized by dynamically adjusting the working voltage of the encryption module.

[0209] As an embodiment, the method further includes: generating the secret key of the user based on a quantum random number generation algorithm; and storing the secret key of the user in a storage component of the user equipment.

[0210] Optionally, the quantum random number generation algorithm can include a quantum random number generator.

[0211] In the embodiments of the present disclosure, the secret key of the user can be generated by the quantum random number generation algorithm, that is, the secret key is randomly generated and has unpredictability. Compared with the traditional random number generator, the quantum random number generator can provide higher security and has stronger security advantages.

[0212] In a possible design, the generating the secret key of the user based on the quantum random number generation algorithm includes: generating a quantum random number based on a preset quantum random number generator; obtaining secret key information of the user; and performing a hash calculation on the quantum random number and the secret key information to obtain the secret key of the user.

[0213] Optionally, the quantum random number generator can include a quantum state generator, a random number generation module, and a measurement module.

[0214] Optionally, a quantum state generator can be used to generate a quantum state. The quantum state can be input into a random number generation module, which can generate a quantum random number corresponding to the quantum state.

[0215] Further, a measurement module of the quantum state generator can measure the generated quantum state, thereby obtaining a quantum random number.

[0216] Exemplarily, the generation formula of the quantum random number is as follows: R quantum =H(ψ)

[0217] wherein ψ is the quantum state, and R quantum is the generated quantum random number.

[0218] The calculation formula of the user key is as follows: K=H(R quantum , P)

[0219] wherein K is the generated key, P is the user key information, and H is a hash function.

[0220] The user key information may, for example, be a password or other key material of the user.

[0221] In the embodiments of the present disclosure, a quantum random number is generated by a quantum random number generator, so as to ensure that the key has true randomness and unpredictability. The user key information and the quantum random number are also subjected to hash calculation, so as to obtain a key with better resistance, and further improve the security of the key. Compared with a conventional pseudo-random number generator, the quantum random number generator can provide stronger security, and especially when facing quantum computing attacks in the future, can effectively guarantee the long-term security of data.

[0222] As shown in FIG. 4, a flowchart of a data encryption algorithm provided by the embodiments of the present disclosure can include the following steps:

[0223] S401, in response to a data encryption request triggered by a user, collecting a biological feature of the user.

[0224] S402, performing identity authentication on the biological feature of the user according to a preset biological recognition algorithm, and obtaining a security authentication result of the user.

[0225] S403, in a case where the security authentication result is a security authentication pass, enabling an access permission of the user to a storage component of a user device.

[0226] S404, detecting a target power consumption level of the user device.

[0227] S405, selecting a target key matched with the target power consumption level from a plurality of keys of the user stored in the user device.

[0228] Optionally, the plurality of secret keys are respectively associated with secret key information. Selecting, from the plurality of secret keys of the user stored in the user device, a target secret key matching the target power consumption level can include: selecting, from the secret key information of the plurality of secret keys of the user stored, secret key information of a target secret key matching the target power consumption level.

[0229] Optionally, in S405, a target secret key matching the target power consumption level is matched, and the secret key information of the target secret key is obtained, but the target secret key is not obtained. Therefore, S406-S407 need to be performed.

[0230] S406, obtain a plurality of storage components respectively corresponding to a plurality of sub-secret keys of the target secret key of which the user has a use right, to read the plurality of sub-secret keys from the plurality of storage components.

[0231] S407, performing secret key restoration processing on the plurality of sub-secret keys to obtain the target secret key.

[0232] S408, determine an algorithm library in an encryption engine of the user device, the algorithm library including at least one encryption algorithm.

[0233] S409, selecting, from the at least one encryption algorithm, a target encryption algorithm matching the target power consumption level.

[0234] S410, calculating an encryption load required for the encryption module of the user device to perform encryption calculation through the target secret key and the target encryption algorithm.

[0235] S411, dynamically scheduling the power resource of the user device according to the encryption load required by the encryption module, to obtain a target power resource of the encryption module.

[0236] S412, allocating the target power resource to the encryption module, and calling the encryption module to use the target encryption algorithm and the target secret key to perform encryption processing on the to-be-encrypted data stream of the user, to obtain an encryption ciphertext.

[0237] S413, sending the encryption ciphertext to a cloud server.

[0238] In the embodiments of the present disclosure, the strict control of key access is realized by combining biometric technology (such as fingerprint and iris recognition) at the hardware level. Only users who pass the biometric authentication can access and use the key, thereby greatly improving the security of key management and avoiding possible attacks and leakage risks at the software level. The target key is divided into multiple independent sub-keys and stored in different locations of the user device. Even if the attacker obtains part of the sub-key, the complete key cannot be reassembled, thereby effectively improving the security of the key. In addition, the encryption algorithm library in the encryption engine automatically switches the encryption algorithm according to the security requirements. Through the intelligent power management system, the power supply is dynamically adjusted according to the load condition of the encryption module and the user input behavior (such as fingerprint, iris or password). The system can prioritize power supply for the encryption module under high load, and switch to low power consumption mode under low load or low security requirement. This intelligent power management not only improves the endurance time of the device, but also ensures the stability and efficiency of the encryption task under various working conditions, thereby realizing high-security and high-performance cloud storage.

[0239] As shown in FIG. 5, a data encryption device provided by an embodiment of the present disclosure is applied to a programmable user device, and the device comprises a request response unit 501, a security verification unit 502, a key acquisition unit 503, an encryption calculation unit 504, and a ciphertext sending unit 505.

[0240] The request response unit 501 is configured to collect the to-be-authenticated information of the user in response to a data encryption request triggered by the user.

[0241] The security verification unit 502 is configured to perform security verification processing on the to-be-authenticated information, and obtain a security authentication result corresponding to the to-be-authenticated information. The security authentication result is security authentication passed or security authentication failed.

[0242] The key acquisition unit 503 is configured to acquire a target key of which the user has a use right in response to the security authentication result being security authentication passed.

[0243] The encryption calculation unit 504 is configured to perform encryption processing on the to-be-encrypted data stream of the user according to the target key, and obtain an encrypted ciphertext.

[0244] The ciphertext sending unit 505 is configured to send the encrypted ciphertext to a cloud server.

[0245] As an embodiment, the to-be-authenticated information comprises a biological feature of the user, and the security verification unit can comprise a biological verification module configured to perform identity authentication on the biological feature of the user according to a preset biometric recognition algorithm, and obtain a security authentication result of the user.

[0246] As a further example, the key obtaining unit comprises: a permission starting module configured to start an access permission of the user to the storage component of the user device in response to the security authentication result being a security authentication pass; and a key reading module configured to read the target key from the storage component.

[0247] As a further example, the target key comprises a plurality of sub-keys, the plurality of sub-keys are respectively stored in a plurality of storage components of the user device, and the key reading module comprises: a key reading submodule configured to obtain a plurality of storage components corresponding to the plurality of sub-keys of the target key for which the user has a use permission, so as to read the plurality of sub-keys from the plurality of storage components; and a key restoration submodule configured to perform key restoration processing on the plurality of sub-keys to obtain the target key.

[0248] As a further example, the method further comprises: a key splitting unit configured to split the target key of the user into a plurality of sub-keys by using a secret sharing algorithm; a split storage unit configured to store the plurality of sub-keys in a plurality of storage components respectively; and a key restoration submodule configured to perform key recombination calculation on the plurality of sub-keys by using a Lagrange interpolation algorithm to obtain the target key.

[0249] As a further example, the encryption calculation unit comprises:

[0250] an engine determination module configured to determine an algorithm library in an encryption engine of the user device, the algorithm library comprising at least one encryption algorithm;

[0251] a target algorithm module configured to determine a target encryption algorithm required by the user from the at least one encryption algorithm; and

[0252] an encryption calculation module configured to perform encryption processing on the to-be-encrypted data stream of the user according to the target encryption algorithm and the target key to obtain an encrypted ciphertext.

[0253] As a further example, the target algorithm module comprises: an environment collection submodule configured to collect encryption environment information in which the user is located; a level determination submodule configured to determine an encryption level required by the user according to the encryption environment information; an algorithm scheduling submodule configured to input the encryption level into a dynamic scheduler in the encryption engine, the dynamic scheduler being configured to schedule a target encryption algorithm matching the encryption level from the at least one encryption algorithm; and a target acquisition submodule configured to acquire the target encryption algorithm output by the dynamic scheduler.

[0254] As a further example, the data stream to be encrypted includes a plurality of, the encryption calculation module includes: processing determination submodule for determining the encryption processor of the user equipment; information input submodule for inputting the target encryption algorithm and the target secret key, and the plurality of data streams to be encrypted into the encryption processor, the encryption processor is used for parallel encryption processing of the plurality of data streams to be encrypted using the target encryption algorithm and the target secret key; and ciphertext acquisition submodule for acquiring the encryption ciphertext obtained by the encryption processor in parallel encryption processing of the plurality of data streams to be encrypted.

[0255] As a further example, further comprising: a first response unit for determining a first encryption algorithm corresponding to an algorithm selection operation of the user on at least one encryption algorithm in the algorithm library of the encryption engine in response to the algorithm selection operation of the user; and a second response unit for acquiring an operation result of the first encryption algorithm in response to a trigger operation of the user on the first encryption algorithm, the trigger operation including a modification operation or a deletion operation.

[0256] As a further example, further comprising: a third response unit for acquiring a second encryption algorithm corresponding to an algorithm addition operation of the user on the algorithm library in the encryption engine in response to the algorithm addition operation of the user; and an algorithm addition unit for adding the second encryption algorithm to the algorithm library.

[0257] As a further example, the user equipment stores a plurality of secret keys of the user, and the device further comprises: a power consumption level unit for detecting a target power consumption level of the user equipment; a secret key acquisition unit comprising: a power consumption matching module for selecting a target secret key matched with the target power consumption level from the plurality of secret keys of the user stored in the user equipment; and a target algorithm module comprising: an algorithm matching module for selecting a target encryption algorithm matched with the target power consumption level from the at least one encryption algorithm.

[0258] As a further example, the power consumption level of the user equipment is inversely proportional to the encryption strength of each secret key, and the power consumption level of the user equipment is inversely proportional to the calculation complexity of each encryption algorithm.

[0259] As a further example, further comprising: a load calculation module for calculating an encryption load required by an encryption module of the user equipment for performing encryption calculation by using the target secret key and the target encryption algorithm; and a power scheduling module for dynamically scheduling the power resources of the user equipment according to the encryption load required by the encryption module, to obtain a target power resource of the encryption module, the target power resource being used for the encryption module to perform encryption processing on the data stream to be encrypted of the user by using the target encryption algorithm and the target secret key, to obtain the encryption ciphertext.

[0260] As a further example, the load calculation module comprises: a first calculation submodule for determining a first power consumption parameter corresponding to a security check process performed by the user equipment on the to-be-authenticated information; a second calculation submodule for determining a second power consumption parameter required by the user equipment for performing encryption calculation using a target encryption algorithm and a target secret key; a third calculation submodule for determining a third power consumption parameter required by the user equipment for encrypting the to-be-encrypted data stream; and a fourth calculation submodule for adding the first power consumption parameter, the second power consumption parameter and the third power consumption parameter to obtain an encryption load required by an encryption module of the user equipment.

[0261] As a further example, the power scheduling module comprises: a weight determination submodule for determining an encryption weight required by the encryption module according to the encryption load required by the encryption module; and a resource allocation submodule for calculating a target power resource allocated to the encryption module by the user equipment according to the encryption weight and weights of other modules of the user equipment.

[0262] As a further example, the power scheduling module comprises: a voltage calculation submodule for calculating a voltage variation of the encryption module according to the encryption load, a maximum encryption load of the user equipment and a preset voltage adjustment range; and a voltage allocation submodule for adding the voltage variation to a preset basic working voltage of the encryption module to obtain a target working voltage of the encryption module.

[0263] As a further example, the quantum generation unit is further configured to generate the secret key of the user based on a quantum random number generation algorithm; and the secret key storage unit is further configured to store the secret key of the user in a storage component of the user equipment.

[0264] As a further example, the quantum generation unit comprises: a random generation module configured to generate a quantum random number based on a preset quantum random number generator; an information acquisition module configured to acquire secret key information of the user; and a secret key calculation module configured to perform a hash calculation on the quantum random number and the secret key information to obtain the secret key of the user.

[0265] As a further example, the programmable user equipment is a field programmable gate array (FPGA) based user equipment.

[0266] FIG. 6 is a structural schematic diagram of a programmable user equipment according to an embodiment of the present disclosure, which can comprise a memory 601, a processor 602 and a computer program stored in the memory 601, wherein the processor executes the computer program to implement any data encryption method.

[0267] The present disclosure further provides a computer readable storage medium having a computer program / instruction stored thereon, wherein the computer program / instruction is executed by a processor to implement any data encryption method.

[0268] The embodiments of the present disclosure further provide a computer program product comprising computer programs / instructions which, when executed by a processor, implement any of the data encryption methods.

[0269] In the above, the data encryption method according to the embodiments of the present disclosure is described with reference to the accompanying drawings. The programmable user equipment can collect the to-be-authenticated information of the user in response to the data encryption request triggered by the user. The security authentication result corresponding to the to-be-authenticated information can be obtained by performing security check processing on the to-be-authenticated information. The security authentication result is security authentication pass or security authentication fail. In the case of security authentication pass, the target key with which the user has the use right can be obtained. The identity of the user needs to be authenticated before the key is obtained, so as to realize strict use control of the key. Only the user who has passed the security authentication can use the target key, thereby improving the security of the key management, avoiding the possibility of key abuse at the software level, and improving the security of the data encryption process.

[0270] The basic principles of the present disclosure are described above in combination with specific embodiments, but it should be pointed out that the advantages, advantages, effects and the like mentioned in the present disclosure are only examples and not limitations, and these advantages, advantages, effects and the like cannot be considered as the must-have of each embodiment of the present disclosure. In addition, the specific details disclosed above are only for the purpose of example and for the purpose of understanding, and are not limited to the present disclosure, and the above details do not limit the present disclosure to the must-use specific details.

[0271] The block diagrams of the devices, apparatuses, equipment, systems involved in the present disclosure are only illustrative examples and are not intended to require or imply that the connection, arrangement, configuration shown in the block diagram must be connected, arranged, configured. As those skilled in the art will recognize, these devices, apparatuses, equipment, systems can be connected, arranged, configured in any manner. Words such as "include", "contain", "have" and the like are open-ended words, mean "include but not limited to", and can be used interchangeably. The words "or" and "and" used herein mean the word "and / or", and can be used interchangeably unless the context clearly indicates otherwise. The word "such as" used herein means the phrase "such as but not limited to", and can be used interchangeably.

[0272] In addition, as used herein, "or" used in the list of items starting with "at least one" indicates separate listing, so that for example, the list of "at least one of A, B or C" means A or B or C, or AB or AC or BC, or ABC (i.e. A and B and C). In addition, the phrase "exemplary" does not mean that the described example is preferred or better than other examples.

[0273] It is also important to note that the systems and methods of the present disclosure can be embodied in a variety of contexts. For example, the systems and methods of the present disclosure can be implemented in the context of a computer system, a mobile device, a server, a network, a distributed computing environment, etc. It is also important to note that the various components and steps of the systems and methods of the present disclosure can be decomposed and / or recombined. Such decompositions and / or recombinations should be considered equivalents of the present disclosure.

[0274] Various changes, modifications, and alterations to the techniques described herein can be made without departing from the teachings of the technology defined by the appended claims. In addition, the scope of the claims of the present disclosure is not limited to the specific aspects described above. Rather, the scope of the claims of the present disclosure is intended to encompass all techniques, apparatuses, manufactures, compositions of matter, means, methods, and actions that would fall within the scope of a person of ordinary skill in the art, having the benefit of the benefit of this disclosure, and the equivalent thereof.

[0275] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the generic principles defined herein can be applied to other aspects without departing from the scope of the disclosure. Thus, the present disclosure is not intended to be limited to the aspects shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

[0276] The above description has been presented for the purpose of illustration and description. Furthermore, this description is not intended to limit the embodiments of the present disclosure to the forms disclosed herein. Although various example aspects and embodiments have been discussed above, those of skill in the art will recognize certain modifications, permutations, alterations, additions and sub-combinations thereof.

Claims

1. A data encryption method applied to a programmable user device, the method comprising: collecting user to-be-authenticated information in response to a user-triggered data encryption request; performing security check processing on the to-be-authenticated information to obtain a security authentication result corresponding to the to-be-authenticated information, the security authentication result being security authentication passed or security authentication failed; obtaining a target key possessed by the user with a use right in response to the security authentication result being security authentication passed; performing encryption processing on a to-be-encrypted data stream of the user according to the target key to obtain an encrypted ciphertext; and sending the encrypted ciphertext to a cloud server. The to-be-authenticated information includes a biological feature of the user, and the security check processing on the to-be-authenticated information to obtain a security authentication result corresponding to the to-be-authenticated information comprises: performing identity authentication on the biological feature of the user according to a preset biological recognition algorithm to obtain a security authentication result of the user. The obtaining of the target key possessed by the user with a use right in response to the security authentication result being security authentication passed comprises: enabling the user to have access right to a storage component of the user device in response to the security authentication result being security authentication passed; and reading the target key from the storage component. The target key includes a plurality of sub-keys, and the plurality of sub-keys are respectively stored in a plurality of storage components of the user device, and the obtaining of the target key possessed by the user with a use right comprises: obtaining a plurality of storage components corresponding to a plurality of sub-keys included in the target key possessed by the user with a use right to read the plurality of sub-keys from the plurality of storage components; and performing key restoration processing on the plurality of sub-keys to obtain the target key. 5.The method of claim 4, further comprising: dividing the target key of the user into the plurality of sub-keys by a secret sharing algorithm; and storing the plurality of sub-keys in the plurality of storage components, respectively. The performing of key restoration processing on the plurality of sub-keys to obtain the target key comprises: performing key reorganization calculation on the plurality of sub-keys by a Lagrange interpolation algorithm to obtain the target key. The performing of encryption processing on the to-be-encrypted data stream of the user according to the target key to obtain the encrypted ciphertext comprises: determining an algorithm library in an encryption engine of the user device, the algorithm library including at least one encryption algorithm; determining a target encryption algorithm required by the user from the at least one encryption algorithm; and performing encryption processing on the to-be-encrypted data stream of the user according to the target encryption algorithm and the target key to obtain the encrypted ciphertext.

2. The method of claim 1, wherein, The determining of the target encryption algorithm required by the user from the at least one encryption algorithm comprises: collecting encryption environment information in which the user is located; determining an encryption level required by the user according to the encryption environment information; inputting the encryption level into a dynamic scheduler in the encryption engine, the dynamic scheduler being configured to schedule a target encryption algorithm matching the encryption level from the at least one encryption algorithm; and ​ 3. The method of claim 1, wherein, ​ ​ ​ 4. The method of claim 1, wherein, ​ ​ ​ ​ ​ ​ ​ ​ 6. The method according to any one of claims 1 to 5, wherein, ​ ​ ​ ​ 7. The method of claim 6, wherein, ​ ​ ​ ​ obtaining a target encryption algorithm of the dynamic scheduler output.

8. The method of claim 6, wherein, The target encryption algorithm and the target secret key are input into an encryption processor of the user equipment, and the encryption processor is configured to perform parallel encryption processing on the plurality of data streams to be encrypted using the target encryption algorithm and the target secret key. The encryption processor is configured to perform parallel encryption processing on the plurality of data streams to be encrypted using the target encryption algorithm and the target secret key. The encryption processor is configured to perform parallel encryption processing on the plurality of data streams to be encrypted using the target encryption algorithm and the target secret key.

9. The method of claim 6, further comprising: in response to an algorithm selection operation of the user on at least one encryption algorithm of an algorithm library in the encryption engine, determining a first encryption algorithm corresponding to the algorithm selection operation; and in response to a trigger operation of the user on the first encryption algorithm, obtaining an operation result of the first encryption algorithm, the trigger operation including a modification operation or a deletion operation.

10. The method of claim 6, further comprising: in response to an algorithm addition operation of the user on the algorithm library in the encryption engine, obtaining a second encryption algorithm corresponding to the algorithm addition operation; and adding the second encryption algorithm to the algorithm library. The user equipment stores a plurality of secret keys of the user, and the method further comprises: detecting a target power consumption level of the user equipment at present; The target secret key to which the user has a use permission is obtained by:

11. The method according to any one of claims 6-10, wherein, selecting a target secret key matching the target power consumption level from the plurality of secret keys of the user stored in the user equipment; and The target encryption algorithm required by the user is determined from the at least one encryption algorithm by: selecting a target encryption algorithm matching the target power consumption level from the at least one encryption algorithm. The power consumption level of the user equipment is inversely proportional to the encryption strength of each secret key, and the power consumption level of the user equipment is inversely proportional to the calculation complexity of each encryption algorithm.

13. The method of claim 11, further comprising: calculating an encryption load required by an encryption module of the user equipment to perform encryption calculation through the target secret key and the target encryption algorithm; 12. The method of claim 11, wherein, and performing dynamic scheduling processing on power resources of the user equipment according to the encryption load required by the encryption module to obtain target power resources of the encryption module, the target power resources being used by the encryption module to perform encryption processing on the data streams to be encrypted of the user using the target encryption algorithm and the target secret key to obtain the encryption ciphertext. The encryption load required by the encryption module of the user equipment to perform encryption calculation through the target secret key and the target encryption algorithm is calculated by: determining a first power consumption parameter corresponding to the user equipment performing security check processing on the to-be-authenticated information; determining a second power consumption parameter required by the user equipment to perform encryption calculation using the target encryption algorithm and the target secret key; 14. The method of claim 13, wherein, ​ ​ ​ determining a third power consumption parameter required by the user equipment when encrypting the data stream to be encrypted; and adding the first power consumption parameter, the second power consumption parameter and the third power consumption parameter to obtain an encryption load required by an encryption module of the user equipment.

15. The method of claim 13, wherein, The dynamic scheduling processing of the power resource of the user equipment according to the encryption load required by the encryption module comprises: determining an encryption weight required by the encryption module according to the encryption load required by the encryption module; and calculating a target power resource allocated to the encryption module of the user equipment according to the encryption weight and a weight of other modules of the user equipment.

16. The method of claim 13, wherein, The dynamic scheduling processing of the power resource of the user equipment according to the encryption load required by the encryption module comprises: calculating a voltage variation of the encryption module according to the encryption load, a maximum encryption load of the user equipment and a preset voltage adjustment range; and adding the voltage variation to a preset basic working voltage of the encryption module to obtain a target working voltage of the encryption module.

17. The method of any one of claims 1-16, further comprising: generating the user's secret key based on a quantum random number generation algorithm; and storing the user's secret key in a storage component of the user equipment.

18. The method of claim 17, wherein, The generating the user's secret key based on a quantum random number generation algorithm comprises: generating a quantum random number based on a preset quantum random number generator; obtaining secret key information of the user; and performing a hash calculation on the quantum random number and the secret key information to obtain the user's secret key.

19. The method of any one of claims 1-18, wherein, The programmable user equipment is a field programmable gate array (FPGA) based user equipment.

20. A data encryption apparatus applied to a programmable user equipment, the apparatus comprising: a request response unit configured to collect to-be-authenticated information of a user in response to a data encryption request triggered by the user; a security verification unit configured to perform security verification processing on the to-be-authenticated information to obtain a security authentication result corresponding to the to-be-authenticated information, the security authentication result being security authentication passed or security authentication failed; a secret key obtaining unit configured to obtain a target secret key to which the user has a use right in response to the security authentication result being security authentication passed; an encryption calculation unit configured to perform encryption processing on a data stream to be encrypted of the user according to the target secret key to obtain encrypted ciphertext; a ciphertext sending unit configured to send the encrypted ciphertext to a cloud server.

21. A programmable user equipment comprising a memory, a processor and a computer program stored on the memory, wherein, The processor executes the computer program to implement the steps of the method of any one of claims 1-19.

22. A computer readable storage medium having stored thereon computer programs / instructions, wherein, The computer program / instruction is executed by the processor to implement the steps of the method of any one of claims 1-19.

23. A computer program product comprising computer programs / instructions, wherein, The computer program / instruction is executed by the processor to implement the steps of the method of any one of claims 1-19.

Images