Data encryption method and apparatus, computer device, storage medium

Abstract

The present application relates to a data encryption method and apparatus, a computer device, a storage medium, and a computer program product. The method comprises: acquiring plaintext data, and determining a preset encryption algorithm used for encrypting the plaintext data, wherein the encryption algorithm is an algorithm that uses a negotiated key and a negotiated random number of a first preset length for encryption (step 202); generating an extended random number, wherein the length of the extended random number is greater than the first preset length (step 204); intercepting, from the extended random number, a data block of the first preset length as the negotiated random number, and obtaining the remaining data blocks in the extended random number other than the intercepted data block (step 206); acquiring a preset key, and fusing the remaining data blocks into the preset key to obtain the negotiated key (step 208); and calling the encryption algorithm to use the negotiated key and the negotiated random number to encrypt the plaintext data, to obtain encrypted data (step 210).

Description

Data encryption methods, devices, computer equipment and storage media

[0001] Related applications

[0002] This application claims priority to Chinese patent application No. 2024116551224, filed on November 15, 2024, entitled "Data Encryption Method, Apparatus, Computer Equipment and Storage Medium", the entire contents of which are incorporated herein by reference. Technical Field

[0003] This application relates to the field of computer technology, and in particular to a data encryption method, apparatus, computer device, and storage medium. Background Technology

[0004] With the development of science and technology, data encryption technology has emerged. Data encryption technology refers to encrypting data to prevent it from being stolen. For example, data can be encrypted during the uploading and downloading processes to reduce the risk of data theft during these processes.

[0005] When encrypting large amounts of data using the Galois Counter pattern (GCM), random number collisions are prone to occur after encrypting 2^32 messages when using random numbers. A random number collision occurs when a currently generated random number is the same as a previously generated random number. If a random number collision occurs, not only will the confidentiality of the encrypted data be lost, but the underlying encryption key may also be leaked. Therefore, a method to reduce random number collisions is urgently needed. Summary of the Invention

[0006] According to various embodiments provided in this application, a data encryption method, apparatus, computer device, storage medium, and computer program product are provided.

[0007] A data encryption method, executed by a computer device, the method comprising:

[0008] Obtain plaintext data and determine an encryption algorithm for encrypting the plaintext data; the encryption algorithm is an algorithm that uses a negotiated key and a negotiated random number of a first preset length for encryption.

[0009] Generate an extended random number, wherein the length of the extended random number is greater than the first preset length;

[0010] Extract a data block of length 1 preset length from the extended random number as the negotiated random number, and obtain the remaining data block in the extended random number excluding the extracted data block;

[0011] Obtain a preset key, merge the remaining data blocks into the preset key, and obtain a negotiation key;

[0012] The encryption algorithm is invoked to encrypt the plaintext data using the negotiated key and the negotiated random number to obtain encrypted data.

[0013] A data encryption device, the device comprising:

[0014] A plaintext data acquisition module is used to acquire plaintext data and determine a preset encryption algorithm for encrypting the plaintext data; the encryption algorithm is an algorithm that uses a negotiated key and a negotiated random number of a first preset length for encryption.

[0015] The negotiation random number generation module is used to generate an extended random number, the length of which is greater than the first preset length; to extract a data block of the first preset length from the extended random number as the negotiation random number, and to obtain the remaining data block in the extended random number excluding the extracted data block;

[0016] The negotiation key generation module is used to obtain a preset key, merge the remaining data blocks into the preset key, and obtain a negotiation key.

[0017] The encryption module is used to call the encryption algorithm to encrypt the plaintext data using the negotiation key and the negotiation random number to obtain encrypted data.

[0018] A computer device includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the steps of any of the data encryption methods provided in the embodiments of this application.

[0019] A computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of any of the data encryption methods provided in the embodiments of this application.

[0020] A computer program product, comprising a computer program that, when executed by a processor, implements the steps of any of the data encryption methods provided in the embodiments of this application.

[0021] Details of one or more embodiments of this application are set forth in the following drawings and description. Other features and advantages of this application will become apparent from the specification, drawings, and claims. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of this application or the conventional technology, the drawings used in the description of the embodiments or the conventional technology will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the disclosed drawings without creative effort.

[0023] Figure 1 is an application environment diagram of a data encryption method in one embodiment;

[0024] Figure 2 is a flowchart illustrating a data encryption method in one embodiment;

[0025] Figure 3 is a schematic diagram of data block extraction in one embodiment;

[0026] Figure 4 is a schematic diagram of data fusion in one embodiment;

[0027] Figure 5 is a schematic diagram of data encryption using an encryption algorithm in one embodiment;

[0028] Figure 6 is a schematic diagram of the doubling operation in one embodiment;

[0029] Figure 7 is a schematic diagram of the multiplication operation in another embodiment;

[0030] Figure 8 is a schematic diagram of the overall process of key derivation in one embodiment;

[0031] Figure 9 is a schematic diagram of the overall process of plaintext encryption in one embodiment;

[0032] Figure 10 is a schematic diagram of a video encryption and decryption application scenario in one embodiment;

[0033] Figure 11 is a schematic diagram of the overall architecture of a data encryption method in one embodiment;

[0034] Figure 12 is a structural block diagram of a data encryption device in one embodiment;

[0035] Figure 13 is an internal structure diagram of a computer device in one embodiment;

[0036] Figure 14 is an internal structural diagram of a computer device in another embodiment. Detailed Implementation

[0037] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0038] The data encryption method provided in this application embodiment can be applied to the application environment shown in Figure 1. Terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated on server 104 or placed on the cloud or other servers. Both terminal 102 and server 104 can be used independently to execute the data encryption method provided in this application embodiment. Terminal 102 and server 104 can also be used collaboratively to execute the data encryption method provided in this application embodiment. Taking the example of terminal 102 and server 104 collaboratively executing the data encryption method provided in this application embodiment, terminal 102 can obtain plaintext data and a preset key, and generate an extended random number. Terminal 102 generates a negotiated random number based on the extended random number, and modifies the preset key based on the extended random number to obtain a negotiated key. Terminal 102 uses an encryption algorithm and encrypts the plaintext data based on the negotiated key and the negotiated random number to obtain encrypted data, and sends the encrypted data to server 104 so that server 104 stores the received encrypted data. The terminal 102 can be, but is not limited to, various desktop computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices can include smart speakers, smart TVs, smart air conditioners, and smart in-vehicle systems. Portable wearable devices can include smartwatches, smart bracelets, and head-mounted devices. The server 104 can be implemented using a standalone server or a server cluster consisting of multiple servers.

[0039] It should be noted that the terms "first," "second," and similar terms used in this application do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Unless the context clearly indicates otherwise, the singular forms "a," "one," or "the," etc., do not indicate a quantity limitation, but rather indicate the presence of at least one. The quantities of "multiple" or "multiple copies" mentioned in the embodiments of this application all refer to a quantity of "at least two," for example, "multiple" means "at least two," and "multiple copies" means "at least two copies."

[0040] In one embodiment, as shown in Figure 2, a data encryption method is provided. Taking the application of this method to a computer device as an example, the computer device can be a terminal or server as shown in Figure 1, and includes the following steps:

[0041] Step 202: Obtain plaintext data and determine the encryption algorithm used to encrypt the plaintext data; the encryption algorithm is an algorithm that uses a negotiated key and a negotiated random number of a first preset length for encryption.

[0042] Plaintext data refers to unencrypted data. An encryption algorithm is a mathematical function or operational rule used to encrypt data. A key is a parameter input into an algorithm that converts plaintext to ciphertext or vice versa. Keys can be symmetric or asymmetric; in this embodiment, the key is a symmetric key. The encryption algorithm in this embodiment is a pre-set algorithm, specifically an encryption algorithm that encrypts plaintext data based on a negotiated key and a negotiated random number of a first preset length. The negotiated key is a key, and the negotiated random number is a random number. Therefore, the encryption algorithm is essentially an algorithm that encrypts plaintext data based on a key and a random number of a first preset length.

[0043] Specifically, the computer device can acquire plaintext data and determine a pre-set encryption algorithm to encrypt that plaintext data. For example, in a video upload scenario, the computer device can acquire the video to be uploaded and use it as plaintext data. Similarly, in a user information upload scenario, the computer device can acquire the user information to be uploaded and use it as plaintext data. Upon acquiring the plaintext data, the computer device can also determine a pre-set encryption algorithm so that the acquired plaintext data can be subsequently encrypted based on that algorithm. For example, the pre-set encryption algorithm could be a symmetric encryption algorithm using the Galois counter mode, and the plaintext data could be encrypted using this symmetric encryption algorithm.

[0044] In one embodiment, the encryption algorithm is an algorithm that encrypts data based on a key and a random number of a first preset length. For example, the encryption algorithm may be a symmetric encryption algorithm using the Galois counter mode, and the random number used is a 96-bit data.

[0045] Step 204: Generate an extended random number. The length of the extended random number is greater than the first preset length. The first preset length is the length pre-set for the negotiated random number when encryption is performed using an encryption algorithm.

[0046] Computer devices can generate extended random numbers using a preset random number generation algorithm. The values ​​in the extended random number are random, but the length of the generated extended random number must be greater than a first preset length. For example, with a first preset length of 96 bits, the generated extended random number can be 192 bits. The first preset length is a pre-set length for the negotiated random number, for example, 96 bits. In traditional schemes, encryption algorithms are based on a 96-bit random number; therefore, the first preset length can be set to 96 bits, allowing for the subsequent generation of a 96-bit negotiated random number.

[0047] In one embodiment, the computer device may select a seed number and calculate the square of the seed number, then select data of a second preset length from the square of the seed number as an extended random number. The second preset length is greater than the first preset length; for example, the second preset length may be 192 bits, and the first preset length may be 96 bits. It is easy to understand that the seed number selected each time an extended random number is generated can be different. For example, an initial seed number can be determined, and each time an extended random number needs to be generated, a preset value can be added to the previous seed number to obtain the current seed number, and then the current extended random number can be generated based on the current seed number.

[0048] In one embodiment, the computer device may select a seed number and calculate the square of the seed number. A second preset length of data is then extracted from the square of the seed number, and the process proceeds to the next round. The second preset length of data extracted from the previous round is used as the new seed number, and the process returns to the step of calculating the square of the seed number. This continues until a stopping condition is met, and the second preset length of data extracted from the square of the last round is used as the extended random number. It is easily understood that the seed number selected each time an extended random number is generated can be different, and the data portion extracted in each round can also be different, thereby increasing randomness.

[0049] Step 206: Extract a data block of length 1 preset length from the extended random number as a negotiated random number, and obtain the remaining data block in the extended random number excluding the extracted data block.

[0050] Here, a data block refers to a string. For example, in binary, a data block can be a string consisting of 0s and 1s. The remaining data block is the data block remaining after the negotiated random number is extracted from the extended random number. For example, if the extended random number is "000111", and "000" is extracted from the extended random number as the negotiated random number, then the remaining data block will be "111".

[0051] Specifically, since the length of the extended random number is greater than the first preset length, the computer device can extract a data block of the first preset length from the extended random number and use the extracted data block as the negotiated random number. The computer device can determine the remaining data block in the extended random number excluding the extracted data block. For example, referring to Figure 3, when the extended random number is 192 bits, the computer device can extract the last 12 bytes of data from the extended random number as the negotiated random number, and the first 12 bytes of data in the extended random number are the remaining data block excluding the extracted data block. Figure 3 shows a schematic diagram of data block extraction in one embodiment.

[0052] In one embodiment, the computer device may also extract the first 12 bytes of data from the extended random number as the negotiated random number. In this case, the last 12 bytes of data in the extended random number are the remaining data blocks excluding the extracted data blocks. Alternatively, the computer device may extract data blocks from the middle part of the extended random number to obtain the negotiated random number and the remaining data blocks.

[0053] Step 208: Obtain the preset key, merge the remaining data blocks into the preset key, and obtain the negotiation key.

[0054] In this context, a preset key refers to a pre-generated key. For example, a preset key could be a symmetric key generated before receiving the plaintext data for symmetric encryption. Symmetric encryption is an encryption method using a single-key cryptosystem, where the same key can be used for both encryption and decryption. This method is called symmetric encryption, also known as single-key encryption. The key used in symmetric encryption is called the symmetric key. In symmetric encryption, the sender processes the plaintext data and the encryption key together using a special encryption algorithm, transforming it into complex ciphertext before sending it. The receiver, upon receiving the ciphertext, needs to use the same key and the inverse algorithm to decrypt it and recover the readable plaintext.

[0055] Specifically, the computer device can obtain a preset key and integrate the remaining data block into that preset key to obtain a negotiation key carrying the data information of the remaining data block. For example, the remaining data block can be stored using some preset data bits in the preset key. The preset data bits in the preset key refer to data bits whose values ​​will not affect the encryption effect even if modified.

[0056] In one embodiment, referring to Figure 4, the preset key can be a binary string of a certain length, and the remaining data block can also be a binary string of a certain length. The position of a character in the binary string is called a data bit, that is, each character occupies one data bit. Thus, the characters in the remaining data block can replace the characters in the preset data bits of the preset key to obtain the negotiation key. Figure 4 shows a schematic diagram of data fusion in one embodiment.

[0057] In one embodiment, during the process of fusing the remaining data blocks with the preset key, the length of the preset key is not increased or decreased; only the data is fused. This ensures that the length of the negotiated key generated after fusion is consistent with the preset length.

[0058] In one embodiment, a preset key can be generated before obtaining the preset key. A random number generator can be used to generate the preset key to ensure its randomness and unpredictability, thereby enhancing its security. Alternatively, data input by the programmer can be obtained, and the preset key can be generated based on this input and a preset key generation algorithm.

[0059] Step 210: Invoke the encryption algorithm to encrypt the plaintext data using the negotiated key and negotiated random number to obtain encrypted data.

[0060] Specifically, a computer device can input a negotiation key, a negotiation random number, and plaintext data into an encryption algorithm. The encryption algorithm then uses the negotiation key and the negotiation random number to encrypt the plaintext data, obtaining encrypted data. For example, referring to Figure 5, the negotiation key, the negotiation random number, and the plaintext data are all inputs to the encryption algorithm. Once the encryption algorithm receives the inputs, it can process the inputs through preset encryption logic and output encrypted data. Figure 5 shows a schematic diagram of data encryption using an encryption algorithm in one embodiment.

[0061] In one embodiment, the encryption algorithm can be any algorithm, as long as its input is a key and a random number of a first preset length. For example, the encryption algorithm can be a symmetric encryption algorithm using the Galois counter mode. A symmetric encryption algorithm is one that uses the same key for both encryption and decryption.

[0062] In the above data encryption method, by generating an extended random number, a random number longer than the first preset length can be obtained. Since the data length of the extended random number is longer than the first preset length, a data block of the first preset length can be extracted from the extended random number as a negotiation random number, resulting in a remaining data block. By obtaining a preset key, the remaining data block can be fused with the preset key, using some free data bits in the preset key to store the data content of the remaining data block, thereby obtaining a negotiation key containing the remaining data block. By obtaining the negotiation key and the negotiation random number of the first preset length, the plaintext data can be encrypted based on the negotiation key and the negotiation random number of the first preset length using a preset encryption algorithm to obtain encrypted data.

[0063] Because the extended random number is divided into the remaining data block and the negotiated random number, and some free data bits in the preset key can be used to store the data content of the remaining data block to obtain the negotiated key, the content of the extended random number is actually distributed across the negotiated random number and the negotiated key. Therefore, in the process of data encryption using the negotiated random number and the negotiated key, the data content of the extended random number is actually used for encryption. Furthermore, since the length of the extended random number is greater than the first preset length, using an extended random number longer than the first preset length for data encryption achieves the goal of encryption based on a longer random number, thus reducing the probability of random number collisions.

[0064] Furthermore, in traditional methods, encryption algorithms use a preset key and a random number of a first preset length for encryption. Since the length of the negotiated random number is also the first preset length, consistent with the length of the random number used for encryption in the traditional method, and the length of the negotiated key is the same as the length of the preset key, consistent with the length of the key used for encryption in the traditional method, there is no need to modify the underlying implementation logic of the encryption algorithm. Simply inputting the negotiated random number and negotiated key into the encryption algorithm enables data encryption based on the algorithm. This allows data encryption without creating new encryption primitives, saving the human and computer resources required to create new encryption primitives.

[0065] In one embodiment, generating an extended random number includes: obtaining a second preset length; the second preset length being greater than a first preset length; determining a random number generation algorithm; inputting the second preset length into the random number generation algorithm; and using the random number generation algorithm to generate an extended random number of the second preset length.

[0066] Specifically, the computer device can determine a second preset length, which is greater than a first preset length. For example, a programmer can input the second preset length through the computer device. Further, the computer device determines a pre-set random number generation algorithm and inputs the second preset length into the algorithm, using the algorithm to generate an extended random number of the second preset length.

[0067] In one embodiment, the computer device may input a second preset length into the rand function to generate an extended random number of the second preset length.

[0068] In one embodiment, the computer device may be equipped with multiple random number generation algorithms. Each time an extended random number is generated, one of the multiple random number generation algorithms can be randomly selected, and the extended random number is generated based on the randomly selected algorithm. By setting multiple random number generation algorithms and randomly selecting one to generate the extended random number, the randomness of the extended random number can be increased.

[0069] In the above embodiments, by determining the second preset length and the random number generation algorithm, an extended random number longer than the first preset length can be generated based on the random number generation algorithm and the second preset length. This allows for a reduction in the probability of random number collisions based on the longer extended random number. A random number collision occurs when two random numbers are identical. For example, when encrypting different plaintext data using the same key, if the random number generated during the encryption of plaintext data A is the same as the random number generated during the encryption of plaintext data B, then a random number collision is considered to have occurred.

[0070] In one embodiment, the remaining data block is merged into a preset key to obtain a negotiation key, including: generating a first initialization data block; the length of the first initialization data block is the length of the preset key; encrypting the first initialization data block according to the preset key to obtain a first information block; increasing the length of the remaining data block according to the length of the first information block to obtain a second information block; and generating a negotiation key based on the first information block and the second information block.

[0071] Specifically, the computer device can generate a first initialization data block. For example, the computer device can generate a data block of all zeros with a third preset length and use this data block as the first initialization data block. Furthermore, the computer device can encrypt the first initialization data block using a preset key to obtain the first information block.

[0072] Furthermore, the computer device generates a second information block based on the remaining data block. For example, the computer device determines whether the length of the remaining data block is the same as the length of the first information block. If the length of the remaining data block is less than the length of the first information block, the computer device expands the remaining data block to obtain a second information block with the same length as the first information block. Further, when the first and second information blocks are obtained, the computer device generates a negotiation key based on the first and second information blocks. For example, the computer device merges the first and second information blocks to obtain the negotiation key.

[0073] In one embodiment, the computer device may use the SM4 encryption algorithm to encrypt the first initialization data block, obtaining an encrypted data block of the first initialization data block. For example, the computer device inputs a preset key and the first initialization data block into the SM4 encryption algorithm. The SM4 encryption algorithm generates multiple round keys based on the preset key, and encrypts the first initialization data block based on these multiple round keys, obtaining an encrypted data block of the first initialization data block. The SM4 algorithm, also known as the SM4 block cipher algorithm, is a commercially available block cipher algorithm with a 128-bit key length and a 128-bit block length. In this embodiment, the preset key length can be 128 bits, and the generated first initialization data block length can also be 128 bits.

[0074] In one embodiment, the first initialization data block is encrypted according to a preset key to obtain an encrypted data block of the first initialization data block. A Galois multiplication operation is then performed on the encrypted data block of the first initialization data block to obtain the first information block. For example, a computer device performs a Galois multiplication operation on the encrypted data block of the first initialization data block to obtain the first information block. A Galois field is a field containing only a finite number of elements; therefore, it is also called a finite field. The number of elements in a Galois field is pn, where p is a prime number and n is a positive integer. The characteristic number of a Galois field must be a prime number p. Multiplication refers to increasing by a factor of two, and a multiplication operation is an operation used to increase a value by a factor of two.

[0075] In one embodiment, the first information block and the second information block can be weighted and averaged to obtain the negotiation key. Alternatively, the first information block and the second information block can be XORed to obtain the negotiation key.

[0076] In this embodiment, since the first information block is obtained by encrypting the first initialization data block with a preset key, the first information block may contain information about the preset key; since the second information block is generated based on the remaining data block, the second information block contains information about the remaining data block; since the negotiation key is generated based on the first and second information blocks, and the first information block contains information about the preset key and the second information block contains information about the remaining data block, the negotiation key generated based on the first and second information blocks may contain information about the preset key and the remaining data block. This achieves the fusion of the remaining data block into the preset key to obtain the negotiation key.

[0077] In one embodiment, encrypting the first initialization data block according to the preset key to obtain the first information block includes: encrypting the first initialization data block according to the preset key to obtain an encrypted data block of the first initialization data block; determining the most significant bit of the encrypted data block of the first initialization data block; and, if the value of the most significant bit is a preset first target value, performing a left shift operation on the value in the encrypted data block of the first initialization data block to obtain the first information block.

[0078] Specifically, the computer device can encrypt the first initialization data block according to a preset key to obtain the encrypted data block of the first initialization data block. After obtaining the encrypted data block of the first initialization data block, in order to ensure the spread and obfuscation of the operation result and resist cryptanalysis, the computer device can also perform a Galois multiplication operation on the encrypted data block of the first initialization data block to obtain the first information block.

[0079] For example, the encrypted data block of the first initialization data block can be binary data. The computer device can obtain the most significant bit of the encrypted data block of the first initialization data block. Here, a significant bit refers to the number of binary bits (excluding the sign bit) that can affect the calculation result in a numerical value; the most significant bit of the encrypted data block of the first initialization data block is the leftmost bit excluding the sign bit. The computer device obtains a preset first target value and a second target value, and determines whether the value at the most significant bit is the first target value. If it is the first target value, since the encrypted data block of the first initialization data block is in binary format, it can be left-shifted by one bit to obtain the first information block.

[0080] In one embodiment, shifting the encrypted data block of the first initialization data block left by one bit can be done by shifting all the binary characters in the encrypted data block of the first initialization data block to the left by one bit, discarding the shifted-out bit, and padding the right side with zeros.

[0081] In one embodiment, referring to Figure 6, the first target value can specifically be 0. That is, when the most significant bit of the encrypted data block of the first initialization data block is 0, the encrypted data block of the first initialization data block is shifted one bit to the left and filled with zeros on the right, thus achieving the doubling of the value. Figure 6 shows a schematic diagram of the doubling operation in one embodiment.

[0082] In the above embodiments, by determining the most significant bit of the first initialized encrypted data block, it can be determined whether the most significant bit is the first target value. When the most significant bit is the first target value, it can be considered that performing a binary left shift operation can achieve the doubling of the value. At this time, a binary left shift operation is performed on the first initialized encrypted data block to achieve the doubling operation on the Galois field of the first initialized encrypted data block, thereby improving the data obfuscation effect based on the doubling operation on the Galois field, thereby resisting cryptanalysis and improving the security of encryption.

[0083] In one embodiment, the method further includes: when the value on the most significant bit is a preset second target value, performing a left shift operation on the value in the encrypted data block of the first initialization data block to obtain a left-shifted encrypted data block; obtaining a preset irreducible polynomial representation, and performing an XOR operation on the left-shifted encrypted data block and the irreducible polynomial representation to obtain a first information block.

[0084] Specifically, when the most significant bit of the encrypted data block of the first initialization data block is not the first target value, but is the second target value, it can be considered that performing a binary left shift operation on the encrypted data block of the first initialization data block alone cannot achieve value doubling. For example, the second target value may specifically be 1. When the most significant bit of the encrypted data block of the first initialization data block is 1, if a binary left shift operation is performed on the encrypted data block of the first initialization data block by one bit, the most significant bit of 1 in the encrypted data block of the first initialization data block can be removed. In this case, not only can the value not be increased, but it may also cause the value to decrease. Therefore, in order to multiply the value of the encrypted data block of the first initialization data block, the computer device first performs a binary left shift on the encrypted data block of the first initialization data block by one bit to obtain a left-shifted encrypted data block, and obtains a preset irreducible polynomial representation. An XOR operation is then performed on the left-shifted encrypted data block and the irreducible polynomial representation to obtain the first information block. Here, an irreducible polynomial refers to a polynomial that cannot be factored over a specified field. In the Galois field, an irreducible polynomial is a prime polynomial that can only be divided by 1 and itself. The representation of an irreducible polynomial refers to representing the irreducible polynomial using numerical values ​​in a preset format. For example, an irreducible polynomial can be represented as a string of binary data.

[0085] In one embodiment, the predefined irreducible polynomial representation may specifically be a Galois domain GF(2). 128 The irreducible polynomial of is represented as 0b10000111. Because computers use binary, 2 m Each element corresponds exactly to a binary number of length m. For example, GF2. 128 This corresponds exactly to the 128 binary bits in a computer, so it can have high computational efficiency on computers or dedicated hardware.

[0086] In one embodiment, referring to FIG7, FIG7 illustrates a schematic diagram of a doubling operation in another embodiment. When the most significant bit of the encrypted data block of the first initial data block is 1, the encrypted data block of the first initial data block is first left-shifted in binary, and then the left-shift result is XORed with the irreducible polynomial representation 0b10000111 to obtain the first information block with a multiplied value.

[0087] In the above embodiments, when the value on the most significant bit is the second target value, it can be considered that simply performing a binary left shift operation cannot achieve the doubling of the value. Therefore, at this time, the doubling operation on the Galois field is achieved by performing a binary left shift and XORing with a preset irreducible polynomial representation.

[0088] In one embodiment, since the encrypted data of the first initialization data block is 128 bits, the multiplication operation on the encrypted data block of the first initialization data block can be performed in the Galois field GF(2 128 The doubling operation on GF(2) is performed on the Galois field. 128 The multiplication operation on the ) can be part of the Galois Counter Mode (GCM) operation itself. Therefore, the embodiments of this application use a part of the Galois Counter Mode (GCM) operation itself to perform the multiplication operation, without introducing new cryptographic primitives, thus saving the resources consumed by introducing new cryptographic primitives.

[0089] In one embodiment, the second information block is obtained by increasing the length of the remaining data block according to the length of the first information block, including: determining a third preset length according to the length of the first information block and the length of the remaining data block, and generating a second initialization data block with the third preset length; and concatenating the remaining data block with the second initialization data block to obtain the second information block.

[0090] Specifically, the computer device can determine a third preset length and initialize a data block of the third preset length to obtain a second initialized data block. For example, if the length of the first information block is 128 bits and the length of the remaining data block is 96 bits, in order to generate a second information block with the same length as the first information block, the third preset length can be 4 bytes, i.e., 128-96=32 bits. The computer device can initialize a second initialized data block with 4 bytes. Further, the computer device concatenates the remaining data block with the second initialized data block to obtain the second information block. For example, the computer device can concatenate the remaining data block after the second initialized data block to obtain the second information block.

[0091] In one embodiment, to facilitate merging with the first information block, the length of the generated second information block can be the same as the length of the first information block. Since the extended random number is 192 bits long, and the negotiated random number derived from the extended random number is 96 bits long, the remaining data block is 96 bits long. The first information block is 128 bits long; therefore, the second initialization data block can be 4 bytes (32 bits) long. Thus, by concatenating the remaining data block after the second initialization data block, a second information block of 128 bits in length can be obtained.

[0092] In one embodiment, the initialized second initialization data block can be a data block common to the cryptographic field: 0x00, 0x01, 0x58, 0x00. The specific meaning of the fixed prefix is: the first two bits are counters (0x00, 0x01), the third bit is a flag bit (the binary representation of the uppercase letter "X" in ASCII), and the fourth bit is 0x00. By generating a second initialization data block common to the cryptographic field, subsequent use based on this second initialization data block can comply with authentication requirements.

[0093] In one embodiment, the second initialization data block can also be an all-zero data block to reduce the amount of subsequent computation.

[0094] In the above embodiments, by generating a second initialization data block, the length of the remaining data block can be expanded based on the second initialization data block, thereby obtaining a second information block with the same length as the first information block. By obtaining a second information block with the same length as the first information block, it is easier to perform subsequent calculations and processing between the first and second information blocks, thus improving the efficiency of data processing.

[0095] In one embodiment, generating a negotiation key based on a first information block and a second information block includes: performing an XOR operation on the first information block and the second information block to obtain an XOR information block; and encrypting the XOR information block based on a preset key to obtain the negotiation key.

[0096] Specifically, when a computer device obtains the first information block and the second information block, it can first perform an XOR operation on the first and second information blocks to obtain an XOR information block, and then encrypt the XOR information block using a preset key to obtain a negotiation key. For example, the computer device can use the SM4 encryption algorithm and the preset key to encrypt the XOR information block to obtain the negotiation key.

[0097] In this embodiment, since the XOR operation can be regarded as a data encryption process, performing an XOR operation on the first information block and the second information block can be considered as encrypting the second information block through the first information block. In this way, the initial encryption result of the second information block can be obtained. Since the second information block includes the remaining data block, the remaining data block in the second information block can be merged into the preset key by encrypting the second information block again using the preset key and based on the SM4 encryption algorithm to obtain the negotiated key.

[0098] In one embodiment, referring to Figure 8, Figure 8 illustrates a schematic diagram of the overall key derivation process in one embodiment. The computer device can initialize a data block of all zeros as a first initialization data block, the length of which is 16 bytes (128 bits, i.e., the standard block length of SM4). The computer device uses a preset key K and encrypts the first initialization data block of all zeros using the SM4 encryption algorithm to generate an encrypted data block L of the first initialization data block. The computer device performs a galvanic field GF(2^3) operation on the encrypted data block L of the first initialization data block. 128 The doubling operation on GF(2) yields the first information block K. In the Galois field GF(2) 128 The doubling operation on GF(2) is as follows: Extract the most significant bit (MSB) (L) of the encrypted data block L of the first initialization data block; if the most significant bit (MSB) (L) is 0, then shift the encrypted data block L of the first initialization data block left by one bit, i.e., L << 1; if the most significant bit (MSB) (L) is 1, then first shift the encrypted data block L of the first initialization data block left by one bit, and then multiply it by GF(2). 128 The irreducible polynomial representation 0b10000111 is subjected to an XOR operation.

[0099] Furthermore, the computer device constructs a second information block M of 128 bits in length, as follows: The computer device initializes a data block as the second data block, with a length of 4 bytes: 0x00, 0x01, 0x58, 0x00. The first two bits represent a counter (0x00, 0x01), the third bit is a flag bit (the binary representation of the uppercase letter "X" in ASCII), and the fourth bit is 0x00. The computer device randomly generates a 192-bit extended random number Nonce, and appends the first 12 bytes of the extended random number Nonce to the end of the second initialized data block to obtain the 128-bit second information block M.

[0100] Furthermore, the computer device performs an XOR operation on the first information block K and the second information block M, and then encrypts the result of the XOR operation using SM4 encryption with a preset key to obtain a 128-bit negotiation key Kx. Additionally, the computer device extends the Nonce by 12 bytes to obtain a 96-bit negotiation random number Nx. Thus, the negotiation key Kx and the negotiation random number Nx are obtained.

[0101] The key derivation process described above is a combination of operations based solely on SM4 and the Galois counter mode (GCM) itself, without introducing any additional hash functions or creating any new cryptographic primitives.

[0102] In one embodiment, the length of the remaining data block is less than the length of the preset key; the lengths of the first initialization data block, the first information block, and the second information block are all the same as the length of the preset key. Specifically, the length of the remaining data block can be 96 bits, and the lengths of the first initialization data block, the first information block, the second information block, and the preset key can all be 128 bits. The preset key is 128 bits long, the extended random number is 192 bits long, the negotiated random number truncated from the extended random number is 96 bits long, and the negotiated key obtained by fusing the preset key and the remaining data blocks (excluding the truncated data blocks) from the extended random number is 128 bits long. The encryption algorithm is a symmetric encryption algorithm using the Galois counter mode, used to encrypt plaintext data using a 128-bit negotiated key and a 96-bit negotiated random number. Thus, the SM4 encryption algorithm can be used for encryption.

[0103] In one embodiment, referring to Figure 8, two SM4 encryption processes are performed during the entire key derivation stage. The result of the first SM4 encryption process can be reused; that is, the encrypted data block of the first initialization data block can be reused. For example, when encrypting multiple messages using a preset key, since the first initialization data block is an unchanging all-zero data block, the result of SM4 encryption of this all-zero data block using the same key will not change. Therefore, when encrypting subsequent messages using the preset key, the encryption result generated when encrypting the first message using the same preset key can be directly used. By reusing the first initialization data block, the computational resources consumed in regenerating the first initialization encrypted data block can be saved.

[0104] The key derivation phase converts the 192-bit extended random number (Nonce) and the 128-bit preset key into a 96-bit negotiated random number (Nonce) and a 128-bit negotiated key. This key derivation phase can be described using a counter-based key derivation function (KDF). Furthermore, the key derivation phase conforms to the construction process of a One-Key CBC-MAC (OMAC) based on cryptographic algorithms. Therefore, while ensuring compliance, the unidirectional nature of the entire key derivation phase and the non-linear nature of the multiplication process ensure that even if an attacker obtains the key data block L of the first initialization data block, they cannot reverse-engineer the permutation of the preset key K, thus guaranteeing the security of the preset key K.

[0105] In one embodiment, once the negotiated key and negotiated random number are obtained, plaintext data can be encrypted using these two keys. The SM4 algorithm in Galois counter mode can be employed for encryption. The initial vector used in the encryption process should be the negotiated random number, and the key used should be the negotiated key. The encryption process based on the negotiated random number and negotiated key can be implemented using standard encryption algorithms without introducing additional cryptographic primitives or computational procedures. It is easy to understand that since both the key derivation stage and the stage of encrypting plaintext data based on the negotiated key and negotiated random number are combinations of the SM4 and GCM operations themselves, no additional hash functions or new encryption primitives are required, thus ensuring complete autonomy and controllability of the process. Furthermore, due to the use of Galois counter mode, the integrity of the plaintext data can be guaranteed, and the plaintext data can also carry additional associated data information (such as user identity, request number, etc.), thereby ensuring the integrity and confidentiality of the plaintext data, as well as preventing the integrity of the associated information from being tampered with.

[0106] In one embodiment, an encryption algorithm is used to encrypt plaintext data based on a negotiated key and a negotiated random number to obtain encrypted data. This includes: generating an initial value for a counter based on the negotiated random number; encrypting the initial value of the counter based on the negotiated key to obtain an initial encryption value; in the first round of the multi-round data encryption process, determining the first round's data block to be encrypted from the plaintext data, increasing the initial value of the counter to obtain the first round's counter value; encrypting the first round's counter value based on the negotiated key; and encrypting the first round's encrypted counter value and the negotiated key. The data block to be encrypted is encrypted to obtain the ciphertext block of the first round. In the current round of the multi-round data encryption process, excluding the first round, the data block to be encrypted in the plaintext data of the current round is determined, and the counter value of the previous round is increased to obtain the counter value of the current round. The counter value of the current round is encrypted based on the negotiation key, and the data block to be encrypted in the current round is encrypted based on the encrypted counter value of the current round, the negotiation key, and the ciphertext block of the previous round to obtain the ciphertext block of the current round. Based on the initial encryption value and the ciphertext block of the last round, the encrypted data is obtained.

[0107] Specifically, the computer device generates an initial value for a counter based on a negotiated random number. For example, the computer device directly uses the negotiated random number as the initial value of the counter and performs a symmetric encryption operation on the initial value of the counter using the negotiated key to obtain an encrypted initial value. After generating the encrypted initial value, the computer device can execute a multi-round data encryption process. In the first round of the multi-round data encryption process, the computer device determines the first round of data to be encrypted in the plaintext data. For example, the computer device segments 128 bits of data from the plaintext data to obtain the first round of data to be encrypted. The computer device increases the initial value of the counter according to a preset increment to add a preset increment to the initial value of the counter to obtain the counter value for the first round. Further, the computer device performs a symmetric encryption operation on the counter value for the first round based on the negotiated key to obtain the encrypted counter value for the first round. The computer device performs an XOR operation on the data to be encrypted in the first round and the encrypted counter value for the first round to obtain the XOR operation result for the first round. The computer device then performs an XOR operation on the negotiated key and the XOR operation result for the first round in the finite field GF(2). 128 Multiply the data in the first round to obtain the ciphertext block. The computer device removes the data to be encrypted from the first round of plaintext data to obtain new plaintext data, which is then used to determine the data to be encrypted in the next round.

[0108] In the multi-round data encryption process, excluding the first round, the computer device segments the data to be encrypted in the current round from the plaintext data. For example, the computer device segments a 128-bit data block from the new plaintext data as the data to be encrypted in the current round. Further, the computer device adds the counter value from the previous round to a preset increment to obtain the counter value for the current round, and performs a symmetric encryption operation on the counter value for the current round using the negotiated key to obtain the encrypted counter value for the current round. The computer device performs an XOR operation on the data to be encrypted in the current round and the encrypted counter value for the current round, and performs an XOR operation on the result of the XOR operation with the ciphertext block from the previous round to obtain the XOR result for the current round. The XOR result of the current round and the negotiated key are then used in a finite field GF(2). 128 Multiply the data in the plaintext data to obtain the ciphertext block for the current round. The computer device removes the data to be encrypted for the current round from the plaintext data and obtains new plaintext data for the next round to determine the data to be encrypted.

[0109] When the plaintext data is less than or equal to 128 bits in length, it is used as the data to be encrypted in the last round. This last round of data is then encrypted using the method described above, resulting in the ciphertext block for the last round. The computer device then uses the initial encryption value and the ciphertext block from the last round to obtain the encrypted data. For example, the computer device might XOR the initial encryption value with the ciphertext block from the last round to obtain the encrypted data.

[0110] In one embodiment, referring to Figure 9, Figure 9 illustrates a schematic diagram of the overall process of plaintext encryption in one embodiment. Here, Ek represents performing a symmetric encryption operation on the input using a preset key; Mh represents encrypting the input and the negotiated key within the finite field GF(2). 128 Multiply by ) . Len(A) represents the length of the authentication data carried in the plaintext data, and Len(C) represents the length of the ciphertext block.

[0111] In the above embodiments, by generating a negotiation key and a negotiation random number, plaintext data can be encrypted using the negotiation key and the negotiation random number. Since the extended random number is distributed throughout the negotiation key and the negotiation random number, encrypting plaintext data using the negotiation key and the negotiation random number is actually encrypting the plaintext data using the extended random number. Compared to traditional encryption using shorter random numbers, using longer extended random numbers reduces the probability of random number collisions. The encryption method of this embodiment can securely encrypt at least 2... 80 The next message (in guarantee 2) -23 In the case of a high probability of conflict, the length of a single message can be as long as 64 GiB.

[0112] In one embodiment, obtaining plaintext data includes: obtaining data generated in the sub-application as plaintext data; the sub-application is an application running in the runtime environment provided by the parent application, and the parent application is a native application running on the operating system; the method further includes: sending encrypted data to the background server of the sub-application.

[0113] In this context, a child application is an application that can run in the runtime environment provided by the parent application, while the parent application is a native application that runs on the operating system and provides the runtime environment for the child applications. The parent application provides the runtime environment for the child applications, creating logic layer processing units and view layer processing units to implement the child applications. The view layer processing unit handles the views of the child applications; the logic layer processing unit handles the interaction logic of the child applications. These processing units can be processes or threads, such as logic layer threads and corresponding view layer threads. The logic layer processing unit can run in a virtual machine, such as the JavaScript Virtual Machine.

[0114] Specifically, the computer device can acquire data generated in sub-applications, such as user accounts, passwords, and facial images entered by users through these applications. The computer device treats this acquired data as plaintext and encrypts it using a negotiated key and a negotiated random number to obtain encrypted data. This encrypted data is then sent to the server for storage. Because encrypted data is sent to the server, compared to sending plaintext data directly, even if data is intercepted during transmission, only the encrypted data will be obtained, thus improving data transmission security.

[0115] In one embodiment, the sub-application is a video playback sub-application, and the encrypted data is an encrypted video. Obtaining data generated in the sub-application includes: obtaining the video generated in the video playback sub-application; sending the encrypted data to the backend server of the sub-application includes: uploading the encrypted video obtained by encrypting the video generated in the video playback sub-application to the backend server of the video playback sub-application; the method further includes: in response to a playback command for the video, obtaining the encrypted video from the backend server of the video playback sub-application, decrypting the encrypted video based on a negotiated key and a negotiated random number, and playing the decrypted video.

[0116] Specifically, the sub-application can be a video playback sub-application. Videos generated within this sub-application can be videos created, recorded, or edited by the user. The computer device can retrieve the video generated in the video playback sub-application and encrypt it using a negotiated key and a negotiated random number, resulting in an encrypted video. For example, when a user records a video using the video playback sub-application and clicks the upload button, the sub-application can encrypt the video and send it to the server for storage. When the user wants to watch the video, the computer device can retrieve the encrypted video from the video playback sub-application's backend server, decrypt it using the negotiated key and a negotiated random number, and then invoke the video playback sub-application to play the decrypted video.

[0117] In one embodiment, the sub-application is specifically a mini-program.

[0118] In one embodiment, since the process of encrypting plaintext data is symmetric encryption, the process of decrypting encrypted data can be the reverse process of encryption.

[0119] In one embodiment, referring to Figure 10, which illustrates an application scenario of video encryption and decryption, after a user creates a video using a video playback sub-application, the triggering terminal can encrypt the video to obtain an encrypted video. The terminal then sends the encrypted video to the server for storage. Once the video is successfully uploaded, the video playback sub-application can display a playback indicator on the video playback page. When the user clicks the playback indicator, the video playback sub-application can retrieve the encrypted video from the server, decrypt it, and play the decrypted video. Uploading encrypted videos enhances data upload security. During video playback, retrieving the encrypted video from the server, decrypting it, and then playing it enhances data transmission security.

[0120] In one embodiment, during the interaction between the server and the terminal, the server can generate a preset key and send it to the terminal via a secure connection, allowing the terminal to store the preset key. For example, when it needs to obtain a video public key from the server, the terminal can generate an encrypted communication request and send it to the server. Upon receiving the encrypted communication request, the server can generate a key pair using a public-private key generation algorithm. This key pair includes the server's public key and a server private key that matches the server's public key. The server then sends the server's public key to a preset digital certificate authority. The digital certificate authority, also known as a CA (Certificate Authority), is a third-party trusted organization that uses PKI (Public Key Infrastructure) technology to provide network identity authentication services. The digital certificate authority has already generated an authority public key and a matching authority private key. The digital certificate authority can then encrypt the server's public key sent by the server using the authority private key to generate a digital certificate and return the digital certificate to the server.

[0121] Furthermore, the server returns the digital certificate to the terminal. The terminal pre-stores the organization's private key. When the terminal receives the digital certificate, it can decrypt it using the organization's private key. If decryption is successful, the digital certificate verification is confirmed. Since the digital certificate is generated based on the server's public key, the terminal can obtain the server's public key after decrypting the digital certificate. Next, the terminal generates a random code, encrypts this random code using the server's public key, obtains an encrypted random code, and sends the encrypted random code to the server.

[0122] Furthermore, after receiving the encrypted random code, the server can decrypt it using its private key, which matches the server's public key, to obtain the encrypted random code. The server then uses this random code to encrypt a preset key, resulting in an encrypted preset key, which is returned to the terminal. Upon receiving the encrypted preset key, the terminal can decrypt it using the encrypted random code to obtain the preset key. Here, the random code is the key used in symmetric encryption. The server's public and private keys are the keys used in asymmetric encryption.

[0123] In one embodiment, when the plaintext data is video and the video size is larger than a preset size, the video can be segmented into multiple video segments. Each video segment is then encrypted using the encryption method described above, and the encrypted video segments are sent to the server. Furthermore, while the terminal is sending the encrypted video segment, it can continue encrypting the next video segment, thus saving time on video encryption and uploading. When the server receives the encrypted video segment uploaded by the terminal, it can store the encrypted video segment, obtain its storage address, and associate the encrypted video segment address with its segment identifier. For example, a key-value pair can be generated, where the key is the segment identifier of the encrypted video segment, and the value is the storage address of the encrypted video segment. For ease of description, the key-value pair with the segment identifier of the encrypted video segment as the key and the storage address of the encrypted video segment as the first key-value pair. Further, the server can associate the segment identifier of the encrypted video segment with an encrypted video identifier. The encrypted video identifier can be generated by adding preset characters to the video identifier of the video. For example, if the video identifier of the video before encryption is A and the default character is "I_", then the identifier of the encrypted video can be I_A.

[0124] In this key-value pair, the encrypted video identifier and the video identifier form a key-value pair. For ease of description, the key-value pair formed by the encrypted video identifier and the video identifier will be referred to as the second key-value pair. The encrypted video identifier is the value in the second key-value pair, and the video identifier is the key. For example, if the video identifier of video A is A, and the encrypted video identifier generated based on the video identifier of video A is I_A, then the second key-value pair is A-I_A. Since the server associates the segment identifier of each received encrypted video segment with the encrypted video identifier, the encrypted video identifier and the segment identifier of each encrypted video segment also form a key-value pair. For ease of description, the key-value pair formed by the encrypted video identifier and the segment identifier of each encrypted video segment will be referred to as the third key-value pair. For example, when the server receives n encrypted video segments, the third key-value pair can be: I_A - {A1, A2…An}, where the encrypted video identifier I_A is the key in the third key-value pair, and the segment identifiers {A1, A2…An} of each encrypted video segment constitute the value in the third key-value pair. It's easy to understand that whenever the server receives a new encrypted video segment, it adds the segment identifier of the newly received encrypted video segment to the value in the third key-value pair, for example, adding it to {A1, A2…An} to obtain the new value {A1, A2…An, An+1} in the third key-value pair, until the segment identifier of the last encrypted video segment generated based on video A is added to the value in the third key-value pair.

[0125] Furthermore, when video playback is required, the terminal can determine the video identifier of the video to be played and send it to the server, allowing the server to locate the corresponding encrypted video based on the video identifier. For example, if the video identifier of the video to be played is A, the retrieved key-value pair could be A-I_A. The server then reads the value of this key-value pair and extracts the encrypted video identifier from it. Using the encrypted video identifier as an index, the server searches for key-value pairs with the encrypted video identifier as the key; for example, the retrieved key-value pairs could be I_A-{A1, A2…An}. The server reads the values ​​from these key-value pairs to obtain the fragment identifier set {A1, A2…An}. Furthermore, the server iterates through the fragment identifier set {A1, A2…An}. For each encountered fragment identifier, the server uses that identifier as an index to find the key-value pair with that identifier as the key, and reads the value from that key-value pair to obtain the storage address of the encrypted video segment corresponding to that fragment identifier. The server can then return the encrypted video segment stored at that address to the terminal. The terminal can then decrypt the received encrypted video segment based on the negotiated key and negotiated random number. In essence, the terminal can receive the next encrypted video segment while decrypting an existing one, thus achieving streaming decryption and improving decryption efficiency.

[0126] In one embodiment, when a user clicks "preview," the terminal can retrieve only one encrypted video segment from the server—for example, the first encrypted video segment—decrypt it, and play the decrypted segment. When the user is satisfied with the preview and wishes to watch the complete video, the terminal then retrieves all the encrypted video segments from the server and decrypts and plays each segment. Retrieving all encrypted video segments from the server only when the user is satisfied with the preview saves on computer and power resources consumed in retrieving the encrypted video segments.

[0127] In one embodiment, both the encryption and decryption processes of the video can be performed by the terminal. This reduces the server load compared to performing video encryption and decryption on the server. For example, in an online education sub-application, if tens of thousands of students are watching videos online simultaneously, server-side encryption would require the server to perform numerous encryption operations, potentially leading to performance degradation and reduced encryption efficiency. However, if the terminal performs the encryption operations, the server only needs to transmit data, thus reducing the server load. Furthermore, since terminals are generally used by a single user and do not require extensive encryption operations, performance degradation is avoided due to the need for numerous encryption operations. Therefore, performing encryption operations by the terminal can also improve encryption efficiency compared to the server performing numerous encryption operations.

[0128] In one embodiment, encrypted data can be decrypted according to the following process: a computer device obtains an initial value of a counter and decrypts the initial value of the counter according to a negotiated key to obtain a decryption initial value; in the first round of the multi-round data decryption process, the computer device determines the first round of data block to be decrypted in the plaintext data, increases the initial value of the counter to obtain the first round counter value, encrypts the first round counter value based on the negotiated key, and decrypts the first round of data block to be decrypted based on the encrypted first round counter value and the negotiated key to obtain the first round decryption initial value. Plaintext data block; In the current round of the multi-round data decryption process (excluding the first round), the computer device determines the data block to be decrypted in the plaintext data for that round, increments the counter value of the previous round to obtain the counter value for the current round, encrypts the counter value for the current round based on the negotiated key, and decrypts the data block to be decrypted in the current round based on the encrypted counter value, the negotiated key, and the plaintext data block from the previous round to obtain the plaintext data block for the current round; The computer device obtains the plaintext data based on the initial decryption value and the plaintext data block from the last round. The initial value of the counter obtained by the computer device during decryption is the same as the initial value of the counter generated based on the negotiated random number during encryption. The increment of the counter value in each round is consistent with the increment during encryption. The process of encrypting the counter value based on the negotiated key during decryption is consistent with the process of encrypting the counter value based on the negotiated key during encryption. The process of decrypting the data block to be decrypted based on the encrypted counter value, the negotiation key, and the plaintext data block is consistent with the process of encrypting the data block to be encrypted based on the encrypted counter value, the negotiation key, and the ciphertext block.

[0129] In the above embodiments, by encrypting the data obtained based on the sub-application, the integrity and security of the data from the client (sub-application) to the server can be effectively protected. Especially in scenarios where a large number of data packets are generated to meet the needs of a large number of users under high traffic, even if a man-in-the-middle attack occurs, it can be guaranteed that the attacker cannot decrypt or crack the data.

[0130] In one embodiment, referring to Figure 11, Figure 11 shows a schematic diagram of the overall architecture of a data encryption method in one embodiment. The terminal can obtain plaintext data input by the user through a sub-application, obtain a preset key, and generate an extended random number. A portion of the extended random number is used as a negotiated random number, and the other portion is merged into the preset key to obtain a negotiated key. The terminal encrypts the plaintext data based on the negotiated key and the negotiated key to obtain encrypted data, and sends the encrypted data to the server for storage. When the terminal obtains the encrypted data from the server, it can decrypt the encrypted data based on the negotiated random number and the negotiated key to obtain decrypted data.

[0131] In one specific embodiment, a data encryption method is provided, including:

[0132] The computer device acquires plaintext data and determines an encryption algorithm to encrypt the plaintext data. The encryption algorithm is an algorithm that encrypts data based on a key and a random number of a first preset length.

[0133] The computer device determines a second preset length; the second preset length is greater than the first preset length; a random number generation algorithm is determined, the second preset length is input into the random number generation algorithm, and an extended random number of the second preset length is generated using the random number generation algorithm.

[0134] The computer device extracts a data block of length 1 preset length from the extended random number as a negotiated random number, and obtains the remaining data block in the extended random number excluding the extracted data block.

[0135] The computer device obtains a preset key and generates a first initialization data block; the length of the first initialization data block is the length of the preset key; the first initialization data block is encrypted according to the preset key to obtain an encrypted data block of the first initialization data block.

[0136] The computer device determines the most significant bit of the encrypted data block of the first initialization data block.

[0137] If the value at the most significant bit is the preset first target value, the computer device performs a binary left shift of the encrypted data block of the first initialization data block by one bit to obtain the first information block.

[0138] When the value at the most significant bit is a preset second target value, the computer device performs a binary left shift of the encrypted data block of the first initialization data block by one bit to obtain a left-shifted encrypted data block; obtains a preset irreducible polynomial representation, and performs an XOR operation on the left-shifted encrypted data block and the irreducible polynomial representation to obtain the first information block.

[0139] The computer device determines a third preset length and generates a second initialization data block with the third preset length; the remaining data block is concatenated with the second initialization data block to obtain a second information block.

[0140] The computer device performs an XOR operation on the first information block and the second information block to obtain an XOR information block; it then encrypts the XOR information block based on a preset key to obtain a negotiated key.

[0141] The computer device generates an initial value for the counter based on a negotiated random number, and encrypts the initial value of the counter based on the negotiated key to obtain an encrypted initial value.

[0142] In the first round of the multi-round data encryption process, the computer device determines the first round of data block to be encrypted in the plaintext data, increases the initial value of the counter to obtain the counter value of the first round, encrypts the counter value of the first round based on the negotiated key, and encrypts the first round of data block to be encrypted based on the encrypted counter value of the first round and the negotiated key to obtain the ciphertext block of the first round.

[0143] In the current round of the multi-round data encryption process (excluding the first round), the computer device determines the data block to be encrypted in the plaintext data for that round, increments the counter value of the previous round to obtain the counter value for the current round, encrypts the counter value for the current round based on the negotiated key, and encrypts the data block to be encrypted for the current round based on the encrypted counter value of the current round, the negotiated key, and the ciphertext block of the previous round to obtain the ciphertext block for the current round; and obtains the encrypted data based on the initial encryption value and the ciphertext block of the last round.

[0144] During the exchange of information between the client and server, some sensitive information needs to be protected from being intercepted by man-in-the-middle attacks. This application embodiment employs an SM4 encryption algorithm based on extended random numbers, called XSM4-GCM. Through a series of key derivation processes, it generates negotiated random numbers and a negotiated key, and then encrypts plaintext data packets in Galois / counter mode, thereby protecting the data and associated data from tampering. The key technical point of this application embodiment is that it does not introduce additional hash functions or create new encryption primitives. Based solely on the combination of the SM4 and GCM operations themselves, it can provide random numbers up to 192 bits in length. This allows SM4 encryption in Galois / counter mode to securely use random values ​​to encrypt large amounts of data without worrying about the potential risk of random number reuse. Simultaneously, due to the use of Galois / counter (GCM) mode, this algorithm can guarantee the integrity of plaintext data, ensuring data integrity and confidentiality, as well as the integrity of associated information from tampering.

[0145] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0146] This application also provides an application scenario in which the above-described data encryption method is applied. Specifically, the data encryption method is applied in this scenario as follows:

[0147] When a user launches a mini-program through an instant messaging application, they can enter the mini-program. The user can input information, such as their registration details. The mini-program generates a negotiation key and a negotiation random number, and encrypts the user's input based on these two keys, resulting in encrypted data, which is then sent to a backend server for storage.

[0148] This application also provides another application scenario in which the above-described data encryption method is applied. Specifically, the data encryption method is applied in this scenario as follows:

[0149] Users can launch an access control mini-program through an instant messaging application, which then captures their facial images. The mini-program encrypts the facial image using a negotiated key and a negotiated random number, generating encrypted data which is then sent to the mini-program's backend server. Simultaneously, the mini-program sends a preset key and an extended random number to the server via a secure connection. The server then generates a negotiated key and a negotiated random number based on the received preset key and extended random number, and decrypts the encrypted data using these negotiated keys and random numbers to obtain the facial image, which is then stored. When a user enters the building by facial recognition, the server already stores the user's facial image, allowing for remote door opening through facial comparison.

[0150] The above application scenarios are merely illustrative. It is understood that the application of the data encryption methods provided in the embodiments of this application is not limited to the above scenarios.

[0151] Based on the same inventive concept, this application also provides a data encryption device for implementing the data encryption method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more data encryption device embodiments provided below can be found in the limitations of the data encryption method described above, and will not be repeated here.

[0152] In one embodiment, as shown in FIG12, a data encryption device 1200 is provided, including: a plaintext data acquisition module 1202, a negotiation random number generation module 1204, a negotiation key generation module 1206, and an encryption module 1208, wherein:

[0153] The plaintext data acquisition module 1202 is used to acquire plaintext data and determine a preset encryption algorithm for encrypting the plaintext data; the encryption algorithm is an algorithm that uses a negotiated key and a negotiated random number of a first preset length for encryption.

[0154] The negotiation random number generation module 1204 is used to generate an extended random number, the length of which is greater than a first preset length; to extract a data block of length of the first preset length from the extended random number as the negotiation random number, and to obtain the remaining data block in the extended random number excluding the extracted data block;

[0155] The negotiation key generation module 1206 is used to obtain a preset key, merge the remaining data blocks into the preset key, and obtain the negotiation key.

[0156] The encryption module 1208 is used to call the encryption algorithm to encrypt plaintext data using the negotiated key and negotiated random number to obtain encrypted data.

[0157] In the above embodiments, by generating extended random numbers, a random number longer than the first preset length can be obtained. Since the data length of the extended random number is longer than the first preset length, a data block of the first preset length can be extracted from the extended random number as a negotiation random number, and the remaining data block can be obtained. By obtaining a preset key, the remaining data block can be fused with the preset key, so that some idle data bits in the preset key can be used to store the data content of the remaining data block, thereby obtaining a negotiation key containing the remaining data block. By obtaining the negotiation key and the negotiation random number of the first preset length, the plaintext data can be encrypted based on the negotiation key and the negotiation random number of the first preset length using a preset encryption algorithm to obtain encrypted data.

[0158] Because the extended random number is divided into the remaining data block and the negotiated random number, and some free data bits in the preset key can be used to store the data content of the remaining data block to obtain the negotiated key, the content of the extended random number is actually distributed across the negotiated random number and the negotiated key. Therefore, in the process of data encryption using the negotiated random number and the negotiated key, the data content of the extended random number is actually used for encryption. Furthermore, since the length of the extended random number is greater than the first preset length, using an extended random number longer than the first preset length for data encryption achieves the goal of encryption based on a longer random number, thus reducing the probability of random number collisions.

[0159] Furthermore, in traditional methods, encryption algorithms use a preset key and a random number of a first preset length for encryption. Since the length of the negotiated random number is also the first preset length, consistent with the length of the random number used for encryption in the traditional method, and the length of the negotiated key is the same as the length of the preset key, consistent with the length of the key used for encryption in the traditional method, there is no need to modify the underlying implementation logic of the encryption algorithm. Simply inputting the negotiated random number and negotiated key into the encryption algorithm enables data encryption based on the algorithm. This allows data encryption without creating new encryption primitives, saving the human and computer resources required to create new encryption primitives.

[0160] In one embodiment, the negotiated random number generation module 1204 is further configured to obtain a second preset length; the second preset length is greater than the first preset length; determine a random number generation algorithm; input the second preset length into the random number generation algorithm; and use the random number generation algorithm to generate an extended random number of the second preset length.

[0161] In one embodiment, the negotiation key generation module 1206 is further configured to generate a first initialization data block; the length of the first initialization data block is the length of a preset key; the first initialization data block is encrypted according to the preset key to obtain a first information block; the length of the remaining data block is increased according to the length of the first information block to obtain a second information block; and a negotiation key is generated based on the first information block and the second information block.

[0162] In one embodiment, the negotiation key generation module 1206 is further configured to encrypt the first initialization data block according to a preset key to obtain the encrypted data block of the first initialization data block; determine the most significant bit of the encrypted data block of the first initialization data block; and, if the value of the most significant bit is a preset first target value, perform a left shift operation on the encrypted data block of the first initialization data block to obtain the first information block.

[0163] In one embodiment, the negotiation key generation module 1206 is further configured to perform a left shift operation on the encrypted data block of the first initialization data block when the value on the most significant bit is a preset second target value, to obtain a left-shifted encrypted data block; obtain a preset irreducible polynomial representation, and perform an XOR operation on the left-shifted encrypted data block and the irreducible polynomial representation to obtain a first information block.

[0164] In one embodiment, the negotiation key generation module 1206 is further configured to determine a third preset length based on the length of the first information block and the length of the remaining data block, and generate a second initialization data block with the third preset length; and concatenate the remaining data block with the second initialization data block to obtain the second information block.

[0165] In one embodiment, the negotiation key generation module 1206 is further configured to perform an XOR operation on the first information block and the second information block to obtain an XOR information block; and encrypt the XOR information block based on a preset key to obtain a negotiation key.

[0166] In one embodiment, the length of the remaining data block is less than the length of the preset key; the lengths of the first initialization data block, the first information block, and the second information block are all the same as the length of the preset key.

[0167] In one embodiment, the preset key is 128 bits long, the extended random number is 192 bits long, the negotiated random number extracted from the extended random number is 96 bits long, and the negotiated key obtained by fusing the preset key and the remaining data blocks in the extended random number excluding the extracted data blocks is 128 bits long. The encryption algorithm is a symmetric encryption algorithm using the Galois counter mode, which is used to encrypt plaintext data using the 128-bit negotiated key and the 96-bit negotiated random number.

[0168] In one embodiment, the encryption module 1208 is further configured to generate an initial value for a counter based on a negotiated random number, encrypt the initial value of the counter based on the negotiated key, and obtain an encrypted initial value; in the first round of the multi-round data encryption process, the first round of data block to be encrypted in the plaintext data is determined, the initial value of the counter is increased to obtain the counter value for the first round, the counter value for the first round is encrypted based on the negotiated key, and the data block to be encrypted in the first round is encrypted based on the encrypted counter value for the first round and the negotiated key, to obtain the first... The process involves several rounds of encryption: First, in the current round (excluding the first round) of the multi-round data encryption process, the plaintext data block to be encrypted for that round is determined. The counter value of the previous round is incremented to obtain the counter value for the current round. This counter value is then encrypted using the negotiated key. Finally, the encrypted data block for the current round is encrypted using the encrypted counter value, the negotiated key, and the ciphertext block from the previous round. Finally, the encrypted data is obtained based on the initial encryption value and the ciphertext block from the last round.

[0169] In one embodiment, the plaintext data acquisition module 1202 is further configured to acquire data generated in the sub-application and use it as plaintext data; the sub-application is an application running in the runtime environment provided by the parent application, and the parent application is a native application running on the operating system.

[0170] In one embodiment, the data encryption device 1200 further includes a data sending module for sending encrypted data to the backend server of the sub-application.

[0171] In one embodiment, the sub-application is a video playback sub-application, the plaintext data is the video generated in the video playback sub-application, the encrypted data is the encrypted video, and the data encryption device 1200 further includes a data sending module for uploading the encrypted video obtained by encrypting the video generated in the video playback sub-application to the background server of the video playback sub-application.

[0172] In one embodiment, the data encryption device 1200 further includes a decryption module, which, in response to a playback command for the video, retrieves the encrypted video from the backend server of the video playback sub-application, decrypts the encrypted video based on a negotiated key and a negotiated random number, and plays the decrypted video.

[0173] Each module in the aforementioned data encryption device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0174] In one embodiment, a computer device, which may be a server, is provided, and its internal structure is shown in Figure 13. The computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is connected to the system bus via the I / O interfaces. The processor of the computer device provides computing and control capabilities. The memory of the computer device includes non-volatile storage media and internal memory. The non-volatile storage media stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The database of the computer device is used to store encrypted data. The I / O interfaces of the computer device are used for exchanging information between the processor and external devices. The communication interface of the computer device is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements a data encryption method.

[0175] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram is shown in Figure 14. The computer device includes a processor, memory, input / output interface, communication interface, display unit, and input device. The processor, memory, and input / output interface are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interface. The processor of the computer device provides computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The input / output interface of the computer device is used for exchanging information between the processor and external devices. The communication interface of the computer device is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. When the computer program is executed by the processor, it implements a data encryption method. The display unit of the computer device is used to form a visually visible image. It can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0176] Those skilled in the art will understand that the structures shown in Figures 13 and 14 are merely block diagrams of some structures related to the present application and do not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than shown in the figures, or combine certain components, or have different component arrangements.

[0177] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0178] In one embodiment, a computer-readable storage medium is provided storing a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0179] In one embodiment, a computer program product or computer program is provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and executes the computer instructions, causing the computer device to perform the steps in the above method embodiments.

[0180] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data shall comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0181] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0182] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0183] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A data encryption method, executed by a computer device, the method comprising: Obtain plaintext data and determine an encryption algorithm for encrypting the plaintext data; the encryption algorithm is an algorithm that uses a negotiated key and a negotiated random number of a first preset length for encryption. Generate an extended random number, wherein the length of the extended random number is greater than the first preset length; Extract a data block of length 1 preset length from the extended random number as the negotiated random number, and obtain the remaining data block in the extended random number excluding the extracted data block; Obtain a preset key, merge the remaining data blocks into the preset key, and obtain a negotiation key; The encryption algorithm is invoked to encrypt the plaintext data using the negotiated key and the negotiated random number to obtain encrypted data.

2. The method according to claim 1, wherein generating extended random numbers comprises: Get the second preset length; The second preset length is greater than the first preset length; Determine a random number generation algorithm, input the second preset length into the random number generation algorithm, and use the random number generation algorithm to generate an extended random number of the second preset length.

3. The method according to claim 1, wherein fusing the remaining data block into the preset key to obtain the negotiation key includes: Generate the first initialization data block; The length of the first initialization data block is the length of the preset key; The first initialization data block is encrypted according to the preset key to obtain the first information block; Based on the length of the first information block, the length of the remaining data block is increased to obtain the second information block; A negotiation key is generated based on the first information block and the second information block.

4. The method according to claim 3, wherein encrypting the first initialization data block according to the preset key to obtain the first information block includes: The first initialization data block is encrypted according to the preset key to obtain the encrypted data block of the first initialization data block; Determine the most significant bit of the encrypted data block of the first initialization data block; If the value at the most significant bit is a preset first target value, the encrypted data block of the first initialization data block is left-shifted to obtain the first information block.

5. The method of claim 4, wherein, The method further includes: If the value at the most significant bit is a preset second target value, the encrypted data block of the first initialization data block is shifted left to obtain a left-shifted encrypted data block. Obtain a preset irreducible polynomial representation, and perform an XOR operation on the left-shifted encrypted data block and the irreducible polynomial representation to obtain a first information block.

6. The method according to claim 3, wherein increasing the length of the remaining data block according to the length of the first information block to obtain the second information block comprises: A third preset length is determined based on the length of the first information block and the length of the remaining data block, and a second initialization data block with the third preset length is generated. The remaining data block is concatenated with the second initialization data block to obtain the second information block.

7. The method of claim 3, wherein, The step of generating a negotiation key based on the first information block and the second information block includes: Perform an XOR operation between the first information block and the second information block to obtain the XOR information block; The XOR information block is encrypted based on the preset key to obtain the negotiation key.

8. The method according to claim 3, wherein the length of the remaining data block is less than the length of the preset key; The lengths of the first initialization data block, the first information block, and the second information block are all the same as the length of the preset key.

9. According to the method described in claim 1, the length of the preset key is 128 bits, the length of the extended random number is 192 bits, the length of the negotiated random number extracted from the extended random number is 96 bits, and the length of the negotiated key obtained by fusing the preset key and the remaining data blocks in the extended random number excluding the truncated data blocks is 128 bits; the encryption algorithm is a symmetric encryption algorithm using the Galois counter mode, used to encrypt plaintext data using the 128-bit negotiated key and the 96-bit negotiated random number.

10. The method according to claim 1, wherein the step of encrypting the plaintext data using the encryption algorithm based on the negotiation key and the negotiation random number to obtain encrypted data comprises: An initial value for the counter is generated based on the negotiated random number, and the initial value of the counter is encrypted based on the negotiated key to obtain an encrypted initial value. In the first round of the multi-round data encryption process, the first round of data block to be encrypted in the plaintext data is determined, the initial value of the counter is increased to obtain the counter value of the first round, the counter value of the first round is encrypted based on the negotiation key, and the data block to be encrypted in the first round is encrypted based on the encrypted counter value of the first round and the negotiation key to obtain the ciphertext block of the first round. In the current round of the multi-round data encryption process, excluding the first round, the data block to be encrypted in the plaintext data for that round is determined, and the counter value of the previous round is increased to obtain the counter value of the current round. The counter value of the current round is encrypted based on the negotiation key, and the data block to be encrypted in the current round is encrypted based on the encrypted counter value of the current round, the negotiation key, and the ciphertext block of the previous round to obtain the ciphertext block of the current round. Based on the initial encryption value and the ciphertext block of the last round, encrypted data is obtained.

11. The method according to any one of claims 1 to 10, wherein obtaining plaintext data comprises: Retrieve data generated in sub-applications and treat it as plaintext data; The sub-application is an application that runs in the runtime environment provided by the parent application, which is a native application running on the operating system.

12. The method according to claim 11, further comprising: The encrypted data is sent to the background server of the sub-application, and the sent encrypted data is used to trigger the background server to store the encrypted data.

13. The method of claim 10, wherein, The sub-application is a video playback sub-application, the plaintext data is a video generated in the video playback sub-application, and the encrypted data is an encrypted video. Sending the encrypted data to the backend server of the sub-application includes: The encrypted video, obtained by encrypting the video generated in the video playback sub-application, is uploaded to the backend server of the video playback sub-application.

14. The method according to claim 13, further comprising: In response to a playback command for a video, the encrypted video is retrieved from the backend server of the video playback sub-application, and the encrypted video is decrypted based on the negotiation key and the negotiation random number, and the decrypted video is played.

15. A data encryption device, the device comprising: A plaintext data acquisition module is used to acquire plaintext data and determine an encryption algorithm for encrypting the plaintext data; The encryption algorithm is an algorithm that uses a negotiated key and a negotiated random number of a first preset length for encryption; The negotiated random number generation module is used to generate extended random numbers, wherein the length of the extended random numbers is greater than the first preset length; Extract a data block of length 1 preset length from the extended random number as the negotiated random number, and obtain the remaining data block in the extended random number excluding the extracted data block; The negotiation key generation module is used to obtain a preset key, merge the remaining data blocks into the preset key, and obtain a negotiation key; The encryption module is used to call the encryption algorithm to encrypt the plaintext data using the negotiation key and the negotiation random number to obtain encrypted data. 16.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-13. When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 14.

17. A computer readable storage medium having stored thereon a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 14.

18. A computer program product comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 14.

Images