CN114666048A

CN114666048A - Data processing method and device, electronic equipment and storage medium

Info

Publication number: CN114666048A
Application number: CN202210289918.7A
Authority: CN
Inventors: 张钊; 张垚; 张帅; 伊帅
Original assignee: Chengdu Sensetime Technology Co Ltd
Current assignee: Chengdu Sensetime Technology Co Ltd
Priority date: 2022-03-23
Filing date: 2022-03-23
Publication date: 2022-06-24

Abstract

The present disclosure relates to a data processing method, apparatus, electronic device, and storage medium, including: the method comprises the steps of obtaining data to be processed, determining an encryption mode and an encryption key generation mode of the data to be processed, generating an encryption key based on the encryption key generation mode, and encrypting target data in the data to be processed by using the encryption key based on the encryption mode to obtain encrypted data, wherein the encrypted data comprises the encrypted target data and non-target data in the data to be processed. Different data to be processed are encrypted differently based on the encryption mode of the data to be processed and the encryption key generation mode, so that the data needing operation statistics can be partially encrypted, and necessary operation is facilitated while the data security is ensured.

Description

Data processing method and device, electronic equipment and storage medium

Technical Field

The present disclosure relates to the field of computer technologies, and in particular, to a data processing method and apparatus, an electronic device, and a storage medium.

Background

With the continuous development of internet technology and communication technology, any behavior of a user on line, such as access to a website or an application program, online transaction, social communication and the like, generates a large amount of data. With the increasing importance of various industries on data security, data encryption has been widely used as a way of ensuring data security.

However, after all the data are uniformly encrypted, when a background worker needs to access and count the data according to the operation or other working requirements, the encrypted data are difficult to count.

Disclosure of Invention

The present disclosure proposes a data processing technical solution.

The present disclosure provides a data processing method, including:

acquiring data to be processed;

determining an encryption mode and an encryption key generation mode of data to be processed;

generating an encryption key based on an encryption key generation mode;

based on the encryption mode, encrypting the target data in the data to be processed by using the encryption key to obtain encrypted data; the encrypted data comprises encrypted target data and non-target data in the data to be processed.

In the embodiment of the application, different data to be processed are encrypted differently based on the encryption mode of the data to be processed and the encryption key generation mode, so that the subsequent data to be counted in operation can be partially encrypted, and necessary operation is facilitated while the data security is ensured.

In some possible embodiments, the determining the encryption mode and the encryption key generation mode of the data to be processed, where the data to be processed carries a service identifier, includes:

acquiring a service demand strategy;

determining encryption grade information of each data in the at least two data based on the service identifier and the service requirement strategy under the condition that the data to be processed comprises at least two data;

based on the encryption level information of each kind of data, the encryption mode and encryption key generation mode of each kind of data are determined.

In the embodiment of the application, each data in the to-be-processed data corresponding to one service identifier may have different encryption level information, and the same data may have different encryption level information in different services. Therefore, the encryption grade information, the service identification and the data are bound, the encryption mode of the data to be processed can be more flexible aiming at different services, and the method lays a foundation for subsequent operation.

In some possible embodiments, when the encryption level information of the data is the first encryption level information, generating the encryption key based on the encryption key generation manner includes:

acquiring network information and account information corresponding to the data to be processed based on the first encryption grade information;

generating original key data according to a preset data generation rule and network information and account information;

and arranging and hashing the original key data to obtain an encryption key.

In the embodiment of the application, the first grading information encryption keys corresponding to different data sending ends are different, so that the encryption keys can be personalized, and the decryption difficulty of the keys is ensured while the data security is improved.

In some possible embodiments, encrypting target data in the data to be processed by using the encryption key based on the encryption mode to obtain encrypted data includes:

determining data to be processed as target data based on the first encryption grade information;

and based on an encryption function corresponding to the first encryption level information, encrypting the target data by using the encryption key, and performing irreversible data index encryption processing on the encrypted target data to obtain encrypted data.

In the embodiment of the application, all data can be encrypted for the data to be processed with high encryption degree, and the security of the data to be processed with high encryption degree is further ensured.

In some possible embodiments, when the encryption level information of the data is the second encryption level information, generating the encryption key based on the encryption key generation manner includes:

acquiring an encryption key corresponding to the encryption key generation mode from a key database based on the second encryption grade information;

wherein the encryption degree of the first encryption level information is higher than the encryption degree of the second encryption level information.

In the embodiment of the application, the encryption key with relatively low encryption degree can save the generation time of the encryption key through the unified encryption key, namely, the encryption resource is saved.

determining target data from the data to be processed based on the category of the data to be processed;

and encrypting the target data by using the encryption key based on the encryption function corresponding to the second encryption level information to obtain encrypted data.

In the embodiment of the application, the data with relatively low secrecy degree is ensured, and the part of the encrypted data is still ensured to be visible, so that the operation of later-stage operation and the like is met.

In some possible embodiments, the method further comprises:

determining a storage area of the encrypted data in the storage database based on the service identifier;

the encrypted data is stored in a storage area.

In the embodiment of the application, the user with the data access right can access the storage area corresponding to the service identifier, so that the number of access persons entering the storage area and acquiring the encrypted data is limited, and the security of the encrypted data is further ensured.

In some possible embodiments, the method further comprises:

receiving a data access instruction of an access device; the data access instruction comprises a service identifier;

responding to the data access instruction, and acquiring network equipment information of the access equipment;

determining access data corresponding to the data access instruction from the storage area based on the service identifier, and feeding the access data back to the access device;

network device information of the access device and the access time are recorded in the storage area.

In the embodiment of the application, the data receiving end can record the network equipment information and the access time of the access equipment in the storage area, so that a method for tracing the access data is provided, and the security of the data is further enhanced.

The present disclosure provides a data processing apparatus including:

the data acquisition module is used for acquiring data to be processed;

the encryption key mode determining module is used for determining an encryption mode and an encryption key generating mode of the data to be processed;

the key generation module is used for generating an encryption key based on an encryption key generation mode;

the encryption mode is used for encrypting the target data in the data to be processed by using the encryption key based on the encryption mode to obtain encrypted data; the encrypted data comprises encrypted target data and non-target data in the data to be processed.

In some possible embodiments, the data to be processed carries a service identifier, and the encryption key mode determining module is configured to:

acquiring a service demand strategy;

In some possible embodiments, when the encryption level information of the data is the first encryption level information, the key generation module is configured to:

and arranging and hashing the original key data to obtain an encryption key.

In some possible embodiments, the encryption module is to:

In some possible embodiments, when the encryption level information of the data is the second encryption level information, the key generation module is configured to:

In some possible embodiments, the encryption module is to:

In some possible embodiments, the apparatus further comprises a storage module for:

the encrypted data is stored in a storage area.

In some possible embodiments, the apparatus further comprises:

the instruction receiving module is used for receiving a data access instruction of the access device; the data access instruction comprises a service identifier;

the equipment information acquisition module is used for responding to the data access instruction and acquiring the network equipment information of the access equipment;

the data feedback module is used for determining access data corresponding to the data access instruction from the storage area based on the service identifier and feeding the access data back to the access equipment;

and the recording module is used for recording the network equipment information and the access time of the access equipment in the storage area.

The present disclosure provides an electronic device comprising at least one processor, and a memory communicatively coupled to the at least one processor; the memory stores instructions executable by the at least one processor, and the at least one processor implements any one of the data processing methods by executing the instructions stored by the memory.

The present disclosure provides a computer-readable storage medium having at least one instruction or at least one program stored therein, the at least one instruction or the at least one program being loaded and executed by a processor to implement a data processing method of any one item.

The present disclosure provides a computer program product containing instructions which, when run on a computer, cause the computer to perform a data processing method of any one of the present disclosure.

In the embodiment of the disclosure, the data to be processed is obtained, the encryption mode and the encryption key generation mode of the data to be processed are determined, the encryption key is generated based on the encryption key generation mode, the target data in the data to be processed is encrypted by using the encryption key based on the encryption mode, and the encrypted data is obtained, wherein the encrypted data comprises the encrypted target data and the non-target data in the data to be processed. Different data to be processed are encrypted differently based on the encryption mode of the data to be processed and the encryption key generation mode, so that the data needing operation statistics can be partially encrypted, and necessary operation is facilitated while the data security is ensured.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure.

Other features and aspects of the present disclosure will become apparent from the following detailed description of exemplary embodiments, which proceeds with reference to the accompanying drawings.

Drawings

In order to more clearly illustrate the embodiments of the present specification or the technical solutions and advantages of the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments of the present specification, and other drawings can be obtained by those skilled in the art without inventive efforts.

FIG. 1 shows a schematic diagram of an application environment in accordance with an embodiment of the present disclosure;

FIG. 2 shows a flow diagram of a data processing method according to an embodiment of the present disclosure;

FIG. 3 illustrates a flow chart for determining an encryption scheme and an encryption key generation scheme in accordance with an embodiment of the present disclosure;

FIG. 4 illustrates a flow chart of one manner of encryption key generation in accordance with an embodiment of the present disclosure;

FIG. 5 shows a flow diagram of one manner of encryption in accordance with an embodiment of the present disclosure;

FIG. 6 illustrates a flow diagram of data access in accordance with an embodiment of the present disclosure;

FIG. 7 shows a block diagram of a data processing apparatus according to an embodiment of the present disclosure;

FIG. 8 shows a block diagram of an electronic device in accordance with an embodiment of the disclosure;

fig. 9 shows a block diagram of another electronic device in accordance with an embodiment of the disclosure.

Detailed Description

The technical solutions in the embodiments of the present disclosure will be clearly and completely described below with reference to the drawings in the embodiments of the present disclosure, and it is obvious that the described embodiments are only a part of the embodiments of the present disclosure, and not all of the embodiments. All other embodiments, which can be obtained by a person skilled in the art without inventive step based on the embodiments in the present description, belong to the protection scope of the present invention.

It should be noted that the terms "first," "second," and the like in the description and claims of the present invention and in the drawings described above are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used is interchangeable under appropriate circumstances such that the embodiments of the invention described herein are capable of operation in sequences other than those illustrated or described herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or server that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed, but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.

Various exemplary embodiments, features and aspects of the present disclosure will be described in detail below with reference to the accompanying drawings. In the drawings, like reference numbers can indicate functionally identical or similar elements. While the various aspects of the embodiments are presented in drawings, the drawings are not necessarily drawn to scale unless specifically indicated.

The word "exemplary" is used exclusively herein to mean "serving as an example, embodiment, or illustration. Any embodiment described herein as "exemplary" is not necessarily to be construed as preferred or advantageous over other embodiments.

The term "and/or" herein is merely an association describing an associated object, meaning that three relationships may exist, e.g., a and/or B, may mean: a exists alone, A and B exist simultaneously, and B exists alone. In addition, the term "at least one" herein means any one of a plurality or any combination of at least two of a plurality, for example, including at least one of A, B, C, and may mean including any one or more elements selected from the group consisting of A, B and C.

Furthermore, in the following detailed description, numerous specific details are set forth in order to provide a better understanding of the present disclosure. It will be understood by those skilled in the art that the present disclosure may be practiced without some of these specific details. In some instances, methods, means, elements and circuits that are well known to those skilled in the art have not been described in detail so as not to obscure the present disclosure.

Referring to fig. 1, fig. 1 illustrates a picture processing system according to an embodiment of the present disclosure, as shown in fig. 1, including a data receiving end 01 and a data transmitting end 02.

Optionally, the data receiving end 01 may obtain the data to be processed, determine an encryption mode and an encryption key generation mode of the data to be processed, generate an encryption key based on the encryption key generation mode, and encrypt the target data in the data to be processed by using the encryption key based on the encryption mode to obtain encrypted data, where the encrypted data includes the encrypted target data and non-target data in the data to be processed. The data receiving end 01 may be a server or a terminal.

The server may include an independent physical server, may also be a server cluster or a distributed system formed by a plurality of physical servers, and may also be a cloud server providing basic cloud computing services such as a cloud service, a cloud database, cloud computing, a cloud function, cloud storage, a Network service, cloud communication, a middleware service, a domain name service, a security service, a CDN (Content Delivery Network), a big data and artificial intelligence platform, and the like. A terminal may include, but is not limited to, smart phones, desktop computers, tablet computers, notebook computers, smart speakers, digital assistants, Augmented Reality (AR)/Virtual Reality (VR) devices, smart wearable devices, and the like. But also a server. Alternatively, the operating system running on the electronic device or the server may include, but is not limited to, an android system, an IOS system, linux, windows, Unix, and the like.

Optionally, the data sending end 02 may send the data to be processed to the data receiving end 01. The data sender 02 may include, but is not limited to, a smart phone, a desktop computer, a tablet computer, a notebook computer, a smart speaker, a digital assistant, an Augmented Reality (AR)/Virtual Reality (VR) device, a smart wearable device, and other types of electronic devices. But also a server. Alternatively, the operating system running on the electronic device or the server may include, but is not limited to, an android system, an IOS system, linux, windows, Unix, and the like.

In an alternative embodiment, the data receiving end 01 and the data sending end 02 may be connected through a wireless link or a wired link.

The following describes a data processing method according to an embodiment of the present disclosure, taking the data receiving end 01 as an execution subject. The data processing method may be implemented by means of a processor calling computer readable instructions stored in a memory.

Fig. 2 shows a flow chart of a data processing method according to an embodiment of the present disclosure, as shown in fig. 2, the method comprising:

in step S201, data to be processed is acquired.

In the embodiment of the application, the data receiving end can obtain the data to be processed from the data sending end. The data to be processed can be generated by the operation behavior of the user on line to which the data sending end belongs. For example, a user accessing a website or an application, performing online transaction settlement, performing social communication with other users, etc., may generate a large amount of data to be processed.

Optionally, the data to be processed may also be generated by the data receiving end based on some data. For example, the data receiving end may receive first data sent by the data sending end, and then, the data receiving end may generate second data based on the first data, where the second data may be determined as data to be processed.

In step S203, the encryption method and the encryption key generation method of the data to be processed are determined.

In the embodiment of the present application, the data receiving end, as the end related to the operation behavior, generally needs to store and process some data. With the continuous improvement of the attention degree of the user to the data security, encrypting the data is an important means for ensuring the data security. However, if all data are treated as the same thing and all data are encrypted, the operator at the data receiving end may be influenced to count and access some data, and further the operator may be influenced adversely, and unnecessary encryption resources may be wasted.

Based on the above reasons, in the embodiment of the present application, the data receiving end may determine an encryption manner and an encryption key generation manner of the data to be processed, and then encrypt the data to be processed based on the encryption manner and the encryption key generation manner.

In an optional embodiment, after the data receiving end acquires the data to be processed, the data to be processed may be identified, and the identification information of the data to be processed may be determined. Wherein the identification information is used for indicating which data the data to be processed is. And then, the data receiving end acquires the identifier and the encrypted mapping table, and determines the encryption mode and the encryption key generation mode of the data to be processed from the identifier and the encrypted mapping table based on the identifier information of the data to be processed.

As shown in the table (1) for identification and encrypted mapping table, the first row includes identification information, encryption mode and encryption key generation mode of the data to be processed, respectively. As can be seen from table (1), the encryption mode of the to-be-processed data with identification information of 0001 is the first encryption mode, and the encryption key generation mode is the first key generation mode. Meanwhile, it can be seen that the encryption mode and the encryption key generation mode of the data to be processed with different identification information may be different. Even, some data to be processed corresponding to the identification information does not need to be encrypted, so that a corresponding encryption mode and an encryption key generation mode do not exist.

Table (1) identification and encrypted mapping table

Identification information	Encryption method	Encryption key generation method
			0001	First encryption mode	First key generation mode
0002	Second encryption mode	Second key generation
			0003	Is free of	Is composed of
……	……	……

Therefore, in the above embodiment, one type of data to be processed corresponds to only one type of encryption method and encryption key generation method.

In another optional embodiment, the encryption mode and the encryption key generation are determined to be related to not only the data to be processed, but also the service corresponding to the data to be processed.

Fig. 3 shows a flowchart for determining an encryption manner and an encryption key generation manner according to an embodiment of the disclosure, and as shown in fig. 3, the method includes:

in step S301, a service requirement policy is acquired.

In a possible embodiment, the data to be processed may carry a service identifier. The service identifier is used for indicating the service to which the data to be processed belongs. After receiving the data packet of the data to be processed, the data receiving end can analyze the data packet to obtain the data to be processed and the service identifier.

Optionally, the data receiving end may obtain the service requirement policy from the storage area. Optionally, the storage area of the service requirement policy may be located at the data receiving end, and optionally, the storage area may be located in other devices.

In step S302, in the case that the data to be processed includes at least two types of data, encryption level information of each of the at least two types of data is determined based on the service identifier and the service requirement policy.

In the embodiment of the application, the data receiving end can determine the encryption level information of the data to be processed based on the service identification and the service requirement strategy.

In this embodiment of the application, the service requirement policy may include a plurality of service identifiers and encryption level information corresponding to each service identifier. Or, the service requirement policy may include a plurality of service identifiers, reference information of data corresponding to each service identifier, and encryption level information corresponding to each data.

The following is illustrated by several alternative embodiments:

in an alternative embodiment, it is assumed that the data to be processed includes one type of data or at least two types of data. The data receiving end can determine whether the service requirement strategy contains the to-be-processed service identifier based on the service identifier of the to-be-processed data, and if so, determines the encryption level information corresponding to the service identifier based on the service identifier. And using the encryption grade information corresponding to the service identification as the encryption grade information of the data or at least two kinds of data. If not, the service corresponding to the service identifier of the data to be processed is a new service, and is not included in the service requirement policy, so that the data receiving end can send a reminding message for reminding the back end to process the encryption requirement of the data to be processed.

Thus, in the above embodiment, the data receiving end determines the encryption level information of the data to be processed based on the encryption level information corresponding to the service identifier.

In another alternative embodiment, it is assumed that the data to be processed includes one kind of data or at least two kinds of data. The data receiving end can determine whether the service requirement strategy contains the to-be-processed service identifier based on the service identifier of the to-be-processed data, and if so, determine whether the to-be-processed data is contained based on the reference information of the data corresponding to the service identifier in the service requirement strategy. If the data to be processed is contained, the encryption registration level information of each data in the data to be processed can be determined based on the reference information of the data corresponding to the data to be processed. If not, the service corresponding to the service identifier of the data to be processed is a new service, and is not included in the service requirement policy, so that the data receiving end can send a reminding message for reminding the back end to process the encryption requirement of the data to be processed.

In the above embodiment, it can be seen that each data in the to-be-processed data corresponding to one service identifier may have different encryption level information, and the same data may have different encryption level information in different services. Therefore, the encryption grade information, the service identifier and each piece of data in the data to be processed are bound, the encryption mode of the data to be processed can be more flexible according to different services, and the method lays a foundation for the subsequent operation of different data to be processed.

In step S303, the encryption method and encryption key generation method for each data are determined based on the encryption level information for each data.

In the embodiment of the application, the data receiving end can determine the encryption mode and the encryption key generation mode of each kind of data based on the encryption grade information of each kind of data in the data to be processed.

Optionally, the present application may include multiple pieces of encryption level information, and the number of the pieces of encryption level information may be set according to an actual situation.

In step S205, an encryption key is generated based on the encryption key generation method.

In this embodiment of the present application, the encryption key generation manner and the encryption manner corresponding to different encryption level information may be different.

The following explains ways of generating the encryption key by taking the encryption level information as the first encryption level information and the second encryption level information, respectively.

Fig. 4 is a flowchart illustrating a method for generating an encryption key according to an embodiment of the disclosure, where as shown in fig. 4, the method includes:

in step S401, network information and account information corresponding to the data to be processed are acquired based on the first encryption level information.

When the encryption level information of the data is the first encryption level information, the data receiving end may obtain network information and account information corresponding to the data to be processed, where the network information may include one or more of a device number, a network protocol address, and a port address of the data transmitting end. The account information may be one or more of a user account number, a nickname, a mobile phone number, and a mailbox number.

In step S402, according to a preset data generation rule, original key data is generated according to the network information and the account information.

Optionally, the data receiving end may sequence the network information and the account information based on a preset data generation rule to generate original key data.

Optionally, the data receiving end may extract part of the information in the network information and the account information based on a preset data generation rule to generate original key data.

Optionally, the data receiving end may extract part of the information in the network information and the account information based on a preset data generation rule, and sequence the extracted information to generate original key data.

In step S403, the original key data is arranged and hashed to obtain an encryption key.

In the embodiment of the application, after the original key data is obtained, the original key data can be sequenced and subjected to hash processing to obtain the encryption key.

Therefore, the encryption keys of the first grading information corresponding to different data sending ends are different, namely the encryption keys can be personalized, so that the data security is improved, and the decryption difficulty of the keys is also ensured.

In another optional embodiment, when the encryption level information of the data is the second encryption level information, the data receiving end may obtain the encryption key corresponding to the encryption key generation manner from the key database based on the second encryption level information. That is, the encryption keys corresponding to the second encryption level information may be unified and stored in the key database.

Or the encryption keys corresponding to the second encryption level information are unified in a certain time period, and in the next time period, the key database can update the encryption keys in the second encryption level information. And then, encrypting all the data to be processed corresponding to the second encryption level information by using the updated encryption key.

It can be seen that the encryption degree of the first encryption level information is higher than that of the second encryption level information. First, the encryption key corresponding to the first encryption level information is generated based on the network information and the account information corresponding to the data to be processed, and the encryption key corresponding to the first encryption level information may be different from person to person. And the encryption keys corresponding to the second encryption level information are unified. Therefore, the encryption degree of the first encryption level information is higher than that of the second encryption level information.

It can also be seen from the above that the encryption key with a relatively low encryption degree can save the generation time of the encryption key, i.e. save the encryption resources.

In step S207, based on the encryption mode, encrypting the target data in the data to be processed by using the encryption key to obtain encrypted data; the encrypted data comprises encrypted target data and non-target data in the data to be processed.

Next, the encryption level information is taken as the first encryption level information and the second encryption level information, respectively, to encrypt the target data in the data to be processed by using the encryption key based on the encryption mode, so as to obtain the encrypted number, and then, the encrypted number is explained.

Fig. 5 shows a flowchart of an encryption method according to an embodiment of the present disclosure, and as shown in fig. 5, the method includes:

in step S501, the data to be processed is determined as the target data based on the first encryption level information.

In this embodiment of the application, the data receiving end may determine, based on the first encryption level information, that all data in the data to be processed is target data.

In step S502, the target data is encrypted by using the encryption key based on the encryption function corresponding to the first encryption level information, and the encrypted target data is subjected to the irreversible data index encryption processing to obtain encrypted data.

In this embodiment of the application, the data receiving end may encrypt the target data by using the encryption key of the data to be processed based on the encryption function corresponding to the first encryption level information, and perform non-reversible data index encryption processing on the encrypted target data to obtain encrypted data. In this manner, the encrypted data includes null non-target data in the data to be processed.

Optionally, the Encryption function corresponding to the first Encryption level information may be an Encryption function corresponding to a symmetric Encryption algorithm, such as an Advanced Encryption Standard (AES) algorithm, a Data Encryption Standard (DES) algorithm, and a triple Data Encryption algorithm (3Data Encryption Standard, DES) algorithm.

The non-reversible data index may be a non-object encryption scheme such as an MD5 value.

In another optional embodiment, when the encryption level information of the data is the second encryption level information, the data receiving end may determine target data from the data to be processed based on the category of the data to be processed, and encrypt the target data by using the encryption key based on an encryption function corresponding to the second encryption level information to obtain encrypted data.

That is, the data receiving end may determine a part of the data to be processed as the target data based on the category of the data to be processed. For example, assuming that the type of the data to be processed is a mobile phone number, the first 7 bits of the mobile phone number may be determined as the target data.

Optionally, the Encryption function corresponding to the second Encryption level information may be an Encryption function corresponding to a symmetric Encryption algorithm, such as an Advanced Encryption Standard (AES) algorithm, a Data Encryption Standard (DES) algorithm, and a triple Data Encryption algorithm (3Data Encryption Standard, DES) algorithm.

The safety of important data is guaranteed by encrypting all data of the data to be processed corresponding to the first encryption level information, and the visibility of later parts is guaranteed by encrypting part of data of the data to be processed corresponding to the second encryption level information. Also, it can be seen that the degree of encryption of the first encryption level information is higher than that of the second encryption level information.

Certainly, the encryption level information of the data to be processed may also be third encryption level information, and when the information to be processed is the third encryption level information, the encryption key generation mode of the data to be processed is null, and the encryption of the data to be processed is null, that is, the data to be processed corresponding to the third encryption level information is not encrypted.

In summary, the embodiment of the present application may determine the encryption level information of the data to be processed of different services, and then may generate the encryption key by using the encryption key generation manner corresponding to the encryption level information, and may encrypt the data to be processed by using the encryption manner and the encryption key corresponding to the encryption level information. So that different data are encrypted to different degrees, for example, some are encrypted completely, and some are encrypted uniformly and partially. Therefore, the data with important confidentiality degree is completely invisible, and the data with relatively low confidentiality degree is partially visible, so that the operation of later-stage operation and the like is met.

In the embodiment of the application, after the data to be processed is encrypted to obtain the encrypted data, the storage area of the encrypted data in the storage database can be determined based on the service identifier of the data to be processed, and the encrypted data is stored in the storage area. Therefore, the user with the data access authority can access the storage area corresponding to the service identifier, so that the number of people accessing the storage area to acquire the encrypted data is limited, and the security of the encrypted data is further ensured.

Fig. 6 shows a flow chart of data access according to an embodiment of the present disclosure, as shown in fig. 6, the method including:

in step S601, a data access instruction of an access device is received; the data access instruction includes a service identification.

In the embodiment of the application, the data receiving end may receive a data access instruction of the access device, where the data access instruction includes a service identifier, and the service identifier included in the data access instruction may be a data access right to access a corresponding storage area.

In step S602, network device information of the access device is acquired in response to the data access instruction.

In the embodiment of the application, the data receiving end may respond to the data access instruction to obtain the network device information of the access device, where the network device information may be a network protocol address of the access device or a device number of the access device.

In step S603, based on the service identifier, access data corresponding to the data access instruction is determined from the storage area, and the access data is fed back to the access device.

In this embodiment of the application, the data receiving end may determine, based on the service identifier, access data corresponding to the data access instruction from the storage area, and feed the access data back to the access device.

In step S604, the network device information of the access device and the access time are recorded in the storage area.

Fig. 7 shows a block diagram of a data processing apparatus according to an embodiment of the present disclosure, as shown in fig. 7, the data processing apparatus including:

a data obtaining module 701, configured to obtain data to be processed;

an encryption key mode determining module 702, configured to determine an encryption mode and an encryption key generation mode of data to be processed;

a key generation module 703, configured to generate an encryption key based on an encryption key generation manner;

the encryption mode 704 is used for encrypting the target data in the data to be processed by using the encryption key based on the encryption mode to obtain encrypted data; the encrypted data comprises encrypted target data and non-target data in the data to be processed.

acquiring a service demand strategy;

and arranging and hashing the original key data to obtain an encryption key.

In some possible embodiments, the encryption module is to:

determining the data to be processed as target data based on the first encryption level information;

and encrypting the target data by using the encryption key based on the encryption function corresponding to the first encryption level information, and performing non-reversible data index encryption processing on the encrypted target data to obtain encrypted data.

In some possible embodiments, the encryption module is to:

the encrypted data is stored in a storage area.

In some possible embodiments, the apparatus further comprises:

In some embodiments, functions of or modules included in the apparatus provided in the embodiments of the present disclosure may be used to execute the method described in the above method embodiments, and specific implementation thereof may refer to the description of the above method embodiments, and for brevity, will not be described again here.

The embodiment of the present disclosure also provides a computer-readable storage medium, in which at least one instruction or at least one program is stored, and the at least one instruction or the at least one program is loaded by a processor and when executed, implements the above method. The computer readable storage medium may be a non-volatile computer readable storage medium.

An embodiment of the present disclosure further provides an electronic device, including: a processor; a memory for storing processor-executable instructions; wherein the processor is configured as the above method.

The electronic device may be provided as a terminal, server, or other form of device.

Embodiments of the present disclosure provide a computer program product containing instructions which, when run on a computer, cause the computer to perform the data processing method of the present disclosure.

FIG. 8 shows a block diagram of an electronic device in accordance with an embodiment of the disclosure. For example, the electronic device 1000 may be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, or the like terminal.

Referring to fig. 8, electronic device 1000 may include one or more of the following components: processing component 1002, memory 1004, power component 1006, multimedia component 1008, audio component 1010, input/output (I/O) interface 1012, sensor component 1014, and communications component 1016.

The processing component 1002 generally controls overall operation of the electronic device 1000, such as operations associated with display, telephone calls, data communications, camera operations, and recording operations. The processing components 1002 may include one or more processors 1020 to execute instructions to perform all or a portion of the steps of the methods described above. Further, processing component 1002 may include one or more modules that facilitate interaction between processing component 1002 and other components. For example, the processing component 1002 may include a multimedia module to facilitate interaction between the multimedia component 1008 and the processing component 1002.

The memory 1004 is configured to store various types of data to support operations at the electronic device 1000. Examples of such data include instructions for any application or method operating on the electronic device 1000, contact data, phonebook data, messages, images, videos, and so forth. The memory 1004 may be implemented by any type or combination of volatile or non-volatile memory devices such as Static Random Access Memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic or optical disks.

The power supply component 1006 provides power to the various components of the electronic device 1000. The power components 1006 may include a power management system, one or more power sources, and other components associated with generating, managing, and distributing power for the electronic device 1000.

The multimedia component 1008 includes a screen that provides an output interface between the electronic device 1000 and a user. In some embodiments, the screen may include a Liquid Crystal Display (LCD) and a Touch Panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive an input signal from a user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundary of a touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 1008 includes a front facing camera and/or a rear facing camera. The front camera and/or the rear camera may receive external multimedia data when the electronic device 1000 is in an operating mode, such as a shooting mode or a video mode. Each front camera and rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.

The audio component 1010 is configured to output and/or input audio signals. For example, the audio component 1010 may include a Microphone (MIC) configured to receive external audio signals when the electronic device 1000 is in an operational mode, such as a call mode, a recording mode, and a voice recognition mode. The received audio signal may further be stored in the memory 1004 or transmitted via the communication component 1016. In some embodiments, audio component 1010 also includes a speaker for outputting audio signals.

Input/output (I/O) interface 1012 provides an interface between processing component 1002 and peripheral interface modules, which may be keyboards, click wheels, buttons, etc. These buttons may include, but are not limited to: a home button, a volume button, a start button, and a lock button.

The sensor assembly 1014 includes one or more sensors for providing various aspects of status assessment for the electronic device 1000. For example, the sensor assembly 1014 may detect an open/closed state of the electronic device 1000, the relative positioning of components, such as a display and keypad of the electronic device 1000, the sensor assembly 1014 may also detect a change in position of the electronic device 1000 or a component of the electronic device 1000, the presence or absence of user contact with the electronic device 1000, orientation or acceleration/deceleration of the electronic device 1000, and a change in temperature of the electronic device 1000. The sensor assembly 1014 may include a proximity sensor configured to detect the presence of a nearby object without any physical contact. The sensor assembly 1014 may also include a light sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 1014 can also include an acceleration sensor, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

The communication component 1016 is configured to facilitate wired or wireless communication between the electronic device 1000 and other devices. The electronic device 1000 may access a wireless network based on a communication standard, such as WiFi, 2G or 3G, or a combination thereof. In an exemplary embodiment, the communication component 1016 receives a broadcast signal or broadcast related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communications component 1016 further includes a Near Field Communication (NFC) module to facilitate short-range communications. For example, the NFC module may be implemented based on Radio Frequency Identification (RFID) technology, infrared data association (IrDA) technology, Ultra Wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.

In an exemplary embodiment, the electronic device 1000 may be implemented by one or more Application Specific Integrated Circuits (ASICs), Digital Signal Processors (DSPs), Digital Signal Processing Devices (DSPDs), Programmable Logic Devices (PLDs), Field Programmable Gate Arrays (FPGAs), controllers, micro-controllers, microprocessors, or other electronic components for performing the above-described methods.

In an exemplary embodiment, a non-transitory computer-readable storage medium, such as the memory 1004, is also provided that includes computer program instructions executable by the processor 1020 of the electronic device 1000 to perform the above-described methods.

Fig. 9 shows a block diagram of another electronic device in accordance with an embodiment of the disclosure. For example, the electronic device 1100 may be provided as a server. Referring to fig. 9, electronic device 1100 includes a processing component 1122 that further includes one or more processors and memory resources, represented by memory 1132, for storing instructions, such as application programs, that are executable by processing component 1122. The application programs stored in memory 1132 may include one or more modules that each correspond to a set of instructions. Further, the processing component 1122 is configured to execute instructions to perform the above-described method.

The electronic device 1100 may also include a power component 1126 configured to perform power management of the electronic device 1100, a wired or wireless network interface 1150 configured to connect the electronic device 1100 to a network, and an input/output (I/O) interface 1158. The electronic device 1100 may operate based on an operating system stored in memory 1132, such as Windows Server, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM, or the like.

In an exemplary embodiment, a non-transitory computer readable storage medium, such as the memory 1132, is also provided that includes computer program instructions executable by the processing component 1122 of the electronic device 1100 to perform the methods described above.

The present disclosure may be systems, methods, and/or computer program products. The computer program product may include a computer-readable storage medium having computer-readable program instructions embodied thereon for causing a processor to implement various aspects of the present disclosure.

The computer readable storage medium may be a tangible device that can hold and store the instructions for use by the instruction execution device. The computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, semiconductor memory device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium would include the following: a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a Static Random Access Memory (SRAM), a portable compact disc read-only memory (CD-ROM), a Digital Versatile Disc (DVD), a memory stick, a floppy disk, a mechanical coding device, such as punch cards or in-groove projection structures having instructions stored thereon, and any suitable combination of the foregoing. Computer-readable storage media as used herein is not to be construed as transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., optical pulses through a fiber optic cable), or electrical signals transmitted through electrical wires.

The computer-readable program instructions described herein may be downloaded from a computer-readable storage medium to a respective computing/processing device, or to an external computer or external storage device via a network, such as the internet, a local area network, a wide area network, and/or a wireless network. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers and/or edge servers. The network adapter card or network interface in each computing/processing device receives computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in a computer-readable storage medium in the respective computing/processing device.

The computer program instructions for carrying out operations of the present disclosure may be assembler instructions, Instruction Set Architecture (ISA) instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source or object code written in any combination of one or more programming languages, including an object oriented programming language such as Smalltalk, C + + or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet service provider). In some embodiments, the electronic circuitry that can execute the computer-readable program instructions implements aspects of the present disclosure by utilizing the state information of the computer-readable program instructions to personalize the electronic circuitry, such as a programmable logic circuit, a Field Programmable Gate Array (FPGA), or a Programmable Logic Array (PLA).

Various aspects of the present disclosure are described herein with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the disclosure. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer-readable program instructions.

These computer-readable program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks. These computer-readable program instructions may also be stored in a computer-readable storage medium that can direct a computer, programmable data processing apparatus, and/or other devices to function in a particular manner, such that the computer-readable medium storing the instructions comprises an article of manufacture including instructions which implement the function/act specified in the flowchart and/or block diagram block or blocks.

The computer readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other devices to cause a series of operational steps to be performed on the computer, other programmable apparatus or other devices to produce a computer implemented process such that the instructions which execute on the computer, other programmable apparatus or other devices implement the functions/acts specified in the flowchart and/or block diagram block or blocks.

The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of instructions, which comprises one or more executable instructions for implementing the specified logical function(s). In some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems that perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

Having described embodiments of the present disclosure, the foregoing description is intended to be exemplary, not exhaustive, and not limited to the disclosed embodiments. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen in order to best explain the principles of the embodiments, the practical application, or improvements made to the technology in the marketplace, or to enable others of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A method of data processing, the method comprising:

acquiring data to be processed;

determining an encryption mode and an encryption key generation mode of the data to be processed;

generating an encryption key based on the encryption key generation mode;

2. The method of claim 1, wherein the to-be-processed data carries a service identifier, and the determining the encryption mode and the encryption key generation mode of the to-be-processed data comprises:

acquiring a service demand strategy;

under the condition that the data to be processed comprises at least two kinds of data, determining encryption grade information of each kind of data in the at least two kinds of data based on the service identification and the service requirement strategy;

and determining the encryption mode and the encryption key generation mode of each data based on the encryption level information of each data.

3. The method according to claim 2, wherein the generating an encryption key based on the encryption key generation method when the encryption level information of the data is first encryption level information includes:

generating original key data according to a preset data generation rule and the network information and the account information;

and arranging and carrying out hash processing on the original key data to obtain the encryption key.

4. The method according to claim 3, wherein the encrypting the target data in the data to be processed by using the encryption key based on the encryption manner to obtain encrypted data comprises:

determining the data to be processed as the target data based on the first encryption level information;

and encrypting the target data by using the encryption key based on an encryption function corresponding to the first encryption level information, and performing irreversible data index encryption processing on the encrypted target data to obtain the encrypted data.

5. The method according to claim 3, wherein the generating an encryption key based on the encryption key generation method when the encryption level information of the data is second encryption level information includes:

wherein an encryption degree of the first encryption level information is higher than an encryption degree of the second encryption level information.

6. The method according to claim 5, wherein the encrypting the target data in the data to be processed by using the encryption key based on the encryption manner to obtain encrypted data comprises:

determining the target data from the data to be processed based on the category of the data to be processed;

and encrypting the target data by using the encryption key based on the encryption function corresponding to the second encryption level information to obtain the encrypted data.

7. The method according to claim 4 or 6, characterized in that the method further comprises:

determining a storage area of the encrypted data in a storage database based on the service identification;

storing the encrypted data in the storage area.

8. The method of claim 7, further comprising:

based on the service identification, determining access data corresponding to the data access instruction from the storage area, and feeding the access data back to the access device;

and recording the network equipment information and the access time of the access equipment in the storage area.

9. A data processing apparatus, comprising:

the data acquisition module is used for acquiring data to be processed;

the key generation module is used for generating an encryption key based on the encryption key generation mode;

the encryption module is used for encrypting the target data in the data to be processed by using the encryption key based on the encryption mode to obtain encrypted data; the encrypted data comprises encrypted target data and non-target data in the data to be processed.

10. An electronic device comprising at least one processor, and a memory communicatively coupled to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the at least one processor implementing a data processing method as claimed in any one of claims 1 to 8 by executing the instructions stored by the memory.

11. A computer-readable storage medium, in which at least one instruction or at least one program is stored, which is loaded and executed by a processor to implement a data processing method according to any one of claims 1 to 8.