WO2017024804A1 - 一种数据加密方法、解密方法、装置和系统 - Google Patents

一种数据加密方法、解密方法、装置和系统 Download PDF

Info

Publication number
WO2017024804A1
WO2017024804A1 PCT/CN2016/078480 CN2016078480W WO2017024804A1 WO 2017024804 A1 WO2017024804 A1 WO 2017024804A1 CN 2016078480 W CN2016078480 W CN 2016078480W WO 2017024804 A1 WO2017024804 A1 WO 2017024804A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
target storage
public key
ciphertext
preset
Prior art date
Application number
PCT/CN2016/078480
Other languages
English (en)
French (fr)
Inventor
林陆一
王宇飞
Original Assignee
腾讯科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 腾讯科技（深圳）有限公司 filed Critical 腾讯科技（深圳）有限公司
Priority to EP16834430.7A priority Critical patent/EP3337088B1/en
Publication of WO2017024804A1 publication Critical patent/WO2017024804A1/zh
Priority to US15/698,432 priority patent/US10659226B2/en

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0838—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these
    • H04L9/0847—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these involving identity based encryption [IBE] schemes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0866—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/088—Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/80—Wireless

Definitions

  • the present invention relates to the field of communications technologies, and in particular, to a data encryption method, a decryption method, an apparatus, and a system.
  • the prior art also proposes an encryption scheme in which a single device feature, such as a device mobile device international identity code (IMEI, International), can be used.
  • IMEI device mobile device international identity code
  • Mobile Equipment Information such as Identity
  • the inventors of the present invention found that the above solution is only suitable for the storage of a single device, and is not suitable for the case where multiple devices share a ciphertext together, and if the devices are also together Loss, that is, the loss of ciphertext and key, will also cause information leakage, so the security of existing solutions is not high enough.
  • the embodiment of the invention provides a data encryption method, a decryption method, a device and a system, which can be applied not only to the common storage of multiple devices, but also to improve the applicability thereof, and also can improve the security thereof.
  • the embodiment of the invention provides a data encryption method, including:
  • the relevant data of the public key is locally destroyed, and the ciphertext is stored in the at least two target storage devices.
  • the embodiment of the present invention further provides a data decryption method, including:
  • the decryption request indicating a ciphertext that needs to be decrypted
  • the ciphertext is decrypted by using the public key to obtain original data.
  • the embodiment of the invention further provides a data encryption device, including:
  • a receiving unit configured to receive a data encryption request, where the data encryption request indicates original data that needs to be encrypted, and at least two target storage devices;
  • An acquiring unit configured to separately acquire device information of the at least two target storage devices
  • a generating unit configured to generate a public key according to the preset policy according to the device information
  • An encryption unit configured to encrypt the original data by using the public key to obtain a ciphertext
  • a processing unit configured to locally destroy related data of the public key, and store the ciphertext into the at least two target storage devices.
  • the embodiment of the present invention further provides a data decryption apparatus, including:
  • a receiving unit configured to receive a data decryption request, where the decryption request indicates a ciphertext that needs to be decrypted
  • a determining unit configured to determine a target storage device storing the ciphertext, where the ciphertext is stored in at least two target storage devices;
  • An acquiring unit configured to acquire device information of the target storage device
  • a generating unit configured to generate a public key according to the preset policy according to the device information
  • a decryption unit configured to decrypt the ciphertext by using the public key to obtain original data.
  • the embodiment of the present invention further provides a data storage system, including any of the data encryption devices and any data decryption device provided by the embodiments of the present invention.
  • an embodiment of the present invention provides a storage medium, where processor executable instructions are stored, and the processor executable instructions are used to perform the following operations:
  • the relevant data of the public key is locally destroyed, and the ciphertext is stored in the at least two target storage devices.
  • the embodiment of the present invention acquires device information of at least two target storage devices, and then generates a public key according to the preset policy according to the multiple device information, and uses the public key to perform the original data. Encrypting, obtaining the ciphertext, and then locally destroying the data related to the public key and storing the ciphertext in the target storage device; the solution can be applied not only to the case where multiple devices share a ciphertext, but also improve The applicability, and since the public key is generated according to device information of a plurality of target storage devices, and the device information needs to be separately obtained from multiple devices, any one of the device information cannot be decrypted, so even One of the devices is stolen, and it will not cause information leakage, which can greatly improve the security of the data.
  • 1a is a schematic diagram of a scenario of encryption in a data storage system according to an embodiment of the present invention
  • FIG. 1b is a schematic diagram of a scenario of decryption in a data storage system according to an embodiment of the present invention
  • FIG. 1c is a flowchart of a data encryption method according to an embodiment of the present invention.
  • FIG. 2 is a flowchart of a data decryption method according to an embodiment of the present invention
  • FIG. 3a is another flowchart of a data encryption method according to an embodiment of the present invention.
  • FIG. 3b is another flowchart of a data decryption method according to an embodiment of the present invention.
  • FIG. 4 is a schematic structural diagram of a data encryption apparatus according to an embodiment of the present invention.
  • FIG. 5 is a schematic structural diagram of a data decryption apparatus according to an embodiment of the present invention.
  • Embodiments of the present invention provide a data encryption method, a decryption method, an apparatus, and a system.
  • the data storage system can include a data encryption device and a data decryption device, wherein the data encryption device and the data decryption device can exist as separate entities or in the same entity, such as a terminal, server, or other network device.
  • the data storage system may also comprise at least two storage devices, such as storage device 1, storage device 2, storage device n, etc. in Figures 1a and 1b. For convenience of description, the data storage system will be briefly described from the two scenarios of encryption and decryption, respectively.
  • the figure is a schematic diagram of a scenario when the data storage system is encrypted.
  • the data encryption device may receive a data encryption request, where the data encryption request indicates the original data that needs to be encrypted. And at least two target storage devices, and then acquiring device information of the at least two target storage devices respectively, and generating a public key according to the preset information according to the device information, and then, the public key pair may be adopted.
  • the original data is encrypted to obtain a ciphertext, and the ciphertext is stored in the at least two target storage devices.
  • the related data of the public key may be locally destroyed.
  • the present embodiment will be described from the perspective of a data encryption device.
  • the data encryption device may be integrated into various devices, such as a terminal, a server, or other network devices.
  • the terminal may specifically be a mobile phone, a tablet computer, or a personal computer (PC, Personal). Computer) or a device such as a laptop.
  • a data encryption method comprising: receiving a data encryption request, the data encryption request indicating original data that needs to be encrypted, and at least two target storage devices; respectively acquiring device information of the at least two target storage devices; and according to the device information Generating a public key according to a preset policy; encrypting the original data by using the public key to obtain a ciphertext; locally destroying related data of the public key, and storing the ciphertext to the at least two target storage devices in.
  • the specific process of the data encryption method can be as follows:
  • a user-triggered data encryption request may be specifically received.
  • the data encryption request indicates the original data that needs to be encrypted, and information such as at least two target storage devices.
  • the data encryption request may carry a storage location of the original data that needs to be encrypted, such as a storage address, and the like.
  • the ciphertext needs to store the identifier of the storage device, and the like.
  • Obtain device information of the at least two target storage devices respectively for example, acquiring device information of the at least two target storage devices by using a method such as a Bluetooth, a wireless network, a mobile network, or the Internet.
  • the device information may include the serial number of the device, the IMEI code, and the integrated circuit card identifier (ICCID, Integrate) Circuit Card Identity) and/or Mobile Equipment Identifier (MEID) information.
  • ICCID integrated circuit card identifier
  • MEID Mobile Equipment Identifier
  • the device information of the target storage device may be obtained by using the device information of the target storage device, and then inputting, that is, receiving the device information of the target storage device directly input by the user, or It can be obtained directly from the target storage device, which can be as follows:
  • the first information acquisition request may be sent to the storage device A, and the device information of the storage device A returned by the storage device A may be received;
  • the device B sends a first information acquisition request, and receives the device information of the storage device A returned by the storage device B, and so on.
  • the requester's rights may be authenticated, that is, the step of “acquiring the device information of the at least two target storage devices respectively” may also be as follows:
  • the device returns when the second information acquisition request is authenticated and the authentication is determined to pass.
  • the storage device A may send a second information acquisition request carrying the authentication information, and the storage device A performs authentication according to the authentication information. And when the authentication is passed, the device information of the storage device A is returned; similarly, after the second information acquisition request carrying the authentication information is sent to the storage device B, the storage device B performs authentication according to the authentication information, and When the authentication is passed, the device information of the storage device B is returned, and so on, and so on.
  • the target storage device may also return the reason for the request failure to the data encryption device, for example, “authentication fails, the correct information needs to be provided. The prompts of the authentication information, etc., etc., are not described here.
  • the key refers to a parameter input in an algorithm that converts plaintext into ciphertext or converts ciphertext into plaintext.
  • the policy can be set according to the requirements of the actual application. For example, any of the following methods can be adopted:
  • the storage device can be used.
  • the IMEI code "000000000000001" of A, the IMEI code "000000000000002" of the storage device B, and the IMEI code "000000000000003" of the storage device C are sequentially combined according to a preset first sequence, for example, in order of arrangement, to obtain a public key, that is, " 000000000000001000000000000002000000000003".
  • the IMEI code of the device is used as an example. If the first target storage device is storage device A, the second target storage device is storage device B, and the third target storage device is storage device C, the extraction rule is extraction.
  • the IMEI code "000000000000001" of the storage device A, the IMEI code "000000000000002" of the storage device B, and the IMEI code "000000000000003" of the storage device C are respectively extracted, and the extracted information is "0001". ",” “0002” and "0003”, and then the extracted information is sequentially combined according to a preset second sequence, for example, in order of arrangement, to obtain a public key, that is, "000100020003".
  • the combination method is similar to the methods (1) and (2). Let me repeat.
  • the first sequence, the second sequence, the third sequence, and the fourth sequence, the preset first algorithm, the preset second algorithm, and the preset extraction rule may be set according to actual application requirements, and details are not described herein again.
  • the encryption process may be specifically invoked, the encryption process is performed, and the original data is encrypted by using the public key to obtain a ciphertext.
  • Destroy related data of the public key locally, and store the ciphertext in the at least two target storage devices.
  • the related data of the public key refers to related information that may leak the public key, such as the public key itself, device information used to generate the public key, and the like, and therefore, the public key is utilized.
  • the public key After the key encrypts the original data, the public key may not be saved, and the acquired device information (ie, the device information used to generate the public key) is deleted locally, so that the basic local data is leaked, and the stealer The public key is also unknown.
  • the ciphertext when storing the ciphertext to the target storage device, since there are multiple target storage devices, there may be multiple ways of storing, for example, the ciphertext may be divided into several segments and then stored in the target storage separately.
  • the complete ciphertext can be obtained only by merging the ciphertext fragments stored in the target storage devices; or, a complete ciphertext can be stored in each target storage device, that is, The step of storing the ciphertext in the at least two target storage devices may be as follows:
  • the entire ciphertext is separately sent to the at least two target storage devices for storage.
  • the solution when receiving the data encryption request, acquiring device information of at least two target storage devices, and then generating a public key according to the preset policy according to the multiple device information, and using the public key pair
  • the original data is encrypted to obtain the ciphertext, and then the relevant data of the public key is locally destroyed, and the ciphertext is stored in the target storage device; the solution can be applied not only to the multi-device sharing a ciphertext.
  • the applicability is improved, and since the public key is generated according to the device information of the plurality of target storage devices, and the device information needs to be separately obtained from the plurality of devices, the lack of any one of the device information cannot be decrypted. Therefore, even if one of the devices is stolen, it will not cause information leakage, which can greatly improve the security of the data.
  • the embodiment of the present invention further provides a data decryption method, which will be described in detail in this embodiment.
  • the data decryption device may be integrated into various devices, such as a terminal, a server, or other network device.
  • the data decryption device may be implemented as an independent entity separately from the encryption device, or may be implemented as a separate entity. Implemented as the same entity.
  • a data decryption method includes: receiving a data decryption request, the decryption request indicating a ciphertext to be decrypted; determining a target storage device storing the ciphertext, the ciphertext being stored in at least two target storage devices; The device information of the target storage device is generated according to the device information, and the public key is decrypted according to the public key to obtain the original data.
  • the specific process of the data decryption method can be as follows:
  • the data decryption request triggered by the user may be received, where the decryption request indicates information such as ciphertext that needs to be decrypted, for example, the data decryption request may carry the storage address of the ciphertext, or other may represent the ciphertext. Store location information, and more.
  • the storage address of the ciphertext can be carried in the data decryption request, so that the ciphertext target can be determined according to the storage address.
  • the storage device is the storage device A and the storage device B.
  • the identifiers of the storage device A and the storage device B are carried in the data decryption request, the density may be directly determined according to the identifiers of the storage device A and the storage device B.
  • the target storage devices of the text are storage device A and storage device B, and so on, and are not enumerated here.
  • Obtain device information of the target storage device for example, obtain device information of the target storage device by using a method such as a Bluetooth, a wireless network, a mobile network, or the Internet.
  • the device information may include information such as a serial number of the device, an IMEI code, an ICCID code, and/or a MEID code.
  • the device information of the target storage device may be obtained by using the device information of the target storage device, and then inputting, that is, receiving the device information of the target storage device directly input by the user, or It can be obtained directly from the target storage device, which can be as follows:
  • the first information acquisition request may be sent to the storage device A, and the device information of the storage device A returned by the storage device A may be received;
  • the device B sends a first information acquisition request, and receives the device information of the storage device A returned by the storage device B, and so on.
  • the requester's rights may be authenticated, that is, the step of “acquiring the device information of the at least two target storage devices respectively” may also be as follows:
  • the information acquisition request is authenticated and determined to be returned when the authentication is passed.
  • the storage device A may send a second information acquisition request carrying the authentication information, and the storage device A performs authentication according to the authentication information. And when the authentication is passed, the device information of the storage device A is returned; similarly, after the second information acquisition request carrying the authentication information is sent to the storage device B, the storage device B performs authentication according to the authentication information, and When the authentication is passed, the device information of the storage device B is returned, and so on, and so on.
  • the target storage device may also return the reason for the request failure to the data encryption device, for example, “authentication fails, the correct information needs to be provided. The prompts of the authentication information, etc., etc., are not described here.
  • the policy can be set according to the requirements of the actual application. For example, any of the following methods can be adopted:
  • the storage device can be used.
  • the IMEI code "000000000000001" of A, the IMEI code "000000000000002" of the storage device B, and the IMEI code "000000000000003" of the storage device C are sequentially combined according to a preset first sequence, for example, in order of arrangement, to obtain a public key, that is, " 000000000000001000000000000002000000000003".
  • the IMEI code of the device is used as an example. If the first target storage device is storage device A, the second target storage device is storage device B, and the third target storage device is storage device C, the extraction rule is extraction.
  • the IMEI code "000000000000001" of the storage device A, the IMEI code "000000000000002" of the storage device B, and the IMEI code "000000000000003" of the storage device C are respectively extracted, and the extracted information is "0001". ",” “0002” and "0003”, and then the extracted information is sequentially combined according to a preset second sequence, for example, in order of arrangement, to obtain a public key, that is, "000100020003".
  • the combination method is similar to the methods (1) and (2). Let me repeat.
  • the first sequence, the second sequence, the third sequence, and the fourth sequence, the preset first algorithm, the preset second algorithm, and the preset extraction rule may be set according to actual application requirements, and details are not described herein again.
  • the strategy used in the decryption may be pre-agreed by the data encryption device and the data decryption device, and respectively set in the data encryption device and the data decryption device, or may be pre-agreed by the data encryption device and the data decryption device.
  • the data decryption method may further include :
  • step 204 is specifically: generating a public key according to the public key generation policy used in the obtained encryption according to the device information. key.
  • the decryption process may be specifically invoked, the decryption process is executed, and the ciphertext is decrypted by using the public key to obtain original data.
  • the related data of the public key may be locally destroyed, where the related data of the public key refers to a public key that may be leaked.
  • Related information such as the public key itself, and device information for generating the public key, etc., that the acquired device information (ie, device information for generating the public key) can be deleted locally.
  • the original data may also be deleted, and details are not described herein again.
  • the target storage device storing the ciphertext is determined, wherein the ciphertext is stored in at least two target storage devices, and then the devices of the target storage devices are acquired.
  • the public key is generated according to the preset policy, and the ciphertext is decrypted by using the public key to obtain the original data; the solution can be applied not only to the case where multiple devices jointly hold a ciphertext.
  • the data encryption device and the data decryption device are all integrated in the same terminal, and the policy for generating the public key is “combining the device information according to the preset first sequence” as an example.
  • the terminal receives a data encryption request triggered by a user.
  • the data encryption request indicates the original data that needs to be encrypted, and information such as at least two target storage devices.
  • the data encryption request may carry a storage location of the original data that needs to be encrypted, such as a storage address, and the like.
  • the ciphertext needs to store the identifier of the storage device, and the like.
  • the storage address of the original data to be encrypted is carried in the data encryption request, and the identifier of the storage device A, the identifier of the storage device B, and the identifier of the storage device C are taken as an example for description. .
  • the terminal determines, according to the identifier of the storage device A, the identifier of the storage device B, and the identifier of the storage device C, that the target storage device is the storage device A, the storage device B, and the storage device C, and obtains the device information of the storage device A and the storage device B respectively.
  • Device information and device information of the storage device C can be obtained separately through Bluetooth, wireless network, mobile network or the Internet.
  • the device information may include information such as a serial number of the device, an IMEI code, an ICCID, and/or a MEID.
  • the device information of the target storage device may be obtained by using the device information of the target storage device, and then inputting, that is, receiving the device information of the target storage device directly input by the user, or It can be obtained directly from the target storage device, which can be as follows:
  • the first information acquisition request is sent to the storage device A, the storage device B, and the storage device C. After receiving the first information acquisition request, the storage device A, the storage device B, and the storage device C respectively return the device to the terminal. information.
  • the rights of the requester may also be authenticated, that is, the specifics may also be as follows:
  • the storage device A, the storage device B, and the storage device C respectively send the second information acquisition request, where the second information acquisition request carries the authentication information, so that the storage device A, the storage device B, and the storage device C receive the
  • the terminal can determine whether the terminal has the right to obtain the device information according to the authentication information, and if yes, return the device information to the terminal.
  • the storage device A returns the device information of the storage device A.
  • the storage device B returns the device information of the storage device B
  • the storage device C returns the device information of the storage device C, and the like.
  • the storage device may refuse to provide its own device information, and may also return the reason for the request failure to the terminal, for example, "authentication is not Pass, prompts to provide correct authentication information, etc., etc., will not be described here.
  • the terminal combines the device information according to a preset first sequence to obtain a public key.
  • the first sequence can be set according to the requirements of the actual application. For example, if the first sequence is sequentially combined according to the storage device arrangement order, the public key can be specifically referred to Table 1.
  • the IMEI code "000000000000001" of the storage device A, the IMEI code "000000000000002" of the storage device B, and the IMEI code "000000000000003" of the storage device C can be preset according to the preset first.
  • the sequences, for example, are combined in order of arrangement to obtain a public key, namely:
  • A304 The terminal needs to obtain the original data by using the storage address of the encrypted original data, and encrypt the original data by using the public key to obtain a ciphertext.
  • the encryption process may be invoked to perform an encryption process to encrypt the original data by using the public key to obtain a ciphertext.
  • the terminal destroys related data of the public key locally (that is, the terminal), and stores the ciphertext in the storage device A, the storage device B, and the storage device C.
  • the related data of the public key refers to related information that may leak the public key, such as the public key itself, device information used to generate the public key, and the like, and therefore, the public key is utilized.
  • the public key After the key encrypts the original data, the public key may not be saved, and the acquired device information (ie, the device information used to generate the public key) is deleted locally, so that the basic local data is leaked, and the stealer The public key is also unknown.
  • the ciphertext when storing the ciphertext to the target storage device, since there are multiple target storage devices, there may be multiple ways of storing, for example, the ciphertext may be divided into several segments and then stored in the target storage separately.
  • the complete ciphertext can be obtained only by merging the ciphertext fragments stored in the target storage devices; or, a complete ciphertext can be stored in each target storage device, for example, A complete ciphertext is stored in storage device A, storage device B, and storage device C, respectively.
  • the terminal receives a data decryption request triggered by a user.
  • the decryption request indicates information such as ciphertext that needs to be decrypted, for example, the data decryption request may carry the storage address of the ciphertext, or other information indicating the storage location of the ciphertext, and the like.
  • the storage address of the ciphertext carried by the data decryption request will be taken as an example for description.
  • the terminal determines the target storage device according to the storage address of the ciphertext.
  • the ciphertext is stored in the storage device A, the storage device B, and the storage device C. , storage device B and storage device C.
  • the terminal acquires the device information of the storage device A, the device information of the storage device B, and the device information of the storage device C.
  • the device information may be separately obtained through a Bluetooth, a wireless network, a mobile network, or the Internet.
  • the device information may include information such as a serial number of the device, an IMEI code, an ICCID, and/or a MEID.
  • the method for obtaining device information of the target storage device may be various. For details, refer to the foregoing embodiment.
  • the requester may have the right to obtain device information. For details, see the previous embodiment, and I will not repeat them here.
  • A304 The terminal combines the device information according to a preset first sequence to obtain a public key.
  • the first sequence can be set according to the requirements of the actual application. For example, if the first sequence is sequentially combined according to the storage device arrangement order, the public key can be specifically referred to Table 1.
  • the IMEI code "000000000000001" of the storage device A, the IMEI code "000000000000002" of the storage device B, and the IMEI code "000000000000003" of the storage device C can be preset according to the preset first.
  • the sequences, for example, are combined in order of arrangement to obtain a public key, namely:
  • the terminal obtains the ciphertext from the storage device A, the storage device B, and the storage device C, and decrypts the ciphertext by using the public key to obtain original data.
  • the decryption process may be invoked, the decryption process is executed, and the ciphertext is decrypted by using the public key to obtain the original data.
  • the related data of the public key may be destroyed locally (ie, the terminal), where the related data of the public key refers to may be Leaking related information of the public key, such as the public key itself, and device information for generating the public key, etc., that the acquired device information (ie, the device information generating the public key) may be deleted locally. ).
  • the original data may also be deleted in the terminal, and details are not described herein again.
  • the terminal used in this embodiment may acquire device information of at least two target storage devices, and then generate a public key according to the preset policy according to the multiple device information, and use the public
  • the key encrypts the original data, obtains the ciphertext, and then locally destroys the related data of the public key, and stores the ciphertext into the target storage devices.
  • the embodiment further provides a corresponding decryption method.
  • the solution provided in this embodiment can be applied not only to the case where multiple devices share a ciphertext, but also to improve the applicability thereof.
  • the public key is generated according to device information of multiple target storage devices, Device information needs to be obtained separately from multiple devices. If any one of the device information is missing, it cannot be decrypted. Therefore, even if one of the devices is stolen, information leakage will not occur, which can greatly improve data security.
  • the embodiment of the present invention further provides a data encryption apparatus.
  • the data encryption apparatus includes a receiving unit 401, an obtaining unit 402, a generating unit 403, an encrypting unit 404, and a processing unit 405. ,as follows:
  • the receiving unit 401 is configured to receive a data encryption request.
  • the receiving unit 401 may specifically receive a data encryption request triggered by a user.
  • the data encryption request indicates the original data that needs to be encrypted, and information such as at least two target storage devices.
  • the data encryption request may carry a storage location of the original data that needs to be encrypted, such as a storage address, and the like.
  • the ciphertext needs to store the identifier of the storage device, and the like.
  • the obtaining unit 402 is configured to separately acquire device information of the at least two target storage devices.
  • these device information can be obtained separately through Bluetooth, wireless network, mobile network or the Internet.
  • the device information may include information such as a serial number of the device, an IMEI code, an ICCID code, and/or a MEID code.
  • the method for obtaining the device information of the target storage device may be various.
  • the device information of the target storage device may be viewed by the user, and then input, that is, the device information of the target storage device directly input by the user is received, or Can be obtained directly from the target storage device, ie:
  • the obtaining unit 402 is specifically configured to send a first information obtaining request to the at least two target storage devices, and respectively receive the device information returned by the at least two target storage devices according to the first information acquiring request.
  • the requester's rights can also be authenticated, namely:
  • the obtaining unit 402 is specifically configured to send a second information obtaining request to the at least two target storage devices, where the second information acquiring request carries the authentication information, and respectively receives the device information returned by the at least two target storage devices.
  • the device information is returned by the target storage device when the second information acquisition request is authenticated and the authentication is determined to pass.
  • the generating unit 403 is configured to generate a public key according to the preset policy according to the device information.
  • the policy can be set according to the requirements of the actual application. For example, any of the following methods can be adopted:
  • the generating unit 403 is specifically configured to combine the device information according to a preset first sequence to obtain a public key.
  • the generating unit 403 may be specifically configured to extract the device information according to the preset extraction rule, obtain the extracted information, and combine the extracted information according to the preset second sequence to obtain a public key.
  • the generating unit 403 may be configured to calculate the device information according to the preset first algorithm, obtain the calculation information, and combine the calculation information according to the preset third sequence to obtain a public key.
  • the generating unit 403 may be configured to combine the device information according to a preset fourth sequence to obtain combined information, and calculate the combined information according to a preset second algorithm to obtain a public key.
  • the first sequence, the second sequence, the third sequence, and the fourth sequence, the preset first algorithm, the preset second algorithm, and the preset extraction rule may be set according to actual application requirements, and details are not described herein again.
  • the encryption unit 404 is configured to encrypt the original data by using the public key to obtain a ciphertext.
  • the encryption unit 404 may specifically acquire the original data according to the data encryption request, and encrypt the original data by using the public key to obtain a ciphertext.
  • the encryption process may be invoked, the encryption process may be performed, and then the public key is adopted.
  • the key encrypts the original data to obtain a ciphertext.
  • processing unit 405
  • the processing unit 405 is configured to locally destroy related data of the public key, and store the ciphertext into the at least two target storage devices.
  • the related data of the public key refers to related information that may leak the public key, such as the public key itself, device information used to generate the public key, and the like, and therefore, the public key is utilized.
  • the public key After the key encrypts the original data, the public key may not be saved, and the acquired device information (ie, the device information used to generate the public key) is deleted locally, so that the basic local data is leaked, and the stealer The public key is also unknown.
  • the ciphertext when storing the ciphertext to the target storage device, since there are multiple target storage devices, there may be multiple ways of storing, for example, the ciphertext may be divided into several segments and then stored in the target storage separately.
  • the complete ciphertext can be obtained only by merging the ciphertext fragments stored in the target storage devices; or, a complete ciphertext can be stored in each target storage device, that is, :
  • the processing unit 405 may be configured to: divide the ciphertext into a corresponding number of ciphertext segments according to the number of the target storage devices, and store the ciphertext segments into the target storage device; or
  • the processing unit 405 is specifically configured to separately send the entire ciphertext to the at least two target storage devices for storage.
  • the foregoing units may be implemented as a separate entity, or may be implemented in any combination, and may be implemented as the same or a plurality of entities.
  • the foregoing method embodiments and details are not described herein.
  • the acquiring unit 402 acquires the device information of the at least two target storage devices, and then the generating unit 403 generates the public key according to the preset policy according to the multiple device information. Key, and the original data is encrypted by the encryption unit 404 using the public key to obtain the ciphertext, and then the processing unit 405 locally destroys the relevant data of the public key, and stores the ciphertext into the target storage devices;
  • the solution can be applied not only to the case where multiple devices share a ciphertext, but also to improve the applicability thereof.
  • the public key is generated according to device information of multiple target storage devices, the device information needs to be separately If the device is not available, it will not be decrypted. Therefore, even if one of the devices is stolen, it will not cause information leakage, which can greatly improve the security of the data.
  • the embodiment of the present invention further provides a data decryption apparatus.
  • the data decryption apparatus includes a receiving unit 501, a determining unit 502, an obtaining unit 503, a generating unit 504, and a decrypting unit 505, as follows:
  • the receiving unit 501 is configured to receive a data decryption request, where the decryption request indicates a ciphertext that needs to be decrypted.
  • the receiving unit 501 can specifically receive a data decryption request triggered by the user.
  • the decryption request indicates information such as ciphertext that needs to be decrypted, for example, the data decryption request may carry the storage address of the ciphertext, or other information indicating the storage location of the ciphertext, and the like.
  • the determining unit 502 is configured to determine a target storage device that stores the ciphertext, where the ciphertext is stored in at least two target storage devices.
  • the storage address of the ciphertext can be carried in the data decryption request, so that the ciphertext target can be determined according to the storage address.
  • the storage device is the storage device A and the storage device B.
  • the identifiers of the storage device A and the storage device B are carried in the data decryption request, the density may be directly determined according to the identifiers of the storage device A and the storage device B.
  • the target storage devices of the text are storage device A and storage device B, and so on, and are not enumerated here.
  • the obtaining unit 503 is configured to acquire device information of the target storage device.
  • these device information can be obtained separately through Bluetooth, wireless network, mobile network or the Internet.
  • the device information may include information such as a serial number of the device, an IMEI code, an ICCID code, and/or a MEID code.
  • the method for obtaining the device information of the target storage device may be various.
  • the device information of the target storage device may be viewed by the user, and then input, that is, the device information of the target storage device directly input by the user is received, or Can be obtained directly from the target storage device, ie:
  • the obtaining unit 503 is specifically configured to send a first information obtaining request to the target storage device, and respectively receive device information returned by the target storage device according to the first information acquiring request.
  • the requester's rights can also be authenticated, namely:
  • the acquiring unit 503 is specifically configured to send a second information obtaining request to the target storage device, where the second information acquiring request carries the authentication information, and respectively receives the device information returned by the target storage device, where the device information is obtained by the target device.
  • the storage device returns when the second information acquisition request is authenticated and the authentication is determined to pass.
  • the generating unit 504 is configured to generate a public key according to the preset policy according to the device information.
  • the policy can be set according to the requirements of the actual application. For example, any of the following methods can be adopted:
  • the generating unit 504 is specifically configured to combine the device information according to a preset first sequence to obtain a public key.
  • the generating unit 504 may be configured to separately extract the device information according to the preset extraction rule, obtain the extracted information, and combine the extracted information according to the preset second sequence to obtain a public key.
  • the generating unit 504 may be configured to separately calculate the device information according to the preset first algorithm, obtain the calculation information, and combine the calculation information according to the preset third sequence to obtain a public key.
  • the generating unit 504 may be configured to combine the device information according to a preset fourth sequence to obtain combined information, and calculate the combined information according to a preset second algorithm to obtain a public key.
  • the first sequence, the second sequence, the third sequence, and the fourth sequence, the preset first algorithm, the preset second algorithm, and the preset extraction rule may be set according to actual application requirements, and details are not described herein again.
  • the decryption unit 505 is configured to decrypt the ciphertext by using the public key to obtain original data.
  • the decryption unit 505 may be specifically configured to obtain a ciphertext from the target storage device according to the data decryption request, and then decrypt the ciphertext by using the public key to obtain original data; for example, calling a decryption process to execute the decryption process, The ciphertext is decrypted by using the public key to obtain original data.
  • the related data of the public key may be locally destroyed, where the related data of the public key refers to a public key that may be leaked.
  • Related information such as the public key itself, and device information for generating the public key, etc., that is, the data decryption device may further include a destruction unit, as follows:
  • the destruction unit is configured to locally destroy related data of the public key, such as locally deleting the acquired device information (that is, device information for generating the public key).
  • the data encryption device may be specifically integrated in various devices, such as terminals, servers, or other network devices.
  • the foregoing units may be implemented as a separate entity, or may be implemented in any combination, and may be implemented as the same or a plurality of entities.
  • the foregoing method embodiments and details are not described herein.
  • the data decryption apparatus of the embodiment may be configured to determine, by the determining unit 502, the target storage device storing the ciphertext when the data decryption request is received, wherein the ciphertext is stored in the at least two target storage devices. Then, the device information of the target storage devices is acquired by the obtaining unit 503, and the generating unit 504 generates a public key according to the preset policy according to the plurality of device information, and then, the decrypting unit 505 uses the public key to perform the ciphertext.
  • the scheme can be applied not only to the case where multiple devices share a ciphertext, but also to improve the applicability thereof, and since the public key is generated based on device information of a plurality of target storage devices, Device information needs to be obtained separately from multiple devices. If any one of the device information is missing, it cannot be decrypted. Therefore, even if one of the devices is stolen, information leakage will not occur, which can greatly improve data security.
  • the embodiment of the present invention further provides a data storage system, including any data encryption device and any data decryption device provided by the embodiment of the present invention, wherein the data encryption device can refer to the fourth embodiment, and the data decryption device can See example five.
  • the data encryption device and the data decryption device can also be integrated in the same entity, such as a terminal, server or other network device.
  • the data encryption device and the data decryption device are all integrated in the same network device as an example, and the specifics may be as follows:
  • a network device configured to receive a data encryption request, the data encryption request indicating the original data to be encrypted, and at least two target storage devices; respectively acquiring device information of the at least two target storage devices; according to the device information, according to the pre-pre
  • the policy generates a public key; the original data is encrypted by the public key to obtain a ciphertext; the related data of the public key is locally destroyed, and the ciphertext is stored in the at least two target storage devices.
  • the network device may be further configured to receive a data decryption request, where the decryption request indicates a ciphertext that needs to be decrypted, and determine a target storage device that stores the ciphertext, where the ciphertext is stored in at least two target storage devices;
  • the device information of the target storage device is generated according to the device information, and the public key is decrypted according to the public key to obtain the original data.
  • the data storage system may further include at least two storage devices, wherein each of the storage devices can perform the above functions:
  • the storage device is configured to provide device information to the network device, and receive the ciphertext sent by the network device, and store the ciphertext.
  • the storage device can also be used to send the ciphertext to the network device.
  • the data encryption system can include any data encryption device and any data decryption device provided by the embodiments of the present invention. Therefore, any data encryption device and any data decryption device provided by the embodiments of the present invention can be implemented. For the beneficial effects that can be achieved, refer to the previous embodiments, and details are not described herein again.
  • the program may be stored in a computer readable storage medium, and the storage medium may include: Read only memory (ROM, Read Only Memory), Random Access Memory (RAM), disk or CD.
  • ROM Read only memory
  • RAM Random Access Memory

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computing Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Storage Device Security (AREA)

Abstract

一种数据加密方法，包括：接收数据加密请求，该数据加密请求指示需要进行加密的原始数据，以及至少两个目标存储设备；分别获取目标存储设备的设备信息；根据设备信息生成公共密钥；采用公共密钥对原始数据进行加密，得到密文；在本地销毁公共密钥的相关数据，并将密文存储至目标存储设备中；此外，还提供相应的装置和系统。

Description

一种数据加密方法、解密方法、装置和系统
本申请要求于2015年8月12日提交中国专利局、申请号为2015104940434、发明名称为“一种数据加密方法、解密方法、装置和系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及通信技术领域，具体涉及一种数据加密方法、解密方法、装置和系统。
 背景技术
随着通信技术的发展，数据安全也越发得到人们的关注。在传统技术中，一般会通过给数据加密来保障数据的安全。其中，为了解密时验证所需，一般在将加密数据（即密文）保存至存储设备的同时，也会将密钥以一定的形式进行保存，因此，若密文和密钥均被盗取，则极易导致数据泄露。为此，现有技术又提出了一种加密方案，在该方案中，可以以单一设备特征，例如设备移动设备国际身份码（IMEI，International Mobile Equipment Identity）等信息作为加密手段，来加密本设备的数据，从而防止本设备的内容在被拷走的情况下造成信息泄漏，因为，设备特征信息并不作保存，因此，即使密文丢失也不会造成信息泄漏。
 技术问题
在对现有技术的研究和实践过程中，本发明的发明人发现，上述方案只适合单一设备的存储，对于多设备共同持有一份密文的情况并不适合，而且，若设备也一起丢失，即密文和密钥一起丢失，将同样会造成信息泄漏，因此，现有方案的安全性也不够高。
 技术解决方案
本发明实施例提供一种数据加密方法、解密方法、装置和系统，不仅可以适用于多设备共同存储，提高其适用性，而且，也可以提高其安全性。
本发明实施例提供一种数据加密方法，包括：
接收数据加密请求，所述数据加密请求指示需要进行加密的原始数据，以及至少两个目标存储设备；
分别获取所述至少两个目标存储设备的设备信息；
根据所述设备信息，按照预置策略生成公共密钥；
采用所述公共密钥对所述原始数据进行加密，得到密文；
在本地销毁公共密钥的相关数据，并将所述密文存储至所述至少两个目标存储设备中。
相应的，本发明实施例还提供一种数据解密方法，包括：
接收数据解密请求，所述解密请求指示需要进行解密的密文；
确定存储有所述密文的目标存储设备，所述密文存储于至少两个目标存储设备中；
获取所述目标存储设备的设备信息；
根据所述设备信息，按照预置策略生成公共密钥；
采用所述公共密钥对所述密文进行解密，得到原始数据。
相应的，本发明实施例还提供一种数据加密装置，包括：
接收单元，用于接收数据加密请求，所述数据加密请求指示需要进行加密的原始数据，以及至少两个目标存储设备；
获取单元，用于分别获取所述至少两个目标存储设备的设备信息；
生成单元，用于根据所述设备信息，按照预置策略生成公共密钥；
加密单元，用于采用所述公共密钥对所述原始数据进行加密，得到密文；
处理单元，用于在本地销毁公共密钥的相关数据，并将所述密文存储至所述至少两个目标存储设备中。
相应的，本发明实施例还提供一种数据解密装置，包括：
接收单元，用于接收数据解密请求，所述解密请求指示需要进行解密的密文；
确定单元，用于确定存储有所述密文的目标存储设备，所述密文存储于至少两个目标存储设备中；
获取单元，用于获取所述目标存储设备的设备信息；
生成单元，用于根据所述设备信息，按照预置策略生成公共密钥；
解密单元，用于采用所述公共密钥对所述密文进行解密，得到原始数据。
此外，本发明实施例还提供一种数据存储系统，包括本发明实施例提供的任一种数据加密装置和任一种数据解密装置。
另外，本发明实施例提供一种存储介质，其内存储有处理器可执行指令，所述处理器可执行指令用于执行如下操作：
接收数据加密请求，所述数据加密请求指示需要进行加密的原始数据，以及至少两个目标存储设备；
分别获取所述至少两个目标存储设备的设备信息；
根据所述设备信息，按照预置策略生成公共密钥；
采用所述公共密钥对所述原始数据进行加密，得到密文；
在本地销毁公共密钥的相关数据，并将所述密文存储至所述至少两个目标存储设备中。
 有益效果
本发明实施例采用在接收到数据加密请求时，获取至少两个目标存储设备的设备信息，然后根据这多个设备信息，按照预置策略生成公共密钥，并利用公共密钥对原始数据进行加密，得到密文，再然后，在本地销毁公共密钥的相关数据，并将密文存储至这些目标存储设备中；该方案不仅可以适用于多设备共同持有一份密文的情况，提高其适用性，而且，由于公共密钥是根据多个目标存储设备的设备信息来生成的，而设备信息需要分别向多个设备来获取，缺少其中任意一个设备信息都无法进行解密，因此，即便其中一个设备被盗取，也不会造成信息泄露，可以大大提高数据的安全性。
 附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1a是本发明实施例提供的数据存储系统中加密的场景示意图；
图1b是本发明实施例提供的数据存储系统中解密的场景示意图；
图1c是本发明实施例提供的数据加密方法的流程图；
图2是本发明实施例提供的数据解密方法的流程图；
图3a是本发明实施例提供的数据加密方法的另一流程图；
图3b是本发明实施例提供的数据解密方法的另一流程图；
图4是本发明实施例提供的数据加密装置的结构示意图；
图5是本发明实施例提供的数据解密装置的结构示意图。
 本发明的最佳实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
本发明实施例提供一种数据加密方法、解密方法、装置和系统。
该数据存储系统可以包括数据加密装置和数据解密装置，其中，该数据加密装置和数据解密装置可以以独立的实体存在，也可以集成在同一实体中，如终端、服务器或其他网络设备中。此外，该数据存储系统还可以包括至少两个存储设备，比如参见图1a和图1b中的存储设备1、存储设备2……存储设备n等。为了描述方便，将分别从加密和解密两种场景对该数据存储系统进行简略说明。
参见图1a，该图为该数据存储系统加密时的场景示意图，在需要对某个原始数据进行加密时，数据加密装置可以接收数据加密请求，其中，该数据加密请求指示需要进行加密的原始数据，以及至少两个目标存储设备，然后，分别获取该至少两个目标存储设备的设备信息，并根据该设备信息，按照预置策略生成公共密钥，再然后，便可以采用该公共密钥对该原始数据进行加密，得到密文，并将该密文存储至该至少两个目标存储设备中，其中，为了避免公共密钥被盗取，可以在本地销毁公共密钥的相关数据。
而在解密时，比如，在接收到数据解密请求（其中，该解密请求指示需要进行解密的密文）后，确定存储有该密文的目标存储设备（该密文存储于至少两个目标存储设备中），然后，获取该目标存储设备的设备信息，并根据该设备信息，按照预置策略生成公共密钥，此后，便可以采用该公共密钥对该密文进行解密，得到原始数据，参见图1b；需说明的是，在生成公共密钥时，解密时所采用的策略应该与加密时所选用的策略保持一致。
以下将分别进行详细说明。
实施例一、
本实施例将从数据加密装置的角度进行描述，该数据加密装置具体可以集成在各式设备，如终端、服务器或其他网络设备等中，终端具体可以手机、平板电脑、个人计算机（PC，Personal Computer）或笔记本电脑等设备。
一种数据加密方法，包括：接收数据加密请求，该数据加密请求指示需要进行加密的原始数据，以及至少两个目标存储设备；分别获取该至少两个目标存储设备的设备信息；根据该设备信息，按照预置策略生成公共密钥；采用该公共密钥对该原始数据进行加密，得到密文；在本地销毁公共密钥的相关数据，并将该密文存储至该至少两个目标存储设备中。
如图1c所示，该数据加密方法的具体流程可以如下：
101、接收数据加密请求。
例如，具体可以接收用户触发的数据加密请求。其中，该数据加密请求指示需要进行加密的原始数据，以及至少两个目标存储设备等信息，比如，该数据加密请求可以携带该需要进行加密的原始数据的存储位置，比如存储地址等，以及在该原始数据加密后，密文需要存放的存储设备的标识等。
102、分别获取该至少两个目标存储设备的设备信息，比如，可以通过蓝牙、无线网络、移动网或互联网等途径分别获取该至少两个目标存储设备的设备信息。
其中，设备信息可以包括设备的序列号、IMEI码、集成电路卡标识 （ICCID，Integrate Circuit Card Identity）和/或移动设备识别码（MEID，Mobile Equipment Identifier）等信息。
其中，获取目标存储设备的设备信息的方式可以有多种，比如，可以由用户通过查看目标存储设备的设备信息，然后进行输入，即接收用户直接输入的目标存储设备的设备信息，或者，也可以直接向目标存储设备获取，即具体可以如下：
分别向该至少两个目标存储设备发送第一信息获取请求，分别接收该至少两个目标存储设备根据该第一信息获取请求返回的设备信息。
比如，以目标存储设备具体为存储设备A和存储设备B为例，则，可以向存储设备A发送第一信息获取请求，并接收存储设备A返回的存储设备A的设备信息；以及，向存储设备B发送第一信息获取请求，并接收存储设备B返回的存储设备A的设备信息，以此类推，等等。
可选的，为了提高安全性，还可以对请求者的权限进行鉴权，即步骤“分别获取该至少两个目标存储设备的设备信息”具体也可以如下：
分别向该至少两个目标存储设备发送第二信息获取请求，其中，该第二信息获取请求中携带鉴权信息，分别接收该至少两个目标存储设备返回的设备信息，该设备信息由目标存储设备在对该第二信息获取请求进行鉴权并确定鉴权通过时返回。
比如，还是以目标存储设备具体为存储设备A和存储设备B为例，则，可以向存储设备A发送携带鉴权信息的第二信息获取请求，由存储设备A根据鉴权信息进行鉴权，并在鉴权通过时，返回存储设备A的设备信息；同理，在向存储设备B发送携带鉴权信息的第二信息获取请求后，由存储设备B根据鉴权信息进行鉴权，并在鉴权通过时，返回存储设备B的设备信息，以此类推，等等。需说明的是，如果鉴权不通过，则拒绝提供目标存储设备的设备信息，此时目标存储设备还可以向该数据加密装置返回请求失败的原因，比如“鉴权不通过，需提供正确的鉴权信息”等的提示，等等，在此不再赘述。
103、根据该设备信息，按照预置策略生成公共密钥。
其中，密钥指的是明文转换为密文或将密文转换为明文的算法中输入的参数。
其中，该策略可以根据实际应用的需求进行设置，比如，可以采用如下任意一种方式：
（1）将该设备信息按照预设第一序列进行组合，得到公共密钥。
比如，以设备信息为设备的IMEI码为例，若第一个目标存储设备为存储设备A，第二目标存储设备为存储设备B，第三目标存储设备为存储设备C，则可以将存储设备A的IMEI码“000000000000001”、存储设备B的IMEI码“000000000000002”和存储设备C的IMEI码“000000000000003”按照预设第一序列，比如按排列先后次序依次进行组合，得到公共密钥，即“000000000000001000000000000002000000000000003”。
（2）按照预设提取规则分别对该设备信息进行提取，得到提取信息，将该提取信息按照预设第二序列进行组合，得到公共密钥。
比如，还是以设备信息为设备的IMEI码为例，若第一个目标存储设备为存储设备A，第二目标存储设备为存储设备B，第三目标存储设备为存储设备C，提取规则为提取IMEI码的后四位数，则可以分别对存储设备A的IMEI码“000000000000001”、存储设备B的IMEI码“000000000000002”和存储设备C的IMEI码“000000000000003”进行提取，得到提取信息为“0001”、“0002”和“0003”，然后将这些提取信息按照预设第二序列，比如按排列先后次序依次进行组合，得到公共密钥，即“000100020003”。
（3）按照预设第一算法分别对该设备信息进行计算，得到计算信息，将该计算信息按照预设第三序列进行组合，得到公共密钥。
比如，可以对设备信息进行一个加权运算或进行某种函数换算，得到计算信息，然后才对计算信息进行组合，得到公共密钥，组合方式与方式（1）和（2）类似，在此不再赘述。
（4）将该设备信息按照预设第四序列进行组合，得到组合信息，按照预设第二算法对该组合信息进行计算，得到公共密钥。
除了可以先对设备信息进行运算再进行组合之外，也可以先进行组合，再进行运算，方式（4）的执行与方式（3）类似，在此不再赘述。
其中，第一序列、第二序列、第三序列和第四序列、预设第一算法、预设第二算法和预设提取规则等可以根据实际应用的需求进行设置，在此不再赘述。
104、采用该公共密钥对该原始数据进行加密，得到密文。
例如，具体可以调用加密进程，执行加密进程，并采用该公共密钥对该原始数据进行加密，得到密文。
105、在本地销毁公共密钥的相关数据，并将该密文存储至该至少两个目标存储设备中。
其中，公共密钥的相关数据指的是可能会泄露公共密钥的相关信息，比如，公共密钥本身，以及用于生成该公共密钥的设备信息，等等，因此，在利用该公共密钥对原始数据进行加密之后，可以不保存该公共密钥，并在本地删除获取到的设备信息（即用于生成该公共密钥的设备信息），这样，基本本地的数据泄露，盗取者也无法得知该公共密钥。
此外，在将该密文存储至目标存储设备时，由于存在多个目标存储设备，因此，存储的方式也可以有多种，比如，可以将密文划分为若干片段，然后分别存进目标存储设备中，即，只有将这些目标存储设备中所存储的密文片段凑齐，才可以得到完整的密文；或者，也可以在每一个目标存储设备中都存储一份完整的密文，即，步骤“将该密文存储至该至少两个目标存储设备中”具体可以如下：
按照目标存储设备的数量将密文划分为对应数量的密文片段，将密文片段分别存储至该目标存储设备中；或者，
将整份密文分别发送至该至少两个目标存储设备中，以进行存储。
由上可知，本实施例采用在接收到数据加密请求时，获取至少两个目标存储设备的设备信息，然后根据这多个设备信息，按照预置策略生成公共密钥，并利用公共密钥对原始数据进行加密，得到密文，再然后，在本地销毁公共密钥的相关数据，并将密文存储至这些目标存储设备中；该方案不仅可以适用于多设备共同持有一份密文的情况，提高其适用性，而且，由于公共密钥是根据多个目标存储设备的设备信息来生成的，而设备信息需要分别向多个设备来获取，缺少其中任意一个设备信息都无法进行解密，因此，即便其中一个设备被盗取，也不会造成信息泄露，可以大大提高数据的安全性。
实施例二、
与数据加密方法对应的，本发明实施例还相应地提供一种数据解密方法，在本实施例中，将进行详细说明。
将从数据解密装置的角度进行描述，该数据解密装置具体可以集成在各式设备，如终端、服务器或其他网络设备等中，该数据解密装置可以与加密装置分别作为独立实体来实现，也可以作为同一实体来实现。
一种数据解密方法，包括：接收数据解密请求，该解密请求指示需要进行解密的密文；确定存储有该密文的目标存储设备，该密文存储于至少两个目标存储设备中；获取该目标存储设备的设备信息；根据该设备信息，按照预置策略生成公共密钥；采用该公共密钥对该密文进行解密，得到原始数据。
如图2所示，该数据解密方法的具体流程可以如下：
201、接收数据解密请求。
例如，具体可以接收用户触发的数据解密请求，其中，该解密请求指示需要进行解密的密文等信息，比如，该数据解密请求中可以携带该密文的存储地址，或者其他可以表示该密文存储位置的信息，等等。
202、确定存储有该密文的目标存储设备，该密文存储于至少两个目标存储设备中。
例如，如果加密时将密文存放在存储设备A和存储设备B中，则可以在数据解密请求中携带该密文的存储地址，这样，此时便可以根据该存储地址确定该密文的目标存储设备为存储设备A和存储设备B；或者，如果在数据解密请求中携带的是存储设备A和存储设备B的标识，则此时可以直接根据存储设备A和存储设备B的标识确定该密文的目标存储设备为存储设备A和存储设备B，以此类推，在此不再列举。
203、获取该目标存储设备的设备信息，比如，通过蓝牙、无线网络、移动网或互联网等途径分别获取该目标存储设备的设备信息。
其中，设备信息可以包括设备的序列号、IMEI码、ICCID码和/或MEID码等信息。
其中，获取目标存储设备的设备信息的方式可以有多种，比如，可以由用户通过查看目标存储设备的设备信息，然后进行输入，即接收用户直接输入的目标存储设备的设备信息，或者，也可以直接向目标存储设备获取，即具体可以如下：
分别向该目标存储设备发送第一信息获取请求，分别接收该目标存储设备根据该第一信息获取请求返回的设备信息。
比如，以目标存储设备具体为存储设备A和存储设备B为例，则，可以向存储设备A发送第一信息获取请求，并接收存储设备A返回的存储设备A的设备信息；以及，向存储设备B发送第一信息获取请求，并接收存储设备B返回的存储设备A的设备信息，以此类推，等等。
可选的，为了提高安全性，还可以对请求者的权限进行鉴权，即步骤“分别获取该至少两个目标存储设备的设备信息”具体也可以如下：
分别向该目标存储设备发送第二信息获取请求，其中，该第二信息获取请求中携带鉴权信息，分别接收该目标存储设备返回的设备信息，该设备信息由目标存储设备在对该第二信息获取请求进行鉴权并确定鉴权通过时返回。
比如，还是以目标存储设备具体为存储设备A和存储设备B为例，则，可以向存储设备A发送携带鉴权信息的第二信息获取请求，由存储设备A根据鉴权信息进行鉴权，并在鉴权通过时，返回存储设备A的设备信息；同理，在向存储设备B发送携带鉴权信息的第二信息获取请求后，由存储设备B根据鉴权信息进行鉴权，并在鉴权通过时，返回存储设备B的设备信息，以此类推，等等。需说明的是，如果鉴权不通过，则拒绝提供目标存储设备的设备信息，此时目标存储设备还可以向该数据加密装置返回请求失败的原因，比如“鉴权不通过，需提供正确的鉴权信息”等的提示，等等，在此不再赘述。
204、根据该设备信息，按照预置策略生成公共密钥。
其中，该策略可以根据实际应用的需求进行设置，比如，可以采用如下任意一种方式：
（1）将该设备信息按照预设第一序列进行组合，得到公共密钥。
比如，以设备信息为设备的IMEI码为例，若第一个目标存储设备为存储设备A，第二目标存储设备为存储设备B，第三目标存储设备为存储设备C，则可以将存储设备A的IMEI码“000000000000001”、存储设备B的IMEI码“000000000000002”和存储设备C的IMEI码“000000000000003”按照预设第一序列，比如按排列先后次序依次进行组合，得到公共密钥，即“000000000000001000000000000002000000000000003”。
（2）按照预设提取规则分别对该设备信息进行提取，得到提取信息，将该提取信息按照预设第二序列进行组合，得到公共密钥。
比如，还是以设备信息为设备的IMEI码为例，若第一个目标存储设备为存储设备A，第二目标存储设备为存储设备B，第三目标存储设备为存储设备C，提取规则为提取IMEI码的后四位数，则可以分别对存储设备A的IMEI码“000000000000001”、存储设备B的IMEI码“000000000000002”和存储设备C的IMEI码“000000000000003”进行提取，得到提取信息为“0001”、“0002”和“0003”，然后将这些提取信息按照预设第二序列，比如按排列先后次序依次进行组合，得到公共密钥，即“000100020003”。
（3）按照预设第一算法分别对该设备信息进行计算，得到计算信息，将该计算信息按照预设第三序列进行组合，得到公共密钥。
比如，可以对设备信息进行一个加权运算或进行某种函数换算，得到计算信息，然后才对计算信息进行组合，得到公共密钥，组合方式与方式（1）和（2）类似，在此不再赘述。
（4）将该设备信息按照预设第四序列进行组合，得到组合信息，按照预设第二算法对该组合信息进行计算，得到公共密钥。
除了可以先对设备信息进行运算再进行组合之外，也可以先进行组合，再进行运算，方式（4）的执行与方式（3）类似，在此不再赘述。
其中，第一序列、第二序列、第三序列和第四序列、预设第一算法、预设第二算法和预设提取规则等可以根据实际应用的需求进行设置，在此不再赘述。
需说明的是，解密时所采用的策略应该与加密时所选用的策略一致。
可选的，该解密时所采用的策略可以由数据加密装置和数据解密装置预先进行约定，并分别设置在数据加密装置和数据解密装置中，也可以由数据加密装置和数据解密装置预先进行约定，但并不进行设置，而是在需要时，根据约定来获取，即在步骤“根据该设备信息，按照预置策略生成公共密钥（即步骤204）”之前，该数据解密方法还可以包括：
获取加密时所采用的公共密钥生成策略。
则此时，步骤“根据该设备信息，按照预置策略生成公共密钥（即步骤204）”具体为：根据该设备信息，按照获取到的加密时所采用的公共密钥生成策略生成公共密钥。
205、采用该公共密钥对该密文进行解密，得到原始数据。
例如，具体可以调用解密进程，执行该解密进程，并采用该公共密钥对该密文进行解密，得到原始数据。
可选的，为了提高安全性，在采用公共密钥对该密文进行解密之后，可以在本地销毁公共密钥的相关数据，其中，公共密钥的相关数据指的是可能会泄露公共密钥的相关信息，比如，公共密钥本身，以及用于生成该公共密钥的设备信息，等等，即可以在本地删除获取到的设备信息（即生成该公共密钥的设备信息）。
此外，为了保证数据安全，在用户得到该原始数据之后，还可以将该原始数据删除，在此不再赘述。
由上可知，本实施例采用在接收到数据解密请求时，确定存储有该密文的目标存储设备，其中，密文存储于至少两个目标存储设备中，然后，获取这些目标存储设备的设备信息，并根据这多个设备信息，按照预置策略生成公共密钥，利用公共密钥对密文进行解密，得到原始数据；该方案不仅可以适用于多设备共同持有一份密文的情况，提高其适用性，而且，由于公共密钥是根据多个目标存储设备的设备信息来生成的，而设备信息需要分别向多个设备来获取，缺少其中任意一个设备信息都无法进行解密，因此，即便其中一个设备被盗取，也不会造成信息泄露，可以大大提高数据的安全性。
实施例三、
根据实施例一和二所描述的方法，以下将举例作进一步详细说明。
在本实施例中，将以数据加密装置和数据解密装置均集成在同一终端中，且生成公共密钥的策略为“将该设备信息按照预设第一序列进行组合”为例进行说明。
（一）加密；
如图3a所示，一种数据加密方法，具体流程可以如下：
A301、终端接收用户触发的数据加密请求。
其中，该数据加密请求指示需要进行加密的原始数据，以及至少两个目标存储设备等信息，比如，该数据加密请求可以携带该需要进行加密的原始数据的存储位置，如存储地址等，以及在该原始数据加密后，密文需要存放的存储设备的标识等。
为了描述方便，在本实施例中，将以该数据加密请求携带需要进行加密的原始数据的存储地址，以及携带存储设备A的标识、存储设备B的标识和存储设备C的标识为例进行说明。
A302、终端根据存储设备A的标识、存储设备B的标识和存储设备C的标识确定目标存储设备为存储设备A、存储设备B和存储设备C，分别获取存储设备A的设备信息、存储设备B的设备信息和存储设备C的设备信息，比如，可以通过蓝牙、无线网络、移动网或互联网等途径分别获取这些设备信息。
其中，设备信息可以包括设备的序列号、IMEI码、ICCID和/或MEID等信息。
其中，获取目标存储设备的设备信息的方式可以有多种，比如，可以由用户通过查看目标存储设备的设备信息，然后进行输入，即接收用户直接输入的目标存储设备的设备信息，或者，也可以直接向目标存储设备获取，即具体可以如下：
分别向存储设备A、存储设备B和存储设备C发送第一信息获取请求，存储设备A、存储设备B和存储设备C在接收到该第一信息获取请求后，分别向该终端返回自身的设备信息。
可选的，为了提高安全性，还可以对请求者的权限进行鉴权，即具体也可以如下：
分别存储设备A、存储设备B和存储设备C发送第二信息获取请求，其中，该第二信息获取请求中携带鉴权信息，这样，存储设备A、存储设备B和存储设备C在接收到该第二信息获取请求后，便可以根据该鉴权信息确定终端是否具有获取设备信息的权限，若有权限，则向终端返回自身的设备信息，比如，存储设备A返回存储设备A的设备信息，存储设备B返回存储设备B的设备信息, 存储设备C返回存储设备C的设备信息，等等。
需说明的是，如果鉴权不通过，即确定终端没有获取设备信息的权限，则存储设备可以拒绝提供自身的设备信息，此时还可以向该终端返回请求失败的原因，比如“鉴权不通过，需提供正确的鉴权信息”等的提示，等等，在此不再赘述。
A303、终端将这些设备信息按照预设第一序列进行组合，得到公共密钥。
其中，第一序列可以根据实际应用的需求进行设置。比如，若第一序列为按存储设备排列先后次序依次进行组合，则该公共密钥具体可以参见表一。
表一：
[根据细则91更正 23.05.2016]　
[根据细则91更正 23.05.2016]　
[根据细则91更正 23.05.2016]　
Figure WO-DOC-TABLE-1
比如，以设备信息为设备的IMEI码为例，则可以将存储设备A的IMEI码“000000000000001”、存储设备B的IMEI码“000000000000002”和存储设备C的IMEI码“000000000000003”按照预设第一序列，比如按排列先后次序依次进行组合，得到公共密钥，即：
“000000000000001000000000000002000000000000003”。
需说明的是，也可以采用其他的策略，其实现与此类似，在此不再赘述。
A304、终端需要进行加密的原始数据的存储地址获取原始数据，并采用该公共密钥对该原始数据进行加密，得到密文。
例如，在获取到原始数据后，可以调用加密进程，执行加密进程，以采用该公共密钥对该原始数据进行加密，得到密文。
A305、终端在本地（即该终端）销毁公共密钥的相关数据，并将该密文存储至存储设备A、存储设备B和存储设备C中。
其中，公共密钥的相关数据指的是可能会泄露公共密钥的相关信息，比如，公共密钥本身，以及用于生成该公共密钥的设备信息，等等，因此，在利用该公共密钥对原始数据进行加密之后，可以不保存该公共密钥，并在本地删除获取到的设备信息（即用于生成该公共密钥的设备信息），这样，基本本地的数据泄露，盗取者也无法得知该公共密钥。
此外，在将该密文存储至目标存储设备时，由于存在多个目标存储设备，因此，存储的方式也可以有多种，比如，可以将密文划分为若干片段，然后分别存进目标存储设备中，即，只有将这些目标存储设备中所存储的密文片段凑齐，才可以得到完整的密文；或者，也可以在每一个目标存储设备中都存储一份完整的密文，比如在存储设备A、存储设备B和存储设备C中分别都存储一份完整的密文，等等。
（二）解密；
与（一）的加密过程对应的，如图3b所示，一种数据解密方法，具体流程可以如下：
B301、终端接收用户触发的数据解密请求。
其中，该解密请求指示需要进行解密的密文等信息，比如，该数据解密请求中可以携带该密文的存储地址，或者其他可以表示该密文存储位置的信息，等等。
为了描述方便，在本实施例中，将以该数据解密请求携带该密文的存储地址为例进行说明。
B302、终端根据该密文的存储地址确定目标存储设备，比如，加密时将密文存放在存储设备A、存储设备B和存储设备C中，则此时，可以确定目标存储设备为存储设备A、存储设备B和存储设备C。
B303、终端获取存储设备A的设备信息、存储设备B的设备信息和存储设备C的设备信息，比如，可以通过蓝牙、无线网络、移动网或互联网等途径分别获取这些设备信息。
其中，设备信息可以包括设备的序列号、IMEI码、ICCID和/或MEID等信息。
其中，获取目标存储设备的设备信息的方式可以有多种，具体可参见前面的实施例，此外，可选的，为了提高安全性，还可以对请求者是否具有获取设备信息的权限进行鉴权，详见前面实施例，在此不在赘述。
A304、终端将这些设备信息按照预设第一序列进行组合，得到公共密钥。
其中，第一序列可以根据实际应用的需求进行设置。比如，若第一序列为按存储设备排列先后次序依次进行组合，则该公共密钥具体可以参见表一。
比如，以设备信息为设备的IMEI码为例，则可以将存储设备A的IMEI码“000000000000001”、存储设备B的IMEI码“000000000000002”和存储设备C的IMEI码“000000000000003”按照预设第一序列，比如按排列先后次序依次进行组合，得到公共密钥，即：
“000000000000001000000000000002000000000000003”。
需说明的是，解密时生成公共密钥的策略需要与加密时所采用的策略保持一致。
A305、终端从存储设备A、存储设备B和存储设备C中获取密文，并采用该公共密钥对该密文进行解密，得到原始数据。
例如，在获取到密文后，可以调用解密进程，执行该解密进程，并采用该公共密钥对该密文进行解密，得到原始数据。
可选的，为了提高安全性，在采用公共密钥对该密文进行解密之后，可以在本地（即终端）销毁公共密钥的相关数据，其中，公共密钥的相关数据指的是可能会泄露公共密钥的相关信息，比如，公共密钥本身，以及用于生成该公共密钥的设备信息，等等，即可以在本地删除获取到的设备信息（即生成该公共密钥的设备信息）。
此外，为了保证数据安全，在用户得到该原始数据之后，还可以在终端中将该原始数据删除，在此不再赘述。
由上可知，本实施例采用的终端在接收到数据加密请求时，可以获取至少两个目标存储设备的设备信息，然后根据这多个设备信息，按照预置策略生成公共密钥，并利用公共密钥对原始数据进行加密，得到密文，再然后，在本地销毁公共密钥的相关数据，并将密文存储至这些目标存储设备中；此外，本实施例还提供相应的解密方法。本实施例所提供的方案，不仅可以适用于多设备共同持有一份密文的情况，提高其适用性，而且，由于公共密钥是根据多个目标存储设备的设备信息来生成的，而设备信息需要分别向多个设备来获取，缺少其中任意一个设备信息都无法进行解密，因此，即便其中一个设备被盗取，也不会造成信息泄露，可以大大提高数据的安全性。
实施例四、
为了更好地实施以上方法，本发明实施例还提供一种数据加密装置，如图4所示，该数据加密装置包括接收单元401、获取单元402、生成单元403、加密单元404和处理单元405，如下：
（1）接收单元401；
接收单元401，用于接收数据加密请求。
例如，接收单元401具体可以接收用户触发的数据加密请求。
其中，该数据加密请求指示需要进行加密的原始数据，以及至少两个目标存储设备等信息，比如，该数据加密请求可以携带该需要进行加密的原始数据的存储位置，比如存储地址等，以及在该原始数据加密后，密文需要存放的存储设备的标识等。
（2）获取单元402；
获取单元402，用于分别获取该至少两个目标存储设备的设备信息。
比如，可以通过蓝牙、无线网络、移动网或互联网等途径分别获取这些设备信息。
其中，设备信息可以包括设备的序列号、IMEI码、ICCID码和/或MEID码等信息。
中，获取目标存储设备的设备信息的方式可以有多种，比如，可以由用户通过查看目标存储设备的设备信息，然后进行输入，即接收用户直接输入的目标存储设备的设备信息，或者，也可以直接向目标存储设备获取，即：
获取单元402，具体可以用于分别向该至少两个目标存储设备发送第一信息获取请求，分别接收该至少两个目标存储设备根据该第一信息获取请求返回的设备信息。
可选的，为了提高安全性，还可以对请求者的权限进行鉴权，即：
该获取单元402，具体可以用于分别向该至少两个目标存储设备发送第二信息获取请求，该第二信息获取请求中携带鉴权信息，分别接收该至少两个目标存储设备返回的设备信息，该设备信息由目标存储设备在对该第二信息获取请求进行鉴权并确定鉴权通过时返回。
（3）生成单元403；
生成单元403，用于根据该设备信息，按照预置策略生成公共密钥。
其中，该策略可以根据实际应用的需求进行设置，比如，可以采用如下任意一种方式：
生成单元403，具体可以用于将该设备信息按照预设第一序列进行组合，得到公共密钥。
或者，生成单元403，具体可以用于按照预设提取规则分别对该设备信息进行提取，得到提取信息，将该提取信息按照预设第二序列进行组合，得到公共密钥。
或者，生成单元403，具体可以用于按照预设第一算法分别对该设备信息进行计算，得到计算信息，将该计算信息按照预设第三序列进行组合，得到公共密钥。
或者，生成单元403，具体可以用于将该设备信息按照预设第四序列进行组合，得到组合信息，按照预设第二算法对该组合信息进行计算，得到公共密钥。
其中，第一序列、第二序列、第三序列和第四序列、预设第一算法、预设第二算法和预设提取规则等可以根据实际应用的需求进行设置，在此不再赘述。
（4）加密单元404；
加密单元404，用于采用该公共密钥对该原始数据进行加密，得到密文。
例如，加密单元404，具体可以根据数据加密请求获取原始数据，并采用该公共密钥对该原始数据进行加密，得到密文，比如，可以调用加密进程，执行加密进程，并然后采用该公共密钥对该原始数据进行加密，得到密文。
（5）处理单元405；
处理单元405，用于在本地销毁公共密钥的相关数据，并将该密文存储至该至少两个目标存储设备中。
其中，公共密钥的相关数据指的是可能会泄露公共密钥的相关信息，比如，公共密钥本身，以及用于生成该公共密钥的设备信息，等等，因此，在利用该公共密钥对原始数据进行加密之后，可以不保存该公共密钥，并在本地删除获取到的设备信息（即用于生成该公共密钥的设备信息），这样，基本本地的数据泄露，盗取者也无法得知该公共密钥。
此外，在将该密文存储至目标存储设备时，由于存在多个目标存储设备，因此，存储的方式也可以有多种，比如，可以将密文划分为若干片段，然后分别存进目标存储设备中，即，只有将这些目标存储设备中所存储的密文片段凑齐，才可以得到完整的密文；或者，也可以在每一个目标存储设备中都存储一份完整的密文，即：
该处理单元405，具体可以用于按照目标存储设备的数量将密文划分为对应数量的密文片段，将密文片段分别存储至该目标存储设备中；或者，
该处理单元405，具体可以用于将整份密文分别发送至该至少两个目标存储设备中，以进行存储。
具体实施时，以上各个单元可以作为独立的实体来实现，也可以进行任意组合，作为同一或若干个实体来实现，以上各个单元的具体实施可参见前面的方法实施例，在此不再赘述。
由上可知，本实施例采用在接收到数据加密请求时，由获取单元402获取至少两个目标存储设备的设备信息，然后由生成单元403根据这多个设备信息，按照预置策略生成公共密钥，并由加密单元404利用公共密钥对原始数据进行加密，得到密文，再然后，由处理单元405在本地销毁公共密钥的相关数据，并将密文存储至这些目标存储设备中；该方案不仅可以适用于多设备共同持有一份密文的情况，提高其适用性，而且，由于公共密钥是根据多个目标存储设备的设备信息来生成的，而设备信息需要分别向多个设备来获取，缺少其中任意一个设备信息都无法进行解密，因此，即便其中一个设备被盗取，也不会造成信息泄露，可以大大提高数据的安全性。
实施例五、
相应的，本发明实施例还提供一种数据解密装置，如图5所示，该数据解密装置包括接收单元501、确定单元502、获取单元503、生成单元504和解密单元505，如下：
（1）接收单元501；
接收单元501，用于接收数据解密请求，该解密请求指示需要进行解密的密文。
例如，接收单元501具体可以接收用户触发的数据解密请求。
其中，该解密请求指示需要进行解密的密文等信息，比如，该数据解密请求中可以携带该密文的存储地址，或者其他可以表示该密文存储位置的信息，等等。
（2）确定单元502；
确定单元502，用于确定存储有该密文的目标存储设备，该密文存储于至少两个目标存储设备中。
例如，如果加密时将密文存放在存储设备A和存储设备B中，则可以在数据解密请求中携带该密文的存储地址，这样，此时便可以根据该存储地址确定该密文的目标存储设备为存储设备A和存储设备B；或者，如果在数据解密请求中携带的是存储设备A和存储设备B的标识，则此时可以直接根据存储设备A和存储设备B的标识确定该密文的目标存储设备为存储设备A和存储设备B，以此类推，在此不再列举。
（3）获取单元503；
获取单元503，用于获取该目标存储设备的设备信息。
比如，可以通过蓝牙、无线网络、移动网或互联网等途径分别获取这些设备信息。
其中，设备信息可以包括设备的序列号、IMEI码、ICCID码和/或MEID码等信息。
中，获取目标存储设备的设备信息的方式可以有多种，比如，可以由用户通过查看目标存储设备的设备信息，然后进行输入，即接收用户直接输入的目标存储设备的设备信息，或者，也可以直接向目标存储设备获取，即：
获取单元503，具体可以用于分别向该目标存储设备发送第一信息获取请求，分别接收该目标存储设备根据该第一信息获取请求返回的设备信息。
可选的，为了提高安全性，还可以对请求者的权限进行鉴权，即：
该获取单元503，具体可以用于分别向该目标存储设备发送第二信息获取请求，该第二信息获取请求中携带鉴权信息，分别接收该目标存储设备返回的设备信息，该设备信息由目标存储设备在对该第二信息获取请求进行鉴权并确定鉴权通过时返回。
（4）生成单元504；
生成单元504，用于根据该设备信息，按照预置策略生成公共密钥。
其中，该策略可以根据实际应用的需求进行设置，比如，可以采用如下任意一种方式：
生成单元504，具体可以用于将该设备信息按照预设第一序列进行组合，得到公共密钥。
或者，生成单元504，具体可以用于按照预设提取规则分别对该设备信息进行提取，得到提取信息，将该提取信息按照预设第二序列进行组合，得到公共密钥。
或者，生成单元504，具体可以用于按照预设第一算法分别对该设备信息进行计算，得到计算信息，将该计算信息按照预设第三序列进行组合，得到公共密钥。
或者，生成单元504，具体可以用于将该设备信息按照预设第四序列进行组合，得到组合信息，按照预设第二算法对该组合信息进行计算，得到公共密钥。
其中，第一序列、第二序列、第三序列和第四序列、预设第一算法、预设第二算法和预设提取规则等可以根据实际应用的需求进行设置，在此不再赘述。
需说明的是，解密时所采用的策略应该与加密时所选用的策略一致。
（5）解密单元505；
解密单元505，用于采用该公共密钥对该密文进行解密，得到原始数据。
例如，解密单元505，具体可以用于根据数据解密请求从目标存储设备中获取密文，然后采用该公共密钥对该密文进行解密，得到原始数据；比如调用解密进程，执行该解密进程，并采用该公共密钥对该密文进行解密，得到原始数据。
可选的，为了提高安全性，在采用公共密钥对该密文进行解密之后，可以在本地销毁公共密钥的相关数据，其中，公共密钥的相关数据指的是可能会泄露公共密钥的相关信息，比如，公共密钥本身，以及用于生成该公共密钥的设备信息，等等，即该数据解密装置还可以包括销毁单元，如下：
该销毁单元，用于在本地销毁公共密钥的相关数据，比如在本地删除获取到的设备信息（即生成该公共密钥的设备信息）。
该数据加密装置具体可以集成在各式设备，如终端、服务器或其他网络设备等中。
具体实施时，以上各个单元可以作为独立的实体来实现，也可以进行任意组合，作为同一或若干个实体来实现，以上各个单元的具体实施可参见前面的方法实施例，在此不再赘述。
由上可知，本实施例的数据解密装置可以采用在接收到数据解密请求时，由确定单元502确定存储有该密文的目标存储设备，其中，密文存储于至少两个目标存储设备中，然后，由获取单元503获取这些目标存储设备的设备信息，并由生成单元504根据这多个设备信息，按照预置策略生成公共密钥，然后，由解密单元505利用公共密钥对密文进行解密，得到原始数据；该方案不仅可以适用于多设备共同持有一份密文的情况，提高其适用性，而且，由于公共密钥是根据多个目标存储设备的设备信息来生成的，而设备信息需要分别向多个设备来获取，缺少其中任意一个设备信息都无法进行解密，因此，即便其中一个设备被盗取，也不会造成信息泄露，可以大大提高数据的安全性。
实施例六、
此外，本发明实施例还提供一种数据存储系统，包括本发明实施例提供的任一种数据加密装置和任一种数据解密装置，其中，数据加密装置可参见实施例四，数据解密装置可参见实施例五。该数据加密装置和数据解密装置也可以集成在同一实体中，如终端、服务器或其他网络设备中。例如，以该数据加密装置和数据解密装置均集成在同一网络设备中为例，则具体可以如下：
网络设备，用于接收数据加密请求，该数据加密请求指示需要进行加密的原始数据，以及至少两个目标存储设备；分别获取该至少两个目标存储设备的设备信息；根据该设备信息，按照预置策略生成公共密钥；采用该公共密钥对该原始数据进行加密，得到密文；在本地销毁公共密钥的相关数据，并将该密文存储至该至少两个目标存储设备中。
该网络设备，还可以用于接收数据解密请求，该解密请求指示需要进行解密的密文；确定存储有该密文的目标存储设备，该密文存储于至少两个目标存储设备中；获取该目标存储设备的设备信息；根据该设备信息，按照预置策略生成公共密钥；采用该公共密钥对该密文进行解密，得到原始数据。
此外，该数据存储系统还可以包括至少两个存储设备，其中，每一种存储设备均可以执行以上功能：
存储设备，用于提供设备信息给网络设备，以及接收网络设备发送的密文，并对密文进行存储。
该存储设备，还可以用于将密文发送给网络设备。
以上各个设备的具体实施可参见前面的实施例，在此不再赘述。
由于该数据存储系统可以包括本发明实施例提供的任一种数据加密装置和任一种数据解密装置，因此，可以实现本发明实施例提供的任一种数据加密装置和任一种数据解密装置所能实现的有益效果，详见前面实施例，在此不再赘述。
本领域普通技术人员可以理解上述实施例的各种方法中的全部或部分步骤是可以通过程序来指令相关的硬件来完成，该程序可以存储于一计算机可读存储介质中，存储介质可以包括：只读存储器（ROM，Read Only Memory）、随机存取记忆体（RAM，Random Access Memory）、磁盘或光盘等。
以上对本发明实施例所提供的一种数据加密方法、解密方法、装置和系统进行了详细介绍，本文中应用了具体个例对本发明的原理及实施方式进行了阐述，以上实施例的说明只是用于帮助理解本发明的方法及其核心思想；同时，对于本领域的技术人员，依据本发明的思想，在具体实施方式及应用范围上均会有改变之处，综上所述，本说明书内容不应理解为对本发明的限制。

Claims (21)

  1. 一种数据加密方法，其特征在于，包括：
    接收数据加密请求，所述数据加密请求指示需要进行加密的原始数据，以及至少两个目标存储设备；
    分别获取所述至少两个目标存储设备的设备信息；
    根据所述设备信息，按照预置策略生成公共密钥；
    采用所述公共密钥对所述原始数据进行加密，得到密文；
    在本地销毁公共密钥的相关数据，并将所述密文存储至所述至少两个目标存储设备中。
  2. 根据权利要求1所述的方法，其特征在于，所述根据所述设备信息，按照预置策略生成公共密钥，包括：
    将所述设备信息按照预设第一序列进行组合，得到公共密钥；或者，
    按照预设提取规则分别对所述设备信息进行提取，得到提取信息，将所述提取信息按照预设第二序列进行组合，得到公共密钥；或者，
    按照预设第一算法分别对所述设备信息进行计算，得到计算信息，将所述计算信息按照预设第三序列进行组合，得到公共密钥；或者，
    将所述设备信息按照预设第四序列进行组合，得到组合信息，按照预设第二算法对所述组合信息进行计算，得到公共密钥。
  3. 根据权利要求1所述的方法，其特征在于，所述分别获取所述至少两个目标存储设备的设备信息，包括：
    分别向所述至少两个目标存储设备发送第一信息获取请求；
    分别接收所述至少两个目标存储设备根据所述第一信息获取请求返回的设备信息。
  4. 根据权利要求1所述的方法，其特征在于，所述分别获取所述至少两个目标存储设备的设备信息，包括：
    分别向所述至少两个目标存储设备发送第二信息获取请求，所述第二信息获取请求中携带鉴权信息；
    分别接收所述至少两个目标存储设备返回的设备信息，所述设备信息由目标存储设备在对所述第二信息获取请求进行鉴权并确定鉴权通过时返回。
  5. 根据权利要求1至4任一项所述的方法，其特征在于，所述在本地销毁公共密钥的相关数据，包括：
    在本地删除获取到的设备信息。
  6. 根据权利要求1至4任一项所述的方法，其特征在于，所述将所述密文存储至所述至少两个目标存储设备中，包括：
    按照目标存储设备的数量将密文划分为对应数量的密文片段，将密文片段分别存储至所述目标存储设备中；或者，
    将整份密文分别发送至所述至少两个目标存储设备中，以进行存储。
  7. 一种数据解密方法，其特征在于，包括：
    接收数据解密请求，所述解密请求指示需要进行解密的密文；
    确定存储有所述密文的目标存储设备，所述密文存储于至少两个目标存储设备中；
    获取所述目标存储设备的设备信息；
    根据所述设备信息，按照预置策略生成公共密钥；
    采用所述公共密钥对所述密文进行解密，得到原始数据。
  8. 根据权利要求7所述的方法，其特征在于，所述根据所述设备信息，按照预置策略生成公共密钥，包括：
    将所述设备信息按照预设第一序列进行组合，得到公共密钥；或者，
    按照预设提取规则分别对所述设备信息进行提取，得到提取信息，将所述提取信息按照预设第二序列进行组合，得到公共密钥；或者，
    按照预设第一算法分别对所述设备信息进行计算，得到计算信息，将所述计算信息按照预设第三序列进行组合，得到公共密钥；或者，
    将所述设备信息按照预设第四序列进行组合，得到组合信息，按照预设第二算法对所述组合信息进行计算，得到公共密钥。
  9. 根据权利要求7所述的方法，其特征在于，所述获取所述目标存储设备的设备信息，包括：
    分别向所述目标存储设备发送第一信息获取请求；
    分别接收所述目标存储设备根据所述第一信息获取请求返回的设备信息。
  10. 根据权利要求7所述的方法，其特征在于，所述获取所述目标存储设备的设备信息，包括：
    分别向所述目标存储设备发送第二信息获取请求，所述第二信息获取请求中携带鉴权信息；
    分别接收所述目标存储设备返回的设备信息，所述设备信息由目标存储设备在对所述第二信息获取请求进行鉴权并确定鉴权通过时返回。
  11. 根据权利要求7至10任一项所述的方法，其特征在于，所述采用所述公共密钥对所述密文进行解密，得到原始数据之后，还包括：
    在本地销毁公共密钥的相关数据。
  12. 一种数据加密装置，其特征在于，包括：
    接收单元，用于接收数据加密请求，所述数据加密请求指示需要进行加密的原始数据，以及至少两个目标存储设备；
    获取单元，用于分别获取所述至少两个目标存储设备的设备信息；
    生成单元，用于根据所述设备信息，按照预置策略生成公共密钥；
    加密单元，用于采用所述公共密钥对所述原始数据进行加密，得到密文；
    处理单元，用于在本地销毁公共密钥的相关数据，并将所述密文存储至所述至少两个目标存储设备中。
  13. 根据权利要求12所述的数据加密装置，其特征在于，
    所述生成单元，具体用于将所述设备信息按照预设第一序列进行组合，得到公共密钥；或者，
    所述生成单元，具体用于按照预设提取规则分别对所述设备信息进行提取，得到提取信息，将所述提取信息按照预设第二序列进行组合，得到公共密钥；或者，
    所述生成单元，具体用于按照预设第一算法分别对所述设备信息进行计算，得到计算信息，将所述计算信息按照预设第三序列进行组合，得到公共密钥；或者，
    所述生成单元，具体用于将所述设备信息按照预设第四序列进行组合，得到组合信息，按照预设第二算法对所述组合信息进行计算，得到公共密钥。
  14. 根据权利要求12至14任一项所述的数据加密装置，其特征在于，
    所述获取单元，具体用于分别向所述至少两个目标存储设备发送第一信息获取请求，分别接收所述至少两个目标存储设备根据所述第一信息获取请求返回的设备信息；或者，
    所述获取单元，具体用于分别向所述至少两个目标存储设备发送第二信息获取请求，所述第二信息获取请求中携带鉴权信息，分别接收所述至少两个目标存储设备返回的设备信息，所述设备信息由目标存储设备在对所述第二信息获取请求进行鉴权并确定鉴权通过时返回。
  15. 根据权利要求12至14任一项所述的数据加密装置，其特征在于，
    所述处理单元，具体用于按照目标存储设备的数量将密文划分为对应数量的密文片段，将密文片段分别存储至所述目标存储设备中；或者，
    所述处理单元，具体用于将整份密文分别发送至所述至少两个目标存储设备中，以进行存储。
  16. 一种数据解密装置，其特征在于，包括：
    接收单元，用于接收数据解密请求，所述解密请求指示需要进行解密的密文；
    确定单元，用于确定存储有所述密文的目标存储设备，所述密文存储于至少两个目标存储设备中；
    获取单元，用于获取所述目标存储设备的设备信息；
    生成单元，用于根据所述设备信息，按照预置策略生成公共密钥；
    解密单元，用于采用所述公共密钥对所述密文进行解密，得到原始数据。
  17. 根据权利要求16所述的数据解密装置，其特征在于，
    所述生成单元，具体用于将所述设备信息按照预设第一序列进行组合，得到公共密钥；或者，
    所述生成单元，具体用于按照预设提取规则分别对所述设备信息进行提取，得到提取信息，将所述提取信息按照预设第二序列进行组合，得到公共密钥；或者，
    所述生成单元，具体用于按照预设第一算法分别对所述设备信息进行计算，得到计算信息，将所述计算信息按照预设第三序列进行组合，得到公共密钥；或者，
    所述生成单元，具体用于将所述设备信息按照预设第四序列进行组合，得到组合信息，按照预设第二算法对所述组合信息进行计算，得到公共密钥。
  18. 根据权利要求16或17所述的数据解密装置，其特征在于，
    所述获取单元，具体用于分别向所述目标存储设备发送第一信息获取请求，分别接收所述目标存储设备根据所述第一信息获取请求返回的设备信息；或者，
    所述获取单元，具体用于分别向所述目标存储设备发送第二信息获取请求，所述第二信息获取请求中携带鉴权信息，分别接收所述目标存储设备返回的设备信息，所述设备信息由目标存储设备在对所述第二信息获取请求进行鉴权并确定鉴权通过时返回。
  19. 根据权利要求16或17所述的数据解密装置，其特征在于，还包括销毁单元；
    所述销毁单元，用于在本地销毁公共密钥的相关数据。
  20. 一种数据存储系统，其特征在于，包括权利要求12至15任一项所述的数据加密装置和权利要求16至19任一项所述的数据解密装置。
  21. 一种存储介质，其特征在于，其内存储有处理器可执行指令，所述处理器可执行指令用于执行如下操作：
    接收数据加密请求，所述数据加密请求指示需要进行加密的原始数据，以及至少两个目标存储设备；
    分别获取所述至少两个目标存储设备的设备信息；
    根据所述设备信息，按照预置策略生成公共密钥；
    采用所述公共密钥对所述原始数据进行加密，得到密文；
    在本地销毁公共密钥的相关数据，并将所述密文存储至所述至少两个目标存储设备中。
PCT/CN2016/078480 2015-08-12 2016-04-05 一种数据加密方法、解密方法、装置和系统 WO2017024804A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP16834430.7A EP3337088B1 (en) 2015-08-12 2016-04-05 Data encryption method, decryption method, apparatus, and system
US15/698,432 US10659226B2 (en) 2015-08-12 2017-09-07 Data encryption method, decryption method, apparatus, and system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510494043.4 2015-08-12
CN201510494043.4A CN106452770B (zh) 2015-08-12 2015-08-12 一种数据加密方法、解密方法、装置和系统

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/698,432 Continuation-In-Part US10659226B2 (en) 2015-08-12 2017-09-07 Data encryption method, decryption method, apparatus, and system

Publications (1)

Publication Number Publication Date
WO2017024804A1 true WO2017024804A1 (zh) 2017-02-16

Family

ID=57984262

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/078480 WO2017024804A1 (zh) 2015-08-12 2016-04-05 一种数据加密方法、解密方法、装置和系统

Country Status (4)

Country Link
US (1) US10659226B2 (zh)
EP (1) EP3337088B1 (zh)
CN (1) CN106452770B (zh)
WO (1) WO2017024804A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112149140A (zh) * 2019-06-28 2020-12-29 北京百度网讯科技有限公司 预测方法、装置、设备及存储介质

Families Citing this family (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108923925B (zh) * 2018-06-22 2022-11-08 北京京东尚科信息技术有限公司 应用于区块链的数据存储方法和装置
CN109660609B (zh) * 2018-12-07 2019-12-06 北京海泰方圆科技股份有限公司 一种设备识别方法和装置以及存储介质
CN110166222A (zh) * 2019-04-15 2019-08-23 平安科技（深圳）有限公司 多设备同时认证方法、装置、计算机设备及存储介质
CN110248166B (zh) * 2019-07-12 2021-04-20 东软集团股份有限公司 视频信息的处理方法、客户端、电子设备及存储介质
CN112235258A (zh) * 2020-09-24 2021-01-15 黄杰 信息传输用的加解密方法、加解密系统以及加解密装置
CN114490451A (zh) * 2020-11-11 2022-05-13 中兴通讯股份有限公司 数据加密及数据解密方法、装置、存储介质及电子装置
CN112583588B (zh) * 2020-12-08 2022-06-21 四川虹微技术有限公司 一种通信方法及装置、可读存储介质
CN113392413A (zh) * 2021-05-26 2021-09-14 亿次网联(杭州)科技有限公司 一种数据安全存储方法、装置、系统和存储介质
CN115134133A (zh) * 2022-06-21 2022-09-30 中国建设银行股份有限公司 数据处理方法、装置和计算机设备
CN116383858B (zh) * 2023-06-05 2023-10-20 中电科网络安全科技股份有限公司 一种磁盘数据处理方法、装置、设备及介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101950347A (zh) * 2010-09-21 2011-01-19 烟台海颐软件股份有限公司 一种对数据进行加密的方法和系统
CN102684877A (zh) * 2012-03-31 2012-09-19 奇智软件（北京）有限公司 一种进行用户信息处理的方法及装置
WO2012124270A1 (ja) * 2011-03-15 2012-09-20 パナソニック株式会社 改ざん監視システム、管理装置、保護制御モジュール及び検知モジュール
CN103107889A (zh) * 2013-02-06 2013-05-15 中电长城网际系统应用有限公司 一种可搜索的云计算环境数据加密存储系统和方法
CN104732155A (zh) * 2013-12-27 2015-06-24 卡巴斯基实验室封闭式股份公司 用于为用户设备自动指定加密策略的系统和方法

Family Cites Families (40)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5485474A (en) * 1988-02-25 1996-01-16 The President And Fellows Of Harvard College Scheme for information dispersal and reconstruction
US5825880A (en) * 1994-01-13 1998-10-20 Sudia; Frank W. Multi-step digital signature method and system
US7503072B2 (en) * 1998-04-29 2009-03-10 Microsoft Corporation Hardware ID to prevent software piracy
JP2000124887A (ja) * 1998-10-14 2000-04-28 Fuji Xerox Co Ltd グループ単位の暗号化・復号方法および署名方法ならびに装置
US6182214B1 (en) * 1999-01-08 2001-01-30 Bay Networks, Inc. Exchanging a secret over an unreliable network
US20040073790A1 (en) 2001-07-13 2004-04-15 Giuseppe Ateniese Intermediated delivery scheme for asymmetric fair exchange of electronic items
JP3864247B2 (ja) * 2001-10-19 2006-12-27 インターナショナル・ビジネス・マシーンズ・コーポレーション ネットワークシステム、端末装置、情報の配信方法及び復号方法
GB2381916B (en) * 2001-11-08 2005-03-23 Ncr Int Inc Biometrics template
US20030123667A1 (en) * 2001-12-28 2003-07-03 Cable Television Laboratories, Inc. Method for encryption key generation
US20040250073A1 (en) * 2003-06-03 2004-12-09 Cukier Johnas I. Protocol for hybrid authenticated key establishment
US7904475B2 (en) * 2007-10-09 2011-03-08 Cleversafe, Inc. Virtualized data storage vaults on a dispersed data storage network
US20070223703A1 (en) 2005-10-07 2007-09-27 Sanjeev Verma Method and apparatus for providing service keys within multiple broadcast networks
JP4962317B2 (ja) * 2005-12-01 2012-06-27 日本電気株式会社 電子入札システムおよび電子入札方法
KR20070108315A (ko) * 2005-12-07 2007-11-09 한국전자통신연구원 서명된 콜백 유알엘 메시지를 이용한 개인정보 공유 서비스제공 장치 및 방법
US8464073B2 (en) * 2006-09-13 2013-06-11 Stec, Inc. Method and system for secure data storage
US8516246B2 (en) * 2008-08-07 2013-08-20 Gilat Satellite Networks Ltd. Network binding
US8638926B2 (en) * 2009-02-26 2014-01-28 Red Hat, Inc. Sharing a secret with modular inverses
US9483656B2 (en) * 2009-04-20 2016-11-01 International Business Machines Corporation Efficient and secure data storage utilizing a dispersed data storage system
KR101362443B1 (ko) * 2009-08-03 2014-02-11 니뽄 덴신 덴와 가부시키가이샤 함수 암호 응용 시스템, 정보 출력 장치, 정보 처리 장치, 암호 프로토콜 실행 방법, 정보 출력 방법, 정보 처리 방법, 프로그램, 및 기록 매체
WO2011033259A2 (en) * 2009-09-15 2011-03-24 Eads Defence And Security Systems Limited Key generation for multi-party encryption
US8811616B2 (en) * 2010-04-12 2014-08-19 Flight Focus Pte. Ltd. Secure aircraft data channel communication for aircraft operations
CN101854392B (zh) * 2010-05-20 2012-11-14 清华大学 一种基于云计算环境的个人数据管理方法
EP2578007B1 (en) * 2010-06-01 2020-04-15 Samsung Electronics Co., Ltd Securing group communication in a machine-to-machine communication environment
US20110293093A1 (en) * 2010-06-01 2011-12-01 Rogers Communications Inc. Method and system for identity-based key management
US8526606B2 (en) * 2010-12-20 2013-09-03 GM Global Technology Operations LLC On-demand secure key generation in a vehicle-to-vehicle communication network
CN102135944A (zh) * 2011-03-24 2011-07-27 深圳市华信安创科技有限公司 一种在移动通讯设备中安全存储数据的方法
KR101574030B1 (ko) * 2011-07-15 2015-12-02 알까뗄 루슨트 안전한 그룹 메시징
US9231926B2 (en) * 2011-09-08 2016-01-05 Lexmark International, Inc. System and method for secured host-slave communication
US8769259B2 (en) * 2012-01-06 2014-07-01 Alcatel Lucent Methods and apparatuses for secure information sharing in social networks using randomly-generated keys
US8681992B2 (en) * 2012-02-13 2014-03-25 Alephcloud Systems, Inc. Monitoring and controlling access to electronic content
CN103259762B (zh) * 2012-02-16 2016-09-28 中兴通讯股份有限公司 一种基于云存储的文件加密、解密方法及系统
JP6139104B2 (ja) * 2012-11-02 2017-05-31 株式会社東芝 通信装置
US8862847B2 (en) * 2013-02-08 2014-10-14 Huawei Technologies Co., Ltd. Distributed storage method, apparatus, and system for reducing a data loss that may result from a single-point failure
FR3004041B1 (fr) * 2013-03-28 2015-04-17 Commissariat Energie Atomique Procede et dispositif d'etablissement de cles de session
CN103414682B (zh) * 2013-04-07 2016-08-17 深圳大学 一种数据的云端存储方法及系统
US9514326B1 (en) * 2013-10-15 2016-12-06 Sandia Corporation Serial interpolation for secure membership testing and matching in a secret-split archive
CN103595730B (zh) * 2013-11-28 2016-06-08 中国科学院信息工程研究所 一种密文云存储方法和系统
US9703979B1 (en) * 2014-06-13 2017-07-11 BicDroid Inc. Methods and computer program products for encryption key generation and management
CN104580359B (zh) * 2014-11-26 2018-09-28 上海斐讯数据通信技术有限公司 带存储功能的路由器中文件分片加密存储备份及下载方法
US9667416B1 (en) * 2014-12-18 2017-05-30 EMC IP Holding Company LLC Protecting master encryption keys in a distributed computing environment

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101950347A (zh) * 2010-09-21 2011-01-19 烟台海颐软件股份有限公司 一种对数据进行加密的方法和系统
WO2012124270A1 (ja) * 2011-03-15 2012-09-20 パナソニック株式会社 改ざん監視システム、管理装置、保護制御モジュール及び検知モジュール
CN102684877A (zh) * 2012-03-31 2012-09-19 奇智软件（北京）有限公司 一种进行用户信息处理的方法及装置
CN103107889A (zh) * 2013-02-06 2013-05-15 中电长城网际系统应用有限公司 一种可搜索的云计算环境数据加密存储系统和方法
CN104732155A (zh) * 2013-12-27 2015-06-24 卡巴斯基实验室封闭式股份公司 用于为用户设备自动指定加密策略的系统和方法

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112149140A (zh) * 2019-06-28 2020-12-29 北京百度网讯科技有限公司 预测方法、装置、设备及存储介质
CN112149140B (zh) * 2019-06-28 2023-06-27 北京百度网讯科技有限公司 预测方法、装置、设备及存储介质

Also Published As

Publication number Publication date
US10659226B2 (en) 2020-05-19
CN106452770A (zh) 2017-02-22
US20170373850A1 (en) 2017-12-28
EP3337088A1 (en) 2018-06-20
EP3337088A4 (en) 2019-04-03
CN106452770B (zh) 2020-10-13
EP3337088B1 (en) 2021-11-03

Similar Documents

Publication Publication Date Title
WO2017024804A1 (zh) 一种数据加密方法、解密方法、装置和系统
CN109150835B (zh) 云端数据存取的方法、装置、设备及计算机可读存储介质
TWI744371B (zh) 資料儲存方法、資料獲取方法、裝置及系統
CN110049016B (zh) 区块链的数据查询方法、装置、系统、设备及存储介质
US8462955B2 (en) Key protectors based on online keys
CN105760764B (zh) 一种嵌入式存储设备文件的加解密方法、装置及终端
US9461821B1 (en) System and method for key material protection on devices using a secret sharing scheme
US20150244522A1 (en) Method and system for providing data security
CN107295069B (zh) 数据备份方法、装置、存储介质及服务器
US20140270179A1 (en) Method and system for key generation, backup, and migration based on trusted computing
CN103763319A (zh) 一种移动云存储轻量级数据安全共享方法
WO2014209190A1 (en) Encrypting and storing data
CN110505055B (zh) 基于非对称密钥池对和密钥卡的外网接入身份认证方法和系统
WO2018024048A1 (zh) 一种认证方法，服务器，终端以及网关
US10063655B2 (en) Information processing method, trusted server, and cloud server
WO2023051337A1 (zh) 数据处理方法、装置、设备及存储介质
CN109495252A (zh) 数据加密方法、装置、计算机设备及存储介质
US10785193B2 (en) Security key hopping
CN110493177B (zh) 基于非对称密钥池对和序列号的量子通信服务站aka密钥协商方法和系统
CN110519222B (zh) 基于一次性非对称密钥对和密钥卡的外网接入身份认证方法和系统
CN114079921B (zh) 会话密钥的生成方法、锚点功能网元以及系统
CN105518696B (zh) 对数据存储器执行操作
US11216571B2 (en) Credentialed encryption
CN117041956A (zh) 通信认证方法、装置、计算机设备和存储介质
US9245097B2 (en) Systems and methods for locking an application to device without storing device information on server

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16834430

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE