WO2022252632A1

WO2022252632A1 - Data encryption processing method and apparatus, computer device, and storage medium

Info

Publication number: WO2022252632A1
Application number: PCT/CN2022/071868
Authority: WO
Inventors: 李强
Original assignee: 平安科技（深圳）有限公司
Priority date: 2021-06-01
Filing date: 2022-01-13
Publication date: 2022-12-08
Also published as: CN113364760A

Abstract

The present application discloses a data encryption processing method and apparatus, a computer device, and a storage medium, which relate to data encryption technology in the technical field of information security. The present application comprises: acquiring data to be encrypted and a first key uploaded by a client, and generating a random character string corresponding to the data to be encrypted; encrypting the random character string by means of the first key, and generating a second key; encrypting, on the basis of the second key, the data to be encrypted, and obtaining ciphertext data; receiving a data decryption instruction, reading the ciphertext data and the random character string, and encrypting the random character string by means of the first key, and obtaining the second key; and decrypting the ciphertext data on the basis of the second key, and obtaining plaintext data. In addition, the present application also relates to blockchain technology, and data to be encrypted may be stored in a blockchain. In the present application, a second key is generated by means of a first key and a random character string, data to be encrypted is encrypted by means of the second key, and the security coefficient of information encryption at a server side is improved.

Description

A data encryption processing method, device, computer equipment and storage medium

This application claims the priority of the Chinese patent application with the application number 202110609708.7 submitted to the China Patent Office on June 1, 2021, and the title of the invention is "a data encryption processing method, device, computer equipment and storage medium", the entire content of which Incorporated in this application by reference.

technical field

The present application relates to the technical field of information security, in particular to a data encryption processing method, device, computer equipment and storage medium.

Background technique

Currently popular object storage products in the industry generally provide encryption functions in order to protect user data security. According to the location of encryption, they are generally divided into two categories, namely, client-side encryption and server-side encryption.

The client-side encryption is relatively simple, that is, the user encrypts the data and then transmits it to the object storage system. The object storage itself is not responsible for any encryption-related processes. All encryption and key management are handled by the client. This encryption method is relatively simple. But security is average.

The encryption operation of server-side encryption is performed on the object storage server. Server-side encryption is divided into SSE-C and SSE-KMS according to whether the key is stored by the user. The key encrypted in SSE-C mode is stored by the user. When accessing data, the user needs to pass the secret key together, encrypt and decrypt the data through the secret key given by the user, and then respond to the user. SSE-KMS mode encryption requires the user to create a key in KMS in advance, and provide the key key_id when PUTing the object. After receiving the request, the server will go to KMS to request a specific key according to the key_id and complete data encryption.

During the data encryption process on the server side, the inventor realized that no matter it is SSE-C or SSE-KMS, the secret key is created in KMS, and the security of the secret key completely depends on the KMS service. Assuming that the KMS service generates information leakage, The security of user data stored on object storage creates security risks. Therefore, existing server-side encryption schemes still have security risks.

Contents of the invention

The purpose of the embodiment of the present application is to propose a data encryption processing method, device, computer equipment and storage medium to solve the technical problem that the existing data encryption scheme has a low safety factor and easily leads to information leakage.

In order to solve the above technical problems, the embodiment of the present application provides a data encryption processing method, which adopts the following technical solutions:

A data encryption processing method, comprising:

Receiving a data encryption instruction, obtaining the data to be encrypted uploaded by the client and the first secret key used to encrypt the data to be encrypted;

generating a random character string corresponding to the data to be encrypted, and encrypting the random character string with the first secret key to generate a second secret key;

Encrypting the data to be encrypted based on the second secret key to obtain ciphertext data corresponding to the data to be encrypted;

receiving a data decryption instruction, reading the ciphertext data and the random character string, and encrypting the random character string with the first secret key to obtain the second secret key;

Decrypting the ciphertext data based on the second secret key to obtain plaintext data corresponding to the data to be encrypted.

Further, after the step of encrypting the data to be encrypted based on the second secret key to obtain the ciphertext data corresponding to the data to be encrypted, it further includes:

adding the random character string to the ciphertext data to obtain mixed data;

storing the mixed data in a local memory, and deleting the second secret key.

Further, the step of adding the random character string to the ciphertext data to obtain mixed data specifically includes:

Segmenting the ciphertext data to determine the position and number of data incisions;

segmenting the random character string based on the number of data cutouts to obtain several subcharacters;

A data cutout mark is set, and based on the data cutout mark, several of the subcharacters are sequentially inserted into corresponding positions of the data cutout to obtain mixed data.

Further, the step of receiving the data decryption instruction, reading the ciphertext data and the random character string, and encrypting the random character string with the first secret key to obtain the second secret key , including:

receiving the data decryption instruction, reading the mixed data, and identifying a data cutout identifier in the mixed data;

Segmenting the mixed data based on the data cut mark to obtain several subcharacters;

combining several of the subcharacters to obtain the random character string;

receiving the first secret key uploaded by the client, and encrypting the random character string with the first secret key to obtain the second secret key.

Further, the step of receiving the data encryption instruction and obtaining the data to be encrypted uploaded by the client specifically includes:

receiving a data encryption instruction, and generating a key pair based on the data encryption instruction, the key pair including a public key and a private key;

sending the public key to the client, and instructing the client to use the public key to encrypt the data to be encrypted and the first secret key;

and instructing the client to upload the encrypted data to be encrypted and the first secret key.

Further, after the step of receiving the data encryption instruction and obtaining the data to be encrypted uploaded by the client and the first secret key used to encrypt the data to be encrypted, the method further includes:

receiving the encrypted data to be encrypted and the first secret key;

The private key is called, and the encrypted data to be encrypted and the first secret key are decrypted by the private key to obtain the data to be encrypted and the first secret key.

Further, after receiving the data encryption instruction and generating a key pair based on the data encryption instruction, it further includes:

instructing the client to obtain initialization time information and time information for sending the data encryption instruction;

instructing the client to calculate the current time of the client based on the initialization time information and the time information of sending the data encryption instruction;

instructing the client to generate a timestamp according to the current time, and instructing the client to generate the first secret key based on the timestamp.

In order to solve the above technical problems, the embodiment of the present application also provides a data encryption processing device, which adopts the following technical solutions:

A data encryption processing device, comprising:

The first instruction receiving module is used to receive the data encryption instruction, and obtain the data to be encrypted uploaded by the client and the first secret key used to encrypt the data to be encrypted;

A random secret key generating module, configured to generate a random character string corresponding to the data to be encrypted, and encrypt the random character string with the first secret key to generate a second secret key;

A ciphertext data generating module, configured to encrypt the data to be encrypted based on the second secret key to obtain ciphertext data corresponding to the data to be encrypted;

The second instruction receiving module is configured to receive a data decryption instruction, read the ciphertext data and the random character string, and encrypt the random character string with the first secret key to obtain the second secret key key;

A ciphertext data decryption module, configured to decrypt the ciphertext data based on the second secret key to obtain plaintext data corresponding to the data to be encrypted.

In order to solve the above technical problems, the embodiment of the present application also provides a computer device, which adopts the following technical solution:

A computer device, comprising a memory and a processor, wherein computer-readable instructions are stored in the memory, and when the processor executes the computer-readable instructions, the steps of the data encryption processing method as described below are implemented:

In order to solve the above technical problems, the embodiment of the present application also provides a computer-readable storage medium, which adopts the following technical solution:

A computer-readable storage medium, where computer-readable instructions are stored on the computer-readable storage medium, and when the computer-readable instructions are executed by a processor, the steps of the data encryption processing method as described below are implemented:

Compared with the prior art, the embodiments of the present application mainly have the following beneficial effects:

This application discloses a data encryption processing method, device, computer equipment, and storage medium. When performing data encryption, this application generates a set of random character strings on the server side and uses the first secret key uploaded by the client to pair the service Encrypt the random character string generated by the terminal to obtain the second secret key, and then use the second secret key to encrypt the data to be encrypted to obtain the ciphertext data, and finally store the ciphertext data and the random character string in the server; When decrypting data, first read the ciphertext data and random strings, then use the first secret key uploaded by the client to encrypt the read random strings to obtain the second secret key, and finally use the second secret key to encrypt the ciphertext The data is decrypted to obtain plaintext data. In this application, the first secret key directly provided by the client is not used to encrypt and decrypt the data to be encrypted, but the second secret key is generated by the first secret key and a random string. Therefore, by generating the second secret key , even if the first secret key is stolen, the ciphertext data cannot be decrypted, which improves the security factor of server-side information encryption.

Description of drawings

In order to illustrate the solution in this application more clearly, a brief introduction will be given below to the accompanying drawings that need to be used in the description of the embodiments of the application. Obviously, the accompanying drawings in the following description are some embodiments of the application. Ordinary technicians can also obtain other drawings based on these drawings on the premise of not paying creative work.

FIG. 1 shows an exemplary system architecture diagram to which the present application can be applied;

Fig. 2 shows the flowchart of an embodiment of the data encryption processing method according to the present application;

FIG. 3 shows a schematic structural diagram of an embodiment of a data encryption processing device according to the present application;

Fig. 4 shows a schematic structural diagram of an embodiment of a computer device according to the present application.

Detailed ways

Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the technical field of the application; the terms used herein in the description of the application are only to describe specific embodiments The purpose is not to limit the present application; the terms "comprising" and "having" and any variations thereof in the specification and claims of the present application and the description of the above drawings are intended to cover non-exclusive inclusion. The terms "first", "second" and the like in the description and claims of the present application or the above drawings are used to distinguish different objects, rather than to describe a specific order.

Reference herein to an "embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the present application. The occurrences of this phrase in various places in the specification are not necessarily all referring to the same embodiment, nor are separate or alternative embodiments mutually exclusive of other embodiments. It is understood explicitly and implicitly by those skilled in the art that the embodiments described herein can be combined with other embodiments.

In order to enable those skilled in the art to better understand the solutions of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

As shown in FIG. 1 , a system architecture 100 may include

terminal devices

101 , 102 , 103 , a network 104 and a server 105 . The network 104 is used as a medium for providing communication links between the

terminal devices

101 , 102 , 103 and the server 105 . Network 104 may include various connection types, such as wires, wireless communication links, or fiber optic cables, among others.

Users can use

terminal devices

101 , 102 , 103 to interact with server 105 via network 104 to receive or send messages and the like. Various communication client applications can be installed on the

terminal devices

101, 102, 103, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, and the like.

Terminal devices

101, 102, 103 can be various electronic devices with display screens and support web browsing, including but not limited to smartphones, tablet computers, e-book readers, MP3 players (Moving Picture Experts Group Audio Layer III, dynamic Video experts compress standard audio layer 3), MP4 (Moving Picture Experts Group Audio Layer IV, moving picture experts compress standard audio layer 4) players, laptops and desktop computers, etc.

The server 105 may be a server that provides various services, such as a background server that provides support for pages displayed on the

terminal devices

101 , 102 , 103 .

It should be noted that the data encryption processing method provided in the embodiment of the present application is generally executed by a server, and correspondingly, the data encryption processing device is generally set in the server.

It should be understood that the numbers of terminal devices, networks and servers in Fig. 1 are only illustrative. According to the implementation needs, there can be any number of terminal devices, networks and servers.

Continuing to refer to FIG. 2 , it shows a flowchart of an embodiment of a data encryption processing method according to the present application. The described data encryption processing method comprises the following steps:

S201. Receive a data encryption instruction, and acquire data to be encrypted uploaded by a client and a first secret key used to encrypt the data to be encrypted.

Among them, the data encryption in this application refers to server-side data encryption. Server-side data encryption mainly provides effective protection for static data, and is suitable for application scenarios with high security or compliance requirements for file storage. For example, the storage of deep learning sample files, the storage of online collaborative document data, and so on.

Specifically, after receiving the data encryption instruction uploaded by the client, the server obtains the data to be encrypted uploaded by the client and the first secret key used to encrypt the data to be encrypted. In a specific embodiment of the present application, the first key is an AES (symmetric encryption algorithm, AES) symmetric encryption key, and the first key may be generated by a KMS (Key Management Service) key service system.

S202. Generate a random character string corresponding to the data to be encrypted, and encrypt the random character string with the first key to generate a second key.

Specifically, after receiving the data to be encrypted and the first secret key uploaded by the client, the server generates a random character string corresponding to the data to be encrypted, and encrypts the random character string with the first secret key to generate the second secret key. key. In a specific embodiment of the present application, an object storage gateway RGW (Rados Gate Way, RGW) is configured in the server, and the object storage gateway RGW reads the data to be encrypted, and outputs a set of random characters corresponding to the data to be encrypted string.

S203. Encrypt the data to be encrypted based on the second key to obtain ciphertext data corresponding to the data to be encrypted.

Specifically, the server encrypts the data to be encrypted uploaded by the client based on the generated second secret key and the preset AES256 encryption algorithm, obtains the ciphertext data corresponding to the data to be encrypted, and inserts the random string into the The ciphertext data is obtained as mixed data, and the mixed data is stored in the local storage, and the second secret key is deleted at the same time.

It should be noted that, in the specific embodiment of this application, before encrypting the data to be encrypted, the data to be encrypted can be converted into a json string in advance, for example, the data to be encrypted can be converted into json by using Google's Gson package string. Then use the MD5 algorithm to generate a digest of the json string, and use the second secret key to encrypt the digest and generate a signature to complete the encryption of the data to be encrypted. Among them, MD5 message digest algorithm (MD5Message-Digest Algorithm, MD5 algorithm), a widely used cryptographic hash function, can generate a 128-bit (16-byte) hash value (hash value), used to ensure Information transmission is complete and consistent.

Among them, the symmetric encryption algorithm (symmetric encryption algorithm, AES) is an earlier encryption algorithm with mature technology. In the AES algorithm, the data sender processes the plaintext (original data) and the encryption key together with a special encryption algorithm to make it a complex encrypted ciphertext and send it out. After the recipient receives the ciphertext, if he wants to interpret the original text, he needs to use the encrypted key and the inverse algorithm of the same algorithm to decrypt the ciphertext to restore it to readable plaintext. In the AES algorithm, only one key is used, and both sender and receiver use this key to encrypt and decrypt data, which requires the decryption party to know the encryption key in advance.

S204. Receive a data decryption instruction, read the ciphertext data and the random string, and encrypt the random string with the first key to obtain the second key.

Specifically, after receiving the data decryption instruction uploaded by the client, the server reads the mixed data from the local storage, separates the ciphertext data from the random string in the mixed data, and finally uses the first secret key to pair the random character The string is encrypted to obtain the second secret key. It should be noted that after the client uploads the data decryption command, it will upload the first secret key again, and in the two encryptions performed on the random string by the above first secret key, the second secret key is the same symmetric key .

In this embodiment, the electronic device on which the data encryption processing method runs (for example, the server shown in FIG. 1 ) may receive a data encryption instruction or a data decryption instruction through a wired connection or a wireless connection. It should be pointed out that the above wireless connection methods may include but not limited to 3G/4G connection, WiFi connection, Bluetooth connection, WiMAX connection, Zigbee connection, UWB (ultra wideband) connection, and other wireless connection methods known or developed in the future .

S205. Decrypt the ciphertext data based on the second secret key to obtain plaintext data corresponding to the data to be encrypted.

Specifically, when performing data decryption, after obtaining the second secret key, the server decrypts the ciphertext data based on the second secret key, obtains the plaintext data corresponding to the data to be encrypted, and sends the plaintext data corresponding to the data to be encrypted to to the client.

In the above embodiments, the first key directly provided by the client is not used to encrypt and decrypt the data to be encrypted, but the second key is generated by the first key and a random character string. Therefore, by generating the second Even if the first secret key is stolen, the ciphertext data cannot be decrypted, which improves the security factor of server-side information encryption. After adopting the above encryption method, the server does not actually use the secret key provided by the KMS for encryption, but uses this secret key to encrypt a random string generated by the server. After encrypting the random string, it is actually used for encryption. The secret key of the data, so that even if the KMS key is leaked, it will not pose a threat to the user's data security.

adding the random character string to the ciphertext data to obtain mixed data;

storing the mixed data in a local memory, and deleting the second secret key.

Specifically, after the server encrypts the data to be encrypted based on the second secret key and obtains the ciphertext data corresponding to the data to be encrypted, the server adds random strings to the generated ciphertext data to form mixed data, and stores the mixed data to the local storage, and delete the second secret key used for encryption at the same time.

In the above embodiment, the server adds random strings to the generated ciphertext data to form mixed data, and deletes the second secret key at the same time, so as to ensure that the random strings and ciphertext data are mixed and saved It is difficult to be stolen. If the random string cannot be effectively obtained, even if the first secret key is stolen, the ciphertext data cannot be decrypted, which improves the security factor of server-side information encryption.

Specifically, when performing data encryption, the server divides the ciphertext data, and at the same time determines the position and number of data cutouts, and then divides the random character string based on the number of data cutouts to obtain several subcharacters. Determine a specific mark, and based on the mark of the data cutout, several subcharacters are sequentially inserted into the corresponding positions of the data cutout to obtain mixed data.

In a specific embodiment of the present application, the ciphertext data P is divided into N parts to obtain N-1 data cutouts (N1, N2, N3...N-1), and a specific identifier is configured at each data cutout , and divide the random character string Q into N-1 parts to obtain N-1 sub-characters (n1, n2, n3...n-1), and insert the N-1 sub-characters into the above N-1 in sequence based on the data cutout identifier In data cutouts (N1, N2, N3...N-1), mixed data is obtained, wherein subcharacter n1 is inserted into data cutout N1, subcharacter n2 is inserted into data cutout N2, and so on until all subcharacters are completed until inserted.

In the above-mentioned embodiment, through ciphertext data segmentation and random character string segmentation, the subcharacters generated by random character string segmentation are sequentially inserted into the incision positions of ciphertext data segmentation to obtain mixed data, and the random character string and ciphertext data The mixed storage method ensures that random strings are difficult to steal. In the case where random strings cannot be obtained effectively, even if the first secret key is stolen, the ciphertext data cannot be decrypted, which improves the security of server-side information encryption. Safety factor.

combining several of the subcharacters to obtain the random character string;

Specifically, when performing data decryption, after receiving the data decryption instruction uploaded by the client, the server reads the mixed data in the local storage, identifies the data incision identifier in the mixed data, and divides the mixed data based on the data incision identifier. Obtain several subcharacters, combine several subcharacters to obtain a random string, and finally receive the first secret key uploaded by the client, and encrypt the random string with the first secret key to obtain the second secret key.

In the above example, by setting the data slot ID and inserting subcharacters into the corresponding position of the data slot based on the data slot ID, when restoring encrypted data and random character strings, the server can simply recognize the data slot ID to It can successfully separate random character strings from mixed data, and facilitate the restoration of encrypted data and random character strings. By storing random strings and ciphertext data in a mixed way, it is ensured that the random strings are difficult to be stolen. In the case that the random strings cannot be obtained effectively, even if the first secret key is stolen, the ciphertext data still cannot be encrypted. Decryption improves the security factor of server-side information encryption.

Among them, the key pair is an RSA key pair, which is generated by a preset RSA algorithm. The asymmetric encryption algorithm (asymmetric cryptographic algorithm, RSA) requires two keys: a public key (public key: public key for short) and a private key (privatekey: referred to as private key), the public key and the private key are a pair, and the public key and the private key can be automatically generated based on the content of the encrypted file. If the data is encrypted with the public key, only the corresponding private key can be used to decrypt it, because Encryption and decryption use two different keys, so this algorithm is called an asymmetric encryption algorithm. The RSA key system has two kinds of keys, one of which is public, so that it is not necessary to transmit the other party’s key like the AES key. This proposal adopts the joint encryption scheme of AES encryption and RSA encryption, which can significantly improve http Security of Information Transmission.

Specifically, after receiving the data encryption instruction, the server generates a key pair based on the data encryption instruction. The key pair includes a public key and a private key. The server stores the private key in the local memory and sends the public key to the client. And instruct the client to use the public key to encrypt the data to be encrypted and the first secret key, and instruct the client to upload the encrypted data to be encrypted and the first secret key.

In the above example, the key pair is generated by an asymmetric encryption algorithm. When encrypting data, the data to be encrypted and the first secret key need to be uploaded to the server to prevent the data to be encrypted and the first secret key from being It is stolen during the upload process, and the security of information transmission can be improved by setting a key pair.

receiving the encrypted data to be encrypted and the first secret key;

Specifically, the server receives the encrypted data to be encrypted and the first secret key, invokes the private key in the local storage, and decrypts the encrypted data to be encrypted and the first secret key through the private key to obtain the data to be encrypted and the first secret key. first secret key.

In the above example, the key pair is generated by an asymmetric encryption algorithm. When decrypting data, the first secret key uploaded is encrypted by the key pair to prevent the first secret key from being stolen during the upload process. By setting the key To improve the security of information transmission.

Specifically, the current time of the client may be calculated based on the principle of clock synchronization, and then the first secret key may be generated according to the current time of the client. After the server receives the data encryption instruction and generates a key pair based on the data encryption instruction, the server first instructs the client to obtain its own initialization time information and the time information of sending the data encryption instruction, and instructs the client to send the data encryption instruction based on the initialization time information The time information of calculates the current time of the client, instructs the client to generate a timestamp according to the current time, and instructs the client to send the timestamp to KMS to generate the first secret key.

In the specific embodiment of the present application, the calculation process based on the principle of clock synchronization is as follows. When the client is initialized, the time interface information is obtained once, and the server time of the client is recorded as A at this time. At the same time, the time of the current client is obtained and recorded. for B. When the client needs to obtain the time of the current server, it first obtains the current time of the client and records it as C. Then, the time of the current server of the client can be calculated by a simple difference D=A+(C-B) by calculating two The difference between the local time and the current server time of the client can be deduced.

The above-mentioned embodiment discloses a data encryption processing method. When the application encrypts data, a group of random character strings are generated at the server end, and the random character strings generated at the server end are encrypted by using the first secret key uploaded by the client end. Encrypt to obtain the second secret key, and then use the second secret key to encrypt the data to be encrypted to obtain ciphertext data, and finally store the ciphertext data and random strings in the server; when decrypting data, first read The ciphertext data and random string, and then use the first secret key uploaded by the client to encrypt the read random string to obtain the second secret key, and finally decrypt the ciphertext data through the second secret key to obtain plaintext data . In this application, the first secret key directly provided by the client is not used to encrypt and decrypt the data to be encrypted, but the second secret key is generated by the first secret key and a random string. Therefore, by generating the second secret key , even if the first secret key is stolen, the ciphertext data cannot be decrypted, which improves the security factor of server-side information encryption.

It should be emphasized that, in order to further ensure the privacy and security of the above-mentioned data to be encrypted, the above-mentioned data to be encrypted can also be stored in nodes of a block chain.

The blockchain referred to in this application is a new application mode of computer technologies such as distributed data storage, point-to-point transmission, consensus mechanism, and encryption algorithm. Blockchain (Blockchain), essentially a decentralized database, is a series of data blocks associated with each other using cryptographic methods. Each data block contains a batch of network transaction information, which is used to verify its Validity of information (anti-counterfeiting) and generation of the next block. The blockchain can include the underlying platform of the blockchain, the platform product service layer, and the application service layer.

Those of ordinary skill in the art can understand that all or part of the processes in the methods of the above embodiments can be implemented by instructing related hardware through computer-readable instructions, and the computer-readable instructions can be stored in a computer-readable storage medium. , when the computer-readable instructions are executed, they may include the processes of the embodiments of the above-mentioned methods. Wherein, the aforementioned storage medium may be a nonvolatile storage medium such as a magnetic disk, an optical disk, a read-only memory (Read-Only Memory, ROM), or a random access memory (Random Access Memory, RAM).

It should be understood that although the various steps in the flow chart of the accompanying drawings are displayed in sequence according to the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some of the steps in the flow charts of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but may be executed at different times, and the order of execution is also It is not necessarily performed sequentially, but may be performed alternately or alternately with at least a part of other steps or sub-steps or stages of other steps.

Further referring to FIG. 3 , as an implementation of the method shown in FIG. 2 above, the present application provides an embodiment of a data encryption processing device. The device embodiment corresponds to the method embodiment shown in FIG. 2 , and the device specifically It can be applied to various electronic devices.

As shown in Figure 3, the data encryption processing device described in this embodiment includes:

The first instruction receiving module 301 is configured to receive a data encryption instruction, obtain the data to be encrypted uploaded by the client and the first secret key used to encrypt the data to be encrypted;

A random secret key generation module 302, configured to generate a random character string corresponding to the data to be encrypted, and encrypt the random character string with the first secret key to generate a second secret key;

A ciphertext data generating module 303, configured to encrypt the data to be encrypted based on the second secret key, to obtain ciphertext data corresponding to the data to be encrypted;

The second instruction receiving module 304 is configured to receive a data decryption instruction, read the ciphertext data and the random character string, and encrypt the random character string with the first secret key to obtain the second Secret key;

The ciphertext data decryption module 305 is configured to decrypt the ciphertext data based on the second secret key to obtain plaintext data corresponding to the data to be encrypted.

Further, the data encryption processing device also includes:

A ciphertext data mixing module, configured to add the random character string to the ciphertext data to obtain mixed data;

A mixed data storage module, configured to store the mixed data in a local storage, and delete the second secret key.

Further, the ciphertext data mixing module specifically includes:

The ciphertext data segmentation unit is used to divide the ciphertext data and determine the position and number of data cuts;

A random character string segmentation unit, configured to segment the random character string based on the number of data cutouts to obtain several subcharacters;

The sub-character inserting unit is configured to set a data notch identifier, and based on the data notch identifier, sequentially insert several of the subcharacters into corresponding positions of the data notch to obtain mixed data.

Further, the second instruction receiving module 304 specifically includes:

a mixed data reading unit, configured to receive the data decryption instruction, read the mixed data, and identify a data cutout identifier in the mixed data;

a mixed data splitting unit, configured to split the mixed data based on the data notch identifier to obtain several subcharacters;

A sub-character combination unit, configured to combine several of the sub-characters to obtain the random character string;

The random character string encryption unit is configured to receive the first secret key uploaded by the client, and encrypt the random character string with the first secret key to obtain the second secret key.

Further, the first instruction receiving module 301 specifically includes:

a key pair generating unit, configured to receive a data encryption instruction, and generate a key pair based on the data encryption instruction, the key pair including a public key and a private key;

a key pair encryption unit, configured to send the public key to the client, and instruct the client to use the public key to encrypt the data to be encrypted and the first secret key;

The encrypted data uploading unit is configured to and instruct the client to upload the encrypted data to be encrypted and the first secret key.

Further, the first instruction receiving module 301 also includes:

An encrypted data receiving unit, configured to receive the encrypted data to be encrypted and the first secret key;

A key pair decryption unit, configured to invoke the private key, and decrypt the encrypted data to be encrypted and the first secret key through the private key to obtain the data to be encrypted and the first secret key key.

Further, the first instruction receiving module 301 also includes:

a time information acquisition unit, configured to instruct the client to acquire initialization time information and time information for sending the data encryption instruction;

a current time calculation unit, configured to instruct the client to calculate the current time of the client based on the initialization time information and the time information for sending the data encryption instruction;

A first secret key generating unit, configured to instruct the client to generate a timestamp according to the current time, and instruct the client to generate the first secret key based on the timestamp.

The above-mentioned embodiment discloses a data encryption processing device. When performing data encryption, the present application generates a set of random character strings on the server side, and uses the first secret key uploaded by the client side to process the random character strings generated by the server side. Encrypt to obtain the second secret key, and then use the second secret key to encrypt the data to be encrypted to obtain ciphertext data, and finally store the ciphertext data and random strings in the server; when decrypting data, first read The ciphertext data and random string, and then use the first secret key uploaded by the client to encrypt the read random string to obtain the second secret key, and finally decrypt the ciphertext data through the second secret key to obtain plaintext data . In this application, the first secret key directly provided by the client is not used to encrypt and decrypt the data to be encrypted, but the second secret key is generated by the first secret key and a random string. Therefore, by generating the second secret key , even if the first secret key is stolen, the ciphertext data cannot be decrypted, which improves the security factor of server-side information encryption.

In order to solve the above technical problems, the embodiment of the present application further provides computer equipment. Please refer to FIG. 4 for details. FIG. 4 is a block diagram of the basic structure of the computer device in this embodiment.

The computer device 4 includes a memory 41 , a processor 42 and a network interface 43 connected to each other through a system bus. It should be noted that only the computer device 4 with components 41-43 is shown in the figure, but it should be understood that it is not required to implement all the components shown, and more or fewer components may be implemented instead. Among them, those skilled in the art can understand that the computer device here is a device that can automatically perform numerical calculation and/or information processing according to preset or stored instructions, and its hardware includes but is not limited to microprocessors, dedicated Integrated circuit (Application Specific Integrated Circuit, ASIC), programmable gate array (Field-Programmable Gate Array, FPGA), digital processor (Digital Signal Processor, DSP), embedded devices, etc.

The computer equipment may be computing equipment such as a desktop computer, a notebook, a palmtop computer, and a cloud server. The computer device can perform human-computer interaction with the user through keyboard, mouse, remote controller, touch panel or voice control device.

The memory 41 includes at least one type of readable storage medium, and the readable storage medium includes a flash memory, a hard disk, a multimedia card, a card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), static Random Access Memory (SRAM), Read Only Memory (ROM), Electrically Erasable Programmable Read Only Memory (EEPROM), Programmable Read Only Memory (PROM), Magnetic Memory, Magnetic Disk, Optical Disk, etc. In some embodiments, the memory 41 may be an internal storage unit of the computer device 4 , such as a hard disk or memory of the computer device 4 . In some other embodiments, the memory 41 can also be an external storage device of the computer device 4, such as a plug-in hard disk equipped on the computer device 4, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, flash memory card (Flash Card), etc. Certainly, the memory 41 may also include both an internal storage unit of the computer device 4 and an external storage device thereof. In this embodiment, the memory 41 is generally used to store the operating system and various application software installed in the computer device 4 , such as computer-readable instructions of data encryption processing methods and the like. In addition, the memory 41 can also be used to temporarily store various types of data that have been output or will be output.

The processor 42 may be a central processing unit (Central Processing Unit, CPU), controller, microcontroller, microprocessor, or other data processing chips in some embodiments. This processor 42 is generally used to control the general operation of said computer device 4 . In this embodiment, the processor 42 is configured to execute computer-readable instructions stored in the memory 41 or process data, for example, execute computer-readable instructions of the data encryption processing method.

The network interface 43 may include a wireless network interface or a wired network interface, and the network interface 43 is generally used to establish a communication connection between the computer device 4 and other electronic devices.

The present application discloses a computer device. When performing data encryption, the present application generates a set of random character strings on the server side, and encrypts the random character strings generated by the server side using the first secret key uploaded by the client side to obtain The second secret key, and then use the second secret key to encrypt the data to be encrypted to obtain the ciphertext data, and finally store the ciphertext data and random strings in the server; when decrypting data, read the ciphertext data first and a random string, and then use the first secret key uploaded by the client to encrypt the read random string to obtain the second secret key, and finally decrypt the ciphertext data with the second secret key to obtain plaintext data. In this application, the first secret key directly provided by the client is not used to encrypt and decrypt the data to be encrypted, but the second secret key is generated by the first secret key and a random string. Therefore, by generating the second secret key , even if the first secret key is stolen, the ciphertext data cannot be decrypted, which improves the security factor of server-side information encryption.

The present application also provides another implementation manner, which is to provide a computer-readable storage medium, the computer-readable storage medium may be non-volatile or volatile, and the computer-readable storage medium stores Computer-readable instructions, the computer-readable instructions can be executed by at least one processor, so that the at least one processor executes the steps of the above-mentioned data encryption processing method.

This application discloses a storage medium. When encrypting data, this application generates a set of random character strings on the server side, and encrypts the random character strings generated by the server side using the first secret key uploaded by the client side to obtain The second secret key, and then use the second secret key to encrypt the data to be encrypted to obtain the ciphertext data, and finally store the ciphertext data and random strings in the server; when decrypting data, read the ciphertext data first and a random string, and then use the first secret key uploaded by the client to encrypt the read random string to obtain the second secret key, and finally decrypt the ciphertext data with the second secret key to obtain plaintext data. In this application, the first secret key directly provided by the client is not used to encrypt and decrypt the data to be encrypted, but the second secret key is generated by the first secret key and a random string. Therefore, by generating the second secret key , even if the first secret key is stolen, the ciphertext data cannot be decrypted, which improves the security factor of server-side information encryption.

Through the description of the above embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus a necessary general-purpose hardware platform, and of course also by hardware, but in many cases the former is better implementation. Based on such an understanding, the technical solution of the present application can be embodied in the form of a software product in essence or the part that contributes to the prior art, and the computer software product is stored in a storage medium (such as ROM/RAM, disk, CD) contains several instructions to make a terminal device (which may be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) execute the methods described in the various embodiments of the present application.

Apparently, the embodiments described above are only some of the embodiments of the present application, not all of them. The drawings show preferred embodiments of the present application, but do not limit the patent scope of the present application. The present application can be implemented in many different forms, on the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present application more thorough and comprehensive. Although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing specific embodiments, or perform equivalent replacements for some of the technical features . All equivalent structures made using the contents of the description and drawings of this application, directly or indirectly used in other related technical fields, are also within the scope of protection of this application.

Claims

A data encryption processing method, comprising:

Receiving a data encryption instruction, obtaining the data to be encrypted uploaded by the client and the first secret key used to encrypt the data to be encrypted;

generating a random character string corresponding to the data to be encrypted, and encrypting the random character string with the first secret key to generate a second secret key;

Encrypting the data to be encrypted based on the second secret key to obtain ciphertext data corresponding to the data to be encrypted;

receiving a data decryption instruction, reading the ciphertext data and the random character string, and encrypting the random character string with the first secret key to obtain the second secret key;

Decrypting the ciphertext data based on the second secret key to obtain plaintext data corresponding to the data to be encrypted.
The data encryption processing method according to claim 1, wherein, after the step of encrypting the data to be encrypted based on the second key to obtain the ciphertext data corresponding to the data to be encrypted, further comprising: :

adding the random character string to the ciphertext data to obtain mixed data;

storing the mixed data in a local memory, and deleting the second secret key.
The data encryption processing method according to claim 2, wherein the step of adding the random character string to the ciphertext data to obtain mixed data specifically includes:

Segmenting the ciphertext data to determine the position and number of data incisions;

segmenting the random character string based on the number of data cutouts to obtain several subcharacters;

A data cutout mark is set, and based on the data cutout mark, several of the subcharacters are sequentially inserted into corresponding positions of the data cutout to obtain mixed data.
The data encryption processing method according to claim 3, wherein said receiving a data decryption instruction reads said ciphertext data and said random character string, and performs said random character string through said first secret key The step of encrypting and obtaining the second secret key specifically includes:

receiving the data decryption instruction, reading the mixed data, and identifying a data cutout identifier in the mixed data;

Segmenting the mixed data based on the data cut mark to obtain several subcharacters;

combining several of the subcharacters to obtain the random character string;

receiving the first secret key uploaded by the client, and encrypting the random character string with the first secret key to obtain the second secret key.
The data encryption processing method according to any one of claims 1 to 4, wherein the step of receiving the data encryption instruction and obtaining the data to be encrypted uploaded by the client includes:

receiving a data encryption instruction, and generating a key pair based on the data encryption instruction, the key pair including a public key and a private key;

sending the public key to the client, and instructing the client to use the public key to encrypt the data to be encrypted and the first secret key;

and instructing the client to upload the encrypted data to be encrypted and the first secret key.
The data encryption processing method according to claim 5, wherein, after the step of receiving the data encryption instruction and obtaining the data to be encrypted uploaded by the client and the first secret key used to encrypt the data to be encrypted, further comprising: :

receiving the encrypted data to be encrypted and the first secret key;

The private key is called, and the encrypted data to be encrypted and the first secret key are decrypted by the private key to obtain the data to be encrypted and the first secret key.
The data encryption processing method according to claim 5, wherein, after receiving the data encryption instruction and generating a key pair based on the data encryption instruction, further comprising:

instructing the client to obtain initialization time information and time information for sending the data encryption instruction;

instructing the client to calculate the current time of the client based on the initialization time information and the time information of sending the data encryption instruction;

instructing the client to generate a timestamp according to the current time, and instructing the client to generate the first secret key based on the timestamp.
A data encryption processing device, comprising:

The first instruction receiving module is used to receive the data encryption instruction, and obtain the data to be encrypted uploaded by the client and the first secret key used to encrypt the data to be encrypted;

A random secret key generating module, configured to generate a random character string corresponding to the data to be encrypted, and encrypt the random character string with the first secret key to generate a second secret key;

A ciphertext data generating module, configured to encrypt the data to be encrypted based on the second secret key to obtain ciphertext data corresponding to the data to be encrypted;

The second instruction receiving module is configured to receive a data decryption instruction, read the ciphertext data and the random character string, and encrypt the random character string with the first secret key to obtain the second secret key key;

A ciphertext data decryption module, configured to decrypt the ciphertext data based on the second secret key to obtain plaintext data corresponding to the data to be encrypted.
A computer device, characterized in that it includes a memory and a processor, wherein computer-readable instructions are stored in the memory, and when the processor executes the computer-readable instructions, the following steps of the data encryption processing method are implemented:

Receiving a data encryption instruction, obtaining the data to be encrypted uploaded by the client and the first secret key used to encrypt the data to be encrypted;

generating a random character string corresponding to the data to be encrypted, and encrypting the random character string with the first secret key to generate a second secret key;

Encrypting the data to be encrypted based on the second secret key to obtain ciphertext data corresponding to the data to be encrypted;

receiving a data decryption instruction, reading the ciphertext data and the random character string, and encrypting the random character string with the first secret key to obtain the second secret key;

Decrypting the ciphertext data based on the second secret key to obtain plaintext data corresponding to the data to be encrypted.
The computer device according to claim 9, wherein, after the step of encrypting the data to be encrypted based on the second key to obtain the ciphertext data corresponding to the data to be encrypted, further comprising:

adding the random character string to the ciphertext data to obtain mixed data;

storing the mixed data in a local memory, and deleting the second secret key.
The computer device according to claim 10, wherein the step of adding the random character string to the ciphertext data to obtain mixed data includes:

Segmenting the ciphertext data to determine the position and number of data incisions;

segmenting the random character string based on the number of data cutouts to obtain several subcharacters;

A data cutout mark is set, and based on the data cutout mark, several of the subcharacters are sequentially inserted into corresponding positions of the data cutout to obtain mixed data.
The computer device according to claim 11, wherein the receiving data decryption instruction reads the ciphertext data and the random character string, and encrypts the random character string with the first secret key, The step of obtaining the second secret key specifically includes:

receiving the data decryption instruction, reading the mixed data, and identifying a data cutout identifier in the mixed data;

Segmenting the mixed data based on the data cut mark to obtain several subcharacters;

combining several of the subcharacters to obtain the random character string;

receiving the first secret key uploaded by the client, and encrypting the random character string with the first secret key to obtain the second secret key.
The computer device according to any one of claims 9 to 12, wherein the step of receiving the data encryption instruction and obtaining the data to be encrypted uploaded by the client specifically includes:

receiving a data encryption instruction, and generating a key pair based on the data encryption instruction, the key pair including a public key and a private key;

sending the public key to the client, and instructing the client to use the public key to encrypt the data to be encrypted and the first secret key;

and instructing the client to upload the encrypted data to be encrypted and the first secret key.
The computer device according to claim 13, wherein, after the step of receiving the data encryption instruction and obtaining the data to be encrypted uploaded by the client and the first secret key used to encrypt the data to be encrypted, further comprising:

receiving the encrypted data to be encrypted and the first secret key;

The private key is called, and the encrypted data to be encrypted and the first secret key are decrypted by the private key to obtain the data to be encrypted and the first secret key.
A computer-readable storage medium, characterized in that computer-readable instructions are stored on the computer-readable storage medium, and when the computer-readable instructions are executed by a processor, the following steps of the data encryption processing method are implemented:

Receiving a data encryption instruction, obtaining the data to be encrypted uploaded by the client and the first secret key used to encrypt the data to be encrypted;

generating a random character string corresponding to the data to be encrypted, and encrypting the random character string with the first secret key to generate a second secret key;

Encrypting the data to be encrypted based on the second secret key to obtain ciphertext data corresponding to the data to be encrypted;

receiving a data decryption instruction, reading the ciphertext data and the random character string, and encrypting the random character string with the first secret key to obtain the second secret key;

Decrypting the ciphertext data based on the second secret key to obtain plaintext data corresponding to the data to be encrypted.
The computer-readable storage medium according to claim 15, wherein, after the step of encrypting the data to be encrypted based on the second key to obtain the ciphertext data corresponding to the data to be encrypted, further include:

adding the random character string to the ciphertext data to obtain mixed data;

storing the mixed data in a local memory, and deleting the second secret key.
The computer-readable storage medium according to claim 16, wherein the step of adding the random character string to the ciphertext data to obtain mixed data includes:

Segmenting the ciphertext data to determine the position and number of data incisions;

segmenting the random character string based on the number of data cutouts to obtain several subcharacters;

A data cutout mark is set, and based on the data cutout mark, several of the subcharacters are sequentially inserted into corresponding positions of the data cutout to obtain mixed data.
The computer-readable storage medium according to claim 17, wherein the receiving data decryption instruction reads the ciphertext data and the random character string, and uses the first secret key to pair the random character string The step of encrypting to obtain the second secret key specifically includes:

receiving the data decryption instruction, reading the mixed data, and identifying a data cutout identifier in the mixed data;

Segmenting the mixed data based on the data cut mark to obtain several subcharacters;

combining several of the subcharacters to obtain the random character string;

receiving the first secret key uploaded by the client, and encrypting the random character string with the first secret key to obtain the second secret key.
The computer-readable storage medium according to any one of claims 15 to 18, wherein the step of receiving the data encryption instruction and obtaining the data to be encrypted uploaded by the client includes:

receiving a data encryption instruction, and generating a key pair based on the data encryption instruction, the key pair including a public key and a private key;

sending the public key to the client, and instructing the client to use the public key to encrypt the data to be encrypted and the first secret key;

and instructing the client to upload the encrypted data to be encrypted and the first secret key.
The computer-readable storage medium according to claim 19, wherein, after the step of receiving the data encryption instruction and obtaining the data to be encrypted uploaded by the client and the first secret key used to encrypt the data to be encrypted, further include:

receiving the encrypted data to be encrypted and the first secret key;

The private key is called, and the encrypted data to be encrypted and the first secret key are decrypted by the private key to obtain the data to be encrypted and the first secret key.