WO2022089014A1 - 数据加、解密方法、装置、设备及存储介质 - Google Patents

数据加、解密方法、装置、设备及存储介质 Download PDF

Info

Publication number
WO2022089014A1
WO2022089014A1 PCT/CN2021/117032 CN2021117032W WO2022089014A1 WO 2022089014 A1 WO2022089014 A1 WO 2022089014A1 CN 2021117032 W CN2021117032 W CN 2021117032W WO 2022089014 A1 WO2022089014 A1 WO 2022089014A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
byte
xor operation
complement
bytes
Prior art date
Application number
PCT/CN2021/117032
Other languages
English (en)
French (fr)
Inventor
陈林
圣赞
Original Assignee
***股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by ***股份有限公司 filed Critical ***股份有限公司
Publication of WO2022089014A1 publication Critical patent/WO2022089014A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6245—Protecting personal data, e.g. for financial or medical purposes

Definitions

  • the present application belongs to the field of data processing, and in particular, relates to a data encryption and decryption method, apparatus, device and storage medium.
  • Embodiments of the present application provide a data encryption and decryption method, apparatus, device, and storage medium, which can reduce risks in data information security.
  • an embodiment of the present application provides a data encryption method, including: determining the length of a complemented byte according to the byte length of the original data; obtaining the complemented data whose byte length is the length of the complemented byte; according to a preset According to the splicing rule, the original data and the complemented data are spliced to obtain the spliced data; at least some bytes of the complemented data are used to perform XOR operation on some bytes of the spliced data including the original data to obtain the encrypted data of the original data.
  • an embodiment of the present application provides a data decryption method, including: determining an XOR operation object included in the complement data in the encrypted data based on a preset splicing rule and encrypted data; Perform the XOR operation on the other bytes except the XOR operation object, and obtain the spliced data; according to the splicing rule and the length of the complement byte, determine the original data of the encrypted data in the spliced data, and the length of the complement byte is the length of the complement data. length in bytes.
  • an embodiment of the present application provides a data encryption device, including: a length determination module, configured to determine the length of a complement byte according to the byte length of the original data; an acquisition module, configured to obtain the byte length as the complement byte Complement data of byte length; splicing module, used for splicing original data and complement data according to preset splicing rules, to obtain spliced data; operation module, used for splicing at least part of the byte pair of complement data Part of the data including the original data is XORed to obtain encrypted data of the original data.
  • an embodiment of the present application provides a data decryption device, comprising: a determination module for determining an XOR operation object included in the complement data in the encrypted data based on a preset splicing rule and encrypted data; an operation module for using It is used to use the XOR operation object to perform XOR operation on other bytes in the encrypted data except the XOR operation object to obtain the spliced data; the decryption module is used to determine the encrypted data in the spliced data according to the splicing rule and the length of the complement byte.
  • the original data of the data, the length of the complement byte is the byte length of the complement data.
  • an embodiment of the present application provides a data encryption device, including: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, the data encryption method of the first aspect is implemented.
  • an embodiment of the present application provides a data decryption device, including: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, the data decryption method of the second aspect is implemented.
  • embodiments of the present application provide a computer storage medium, where computer program instructions are stored on the computer storage medium, and when the computer program instructions are executed by a processor, the data encryption method of the first aspect and/or the data decryption of the second aspect are implemented method.
  • the embodiments of the present application provide a data encryption and decryption method, device, device, and storage medium, which can determine the length of the complement byte according to the byte length of the original data, so as to obtain the complement byte whose byte length is the length of the complement byte data.
  • the original data and the spliced data are spliced according to the splicing rules to form new data, that is, the spliced data.
  • the encrypted data in the original data is obtained by performing an XOR operation on part of the bytes including the original data in the spliced data by using at least part of the bytes of the complement data. After splicing, the byte length of the encrypted data is different from the byte length of the original data.
  • the value of the bytes in the encrypted data is also changed relative to the value of the bytes in the original data.
  • the original data can also be obtained by reverse decryption through the data decryption method.
  • FIG. 1 is a flowchart of an embodiment of a data encryption method provided by the first aspect of the present application
  • FIG. 2 is a flowchart of another embodiment of the data encryption method provided by the first aspect of the present application.
  • FIG. 3 is a flowchart of an example of a data encryption process provided by an embodiment of the present application.
  • FIG. 4 is a flowchart of an embodiment of a data decryption method provided by the second aspect of the present application.
  • FIG. 5 is a flowchart of another embodiment of the data decryption method provided by the second aspect of the present application.
  • FIG. 6 is a schematic structural diagram of an embodiment of a data encryption device provided by the third aspect of the present application.
  • FIG. 7 is a schematic structural diagram of an embodiment of a data decryption device provided by the fourth aspect of the application.
  • FIG. 8 is a schematic structural diagram of an embodiment of a data encryption device provided by the fifth aspect of the application.
  • FIG. 9 is a schematic structural diagram of an embodiment of a data decryption device provided by the sixth aspect of the present application.
  • Sensitive data refers to the data that may cause serious harm to society or individuals after leakage.
  • sensitive data may include, but is not limited to, name, ID number, address, phone number, bank account number, email address, password and other data.
  • data may be leaked or spied on. Once sensitive data is leaked or spied on, it will bring great risks to the information security of individuals or society.
  • the present application provides a data encryption and decryption method, device, device and storage medium, which can encrypt data to obtain encrypted data. Since the encrypted data is difficult to crack, even if the encrypted data is leaked or spied on, the possibility of obtaining the original data is very small, thus reducing the risk of sensitive data and information security. In some specific scenarios where the original data needs to be restored, the original data can be obtained by decrypting and restoring the encrypted data according to the data decryption method corresponding to the data encryption method in the present application.
  • FIG. 1 is a flowchart of an embodiment of the data encryption method provided by the first aspect of the present application. As shown in FIG. 1 , the data encryption method may include steps S101 to S104.
  • step S101 the length of the complement byte is determined according to the byte length of the original data.
  • Raw data may include, but is not limited to, sensitive data. Since the content of the information corresponding to different original data is different, the byte length of different original data may also be different. In order to uniformly encrypt the original data, the original data needs to be complemented, so that the byte length after the original data is complemented has a certain regularity, which is convenient for processing. In some examples, the length in bytes of the padded original data is an integer multiple of the byte division threshold.
  • the byte division threshold may specifically be consistent with the byte length of the data that can be run at one time by a device for executing the data encryption method, such as a processor of a computer, which is not limited herein.
  • the byte partition threshold may be 8.
  • the length of the complement byte can be determined for the purpose of the byte length after the complement of the original data being an integer multiple of the byte division threshold.
  • the length of the complement byte can be regarded as the byte length of the complement data.
  • the byte length of the original data is an integer multiple of the byte division threshold, and the byte division threshold can be determined as the length of the complement byte, thereby avoiding redundant complement data and reducing operations in the subsequent process. and save the storage space of encrypted data.
  • the byte length of the original data is not an integer multiple of the byte division threshold
  • the complement can be calculated according to the byte length of the original data through the preset byte division threshold and the complement auxiliary byte threshold. length in bytes. Calculates the remainder of dividing the byte length of the original data by the byte partition threshold. Calculate the difference between the complemented auxiliary byte threshold and the remainder, and use the difference as the length of the complemented byte.
  • the complementary byte threshold is greater than the byte division threshold.
  • the length of the complement byte can be calculated according to formula (1):
  • N is the length of the complement byte
  • P is the threshold value of the complement auxiliary byte
  • L is the byte length of the original data
  • Q is the byte division threshold
  • mod is the calculation of the remainder.
  • the minimum length of the complement byte obtained by calculating the length of the complement byte is 8 and the maximum is 15, which can avoid adding too much redundant data after the original data is complemented, that is, avoiding too much useless data.
  • the byte length of the encrypted data corresponding to the original data is too long, so that it can be ensured that the encrypted data of the original data obtained by using the data encryption method in the embodiment of the present application occupies a smaller storage space, and Encrypted computations are faster.
  • step S102 the complement data whose byte length is the length of the complement byte is obtained.
  • the complement data is the data used to complement the original data, which can be regarded as an encryption seed used for data encryption.
  • the complement data may be one of the preset complement data sets that satisfies the length of the complement byte.
  • the complement data set can be preset, and the complement data set includes at least one piece of data.
  • the complement data set may include a plurality of data with different byte lengths. In the case where the length of the complement byte is determined according to the byte length of the original data, a data whose byte length is the length of the complement byte can be selected from the complement data set as the complement data of the original data.
  • the complement data are randomly generated values. That is, the complement data may include completely randomly generated data, or may include partially randomly generated data. At least some of the bytes in the complement data are randomly generated values, which can ensure randomness of the complement data used in each encryption process, improve the difficulty of cracking the encrypted data, and further improve the security of the encrypted data.
  • the bit-complement data includes part of randomly generated data, some bytes in the bit-complement data may be required, and the specific requirements may be set according to work scenarios and work requirements, which are not limited here.
  • the complement data may include the first bit representing the length of the complement byte.
  • the first bit in the complement data can represent the length of the complement byte of the complement data, and the specific position of the first bit in the complement data and the length of the first bit in the complement data are not limited here. number.
  • the first bit may be located in the rightmost bytes of the complement data whose number is the byte division threshold, that is, the first bit may be located in the low-order bytes of the complement data whose number is the byte division threshold.
  • the complement data Assuming that the byte division threshold is 8, the complement auxiliary byte threshold is 16, and the original data is the string "1234567".
  • ASCII American Standard Code for Information Interchange
  • the hexadecimal data "0x31323334353637" obtained by converting the character string can be obtained.
  • the 0x prefix is the hexadecimal flag.
  • the byte length of the hexadecimal data "0x31323334353637” obtained by converting the character string is 7. According to the above formula (1), the length of the complement byte can be calculated to be 9.
  • the lower 4 bits of the rightmost byte in the complement data may be used as the first bits, that is, the complement data includes four first bits.
  • the rightmost byte in the complement data can be set to "0x09", “0xA9", 0x39, etc., to ensure that the value of the first bit in the byte can represent the length of the complement byte 9.
  • Other bytes in the complement data can be randomly generated, for example, the generated complement data can be "0xA1B2C3D4E5F637A839".
  • step S103 according to a preset splicing rule, splicing the original data and the complement data to obtain splicing data.
  • the preset splicing rule can be pre-written into the device for executing the data encryption method.
  • the splicing rule is read, and the original data and the complemented data are spliced according to the splicing rule.
  • the concatenation of the original data and the complement data is the concatenated data.
  • the splicing rules used in the process of encrypting data each time may be the same or different, which are not limited here.
  • the splicing rule is used to characterize the specific method of splicing the original data and the complement data.
  • the splicing rule may include splicing the complement data to the far right of the original data.
  • the splicing rule may include splicing the complement data to the leftmost of the original data.
  • the splicing rule may include dividing the original data into a first part and a second part, and splicing the complement data between the first part and the second part of the original data.
  • the splicing rule can include dividing the complement data into a first part and a second part, splicing the first part of the complement data to the leftmost part of the original data, and splicing the second part of the complement data to the most left part of the original data.
  • the specific content of the splicing rule can be set according to the work scenario and work requirements, which is not limited here.
  • the complement data may include a second bit for characterizing the splicing rule. That is, the second bit in the complementary data can represent the splicing rule between the complementary data and the original data, and the specific position of the second bit in the complementary data and the position of the second bit in the complementary data are not limited here.
  • the highest bit is 1, indicating that the complement data is spliced to the far right of the original data; in the 4 bits, the highest bit is 0, indicating that the complement data is split, and the splitting method is determined by
  • the lower 3 bits of the 4 bits indicate that the lower 3 bits of the 4 bits are 1** indicating that the complement data is divided into two parts, which are respectively spliced to the leftmost and rightmost of the original data.
  • the low 3 bits of 01* indicate that the complement data is divided into three parts, the original data is divided into two parts, and the three parts of the complement data are spliced to the leftmost part of the original data, between the two parts of the original data and The far right of the original data. * represents any number between 0 and 1, and * on different bits can represent different numbers.
  • the original data is "0x31323334353637”
  • the splicing data is "0xFA31CBD2ECF32D34A9”
  • the preset splicing rule is to splicing the splicing data to the far right of the original data
  • the obtained splicing data is "0x31323334353637FA31CBD2ECF32D34A9”.
  • the splicing rule may be a specified splicing rule, and in each process of encrypting data, the original data and the complemented data are spliced according to the specified splicing rule.
  • the splicing rule is a rule determined according to the original data and/or the complement data, that is, the splicing rule may be dynamically determined according to the original data and/or the complement data. For example, when the byte length of the original data is L 1 , the splicing rule is to splicing the complement data to the far right of the original data; when the length of the complement byte is N 1 , the splicing rule is to The bit data is divided into two parts and spliced to the leftmost and rightmost parts of the original data respectively; when the byte length of the original data is L 2 and the length of the complement byte is N 2 , the splicing rule is to The original data is divided into two parts, the complement data is divided into three parts, and the three parts of the complement data are spliced to the leftmost part of the original data, between the two parts of the original data and the rightmost part of the original data.
  • step S104 at least some bytes of the complement data are used to perform an exclusive OR operation on some bytes of the spliced data including the original data to obtain encrypted data of the original data.
  • the encrypted data of the original data can be obtained by performing XOR operation on the bytes of the original data in the spliced data by using all the bytes in the complement data.
  • the original data in the concatenated data and another part of the bytes in the complementary data in the concatenated data can also be XORed by using some bytes in the complement data to obtain encrypted data of the original data.
  • both sides of the XOR operation can be determined according to the original data and the complement data, which is not limited here.
  • the length of the complement byte is determined according to the byte length of the original data, so as to obtain the complement data whose byte length is the length of the complement byte.
  • the original data and the spliced data are spliced according to the splicing rules to form new data, that is, the spliced data.
  • Encrypted data in the original data is obtained by performing XOR operation on part of the bytes in the spliced data including the original data by using at least part of the bytes of the complement data. After splicing, the byte length of the encrypted data is different from the byte length of the original data.
  • the value of the bytes in the encrypted data is also changed relative to the value of the bytes in the original data.
  • the amount of computation required for the complement and XOR operations is small, which is more concise and less computationally intensive than encryption algorithms such as MD5, SM3, DES, and 3DES.
  • the encryption efficiency of the data encryption method in the embodiment of the present application can be improved by more than 50 times compared with encryption algorithms such as MD5, SM3, DES, and 3DES.
  • the complemented data is dynamically generated, and the complemented data is used to participate in the XOR operation.
  • the data encryption can be realized in the data transmission device and the data storage device, and no additional hardware encryption equipment is required, and no encryption is required. Key management simplifies the hardware equipment required for data encryption and reduces the cost required for data encryption.
  • FIG. 2 is a flowchart of another embodiment of the data encryption method provided by the first aspect of the present application. The difference between FIG. 2 and FIG. 1 is that step S104 in FIG. 1 may be specifically refined into steps S1041 to S1043 in FIG. 2 .
  • step S1041 the number of bytes in the complement data equal to the byte division threshold is selected to form an XOR operation object.
  • an exclusive OR operation may be performed on the bytes whose data in the concatenated data is a byte division threshold.
  • the XOR operation requires at least two objects to participate.
  • the XOR operation object can be an object participating in the XOR operation, and the object participating in the XOR operation can also be generated according to the XOR operation object, which is not limited herein.
  • the specific selection of which bytes in the complement data constitute the XOR operation object can be set according to the work scenario and work requirements, which is not limited here.
  • the rightmost bytes in the complement data whose number is the byte division threshold can be selected as the XOR operation object, and the low-order bytes whose number is the byte division threshold in the complement data can be selected to form the XOR operation object.
  • the byte division threshold is 8
  • the complement data is "0xFA31CBD2ECF32D34A9”
  • the XOR operation object can be "0x31CBD2ECF32D34A9".
  • step S1042 an XOR operation is performed on the first target byte by using the XOR operation object to obtain the first target byte after the XOR operation.
  • the first target byte includes other bytes in the concatenated data except the object of the XOR operation.
  • the first target byte includes the original data in the concatenated data and the other bytes in the complement data except for the object of the XOR operation.
  • the XOR operation object is used to perform an XOR operation on the bytes in the original data and the complement data except the XOR operation object to obtain the first target byte after the XOR operation.
  • the first target byte includes the original data in the concatenated data.
  • the XOR operation is used to perform an XOR operation on the original data to obtain the first target byte after the XOR operation.
  • the first target byte includes the original data in the spliced data, or includes the original data in the spliced data and the word in the complement data except the XOR operation object Festival.
  • the first target bytes are divided into at least two groups of first target bytes.
  • the set of first target bytes includes a number of first target bytes that is a byte partition threshold.
  • the XOR operation is performed on each group of the first target bytes to obtain each group of the first target bytes after the XOR operation.
  • the byte division threshold is 8
  • the complement auxiliary byte threshold is 16
  • the hexadecimal of the original data is "0x313233343536374348494E41”
  • the length of the complement byte calculated according to the formula (1) is 12, and the complement data is randomly generated.
  • the splicing rule is to splicing the complement data to the right side of the original data, correspondingly, the splicing data is "0x313233343536374348494E41AAB1CBD2ECF31D243E455F6C”.
  • the first target byte includes "0x313233343536374348494E41AAB1CBD2"
  • the first target byte can be divided into two groups, one group includes “0x3132333435363743”, and the other group includes "0x48494E41AAB1CBD2".
  • the first target byte can be divided into M 1 groups, where M 1 is a positive integer greater than 1.
  • an XOR operation can be performed on the XOR operation object and each group of first target bytes respectively to obtain each group of first target bytes after the XOR operation. That is, perform the XOR operation on the XOR operation object and the first group of the first target bytes to obtain the first group of first target bytes after the XOR operation; perform the XOR operation on the XOR operation object and the second group of the first target bytes. XOR operation to obtain the second group of the first target bytes after the XOR operation; and so on, until the XOR operation object and the M1th group of the first target bytes are XORed to obtain the XOR operation object. Group M1 of the first target byte.
  • the concatenated data is "0x313233343536374348494E41AAB1CBD2ECF31D243E455F6C”
  • the original data is "0x313233343536374348494E41”
  • the complementary data is "0xAAB1CBD2ECF31D243E455F6C”.
  • the XOR operation object is "0xECF31D243E455F6C”
  • a group of first target bytes includes "0x3132333435363743”
  • another group of first target bytes includes "0x48494E41AAB1CBD2".
  • a group of first target bytes “0x3132333435363743” can be XORed with the XOR operation object "0xECF31D243E455F6C” to obtain a group of first target bytes after XOR operation; another group of first target bytes “0x48494E41AAB1CBD2 ” performs the XOR operation with the XOR operation object “0xECF31D243E455F6C” to obtain another set of first target bytes after the XOR operation.
  • the XOR operation object may be shifted M 1 -1 times to obtain M 1 -1 shifted XOR operation objects. That is, each shift gets a shifted XOR object.
  • the XOR operation object and the M 1 -1 shifted XOR operation objects are respectively subjected to XOR operation with each group of first target bytes to obtain each group of first target bytes after the XOR operation.
  • the step size of each shift can be set according to the work scenario and work requirements, and is not limited here. In order to further improve the difficulty of cracking the encrypted data, the step size of each shift can be S bits, and S cannot be divisible by 8 or by 4. For example, the step size for each shift is 1 bit.
  • the shift may be a sequential left shift and a right complement of 0 or 1, where 0 or 1 is the value of the complemented bit.
  • the shift may be a sequential right shift and a left complement of 0 or 1, where 0 or 1 is the value of the complemented bit.
  • the shift may be a cyclic left shift or a cyclic right shift.
  • the spliced data is "0x313233343536374348494E41AAB1CBD2ECF31D243E455F6C”
  • the original data is "0x313233343536374348494E41”
  • the complement data is "0xAAB1CBD2ECF31D243E455F6C”.
  • the XOR operation object is "0xECF31D243E455F6C”
  • a group of first target bytes includes "0x3132333435363743”
  • another group of first target bytes includes "0x48494E41AAB1CBD2".
  • the shift is a cyclic left shift, and the step size of each shift is 1 bit. Shift the XOR operation object once to obtain the shifted XOR operation object "0xD9E63A487C8ABED9".
  • a group of first target bytes "0x3132333435363743” can be XORed with the XOR operation object "0xECF31D243E455F6C” to obtain a group of first target bytes after XOR operation; another group of first target bytes "0x48494E41AAB1CBD2 " and the shifted XOR operation object "0xD9E63A487C8ABED9" to perform XOR operation to obtain another set of first target bytes after XOR operation.
  • the difficulty of cracking the encrypted data can be further improved, thereby further reducing the security of data information aspects of risk.
  • step S1043 based on the arrangement order of the bytes in the concatenated data, the encrypted data is obtained according to the first target byte after the XOR operation and the XOR operation object.
  • the first target byte after the XOR operation and the XOR operation object are arranged according to the arrangement order of the bytes in the concatenated data to obtain encrypted data.
  • determining the length of the complement byte, splicing data and outputting encrypted data can be implemented by a complementer, that is, the complement byte length algorithm and the splicing rule can be built into the complementer.
  • Obtaining the complement data can be achieved through a seed generator, and the complement data generation algorithm can be built into the seed generator.
  • the XOR operation can be implemented by an XOR. Shifting can be achieved by a shifter.
  • the complementer, the seed generator, the XOR and the shifter may be provided in the apparatus for performing the data encryption method of the present application.
  • the byte division threshold is 8, and the byte length of the original data is greater than the byte division threshold of 8 as an example for description.
  • FIG. 3 is a flowchart of an example of a data encryption process provided by an embodiment of the present application. As shown in FIG. 3 , the data encryption process may include steps S201 to S215.
  • step S201 the complementer determines the length of the complement byte according to the byte length of the original data.
  • step S202 the complementer requests the seed generator for complemented data whose byte length is the length of the complemented byte.
  • step S203 the seed generator generates complement data.
  • step S204 the seed generator feeds back the complement data to the complementer.
  • step S205 the complementer splices the original data and the complemented data according to the splicing rule.
  • step S206 the complementer sends the first target byte with the length of 8 bytes and the XOR operation object of 8 bytes according to the arrangement order in the spliced data to the XOR, requesting The XOR performs the XOR operation.
  • step S207 the XOR performs an XOR operation on the first group of the first target bytes and the XOR operation object.
  • step S208 the XOR feeds back the first group of first target bytes after the XOR operation to the complementer.
  • step S209 the complementer sends an XOR operation object to the shifter, and requests the shifter to perform shifting.
  • step S210 the shifter performs the first shift on the XOR operation object to obtain the XOR operation object after the first shift.
  • step S211 the shifter feeds back the XOR operation object after the first shift to the complementer.
  • step S212 the complementer sends to the XOR the second group of first target bytes whose length is 8 bytes and the XOR operation object after the first shift, which are arranged in the order in which the spliced data is arranged. , requesting the XOR to perform the XOR operation.
  • step S213 the XOR performs an XOR operation on the second group of the first target bytes and the XOR operation object after the first shift.
  • step S214 the XOR feeds back the second group of the first target bytes after the XOR operation to the complementer.
  • the above steps S209 to S214 can be repeated, the shifter performs second or more shifts, and the XOR performs An XOR operation between the second or more groups of the first target bytes and the second or more shifted XOR objects.
  • step S215 the complementer outputs encrypted data according to the order of the bytes in the concatenated data, and according to the obtained first target byte after the XOR operation and the object of the XOR operation.
  • FIG. 4 is a flowchart of an embodiment of the data decryption method provided by the second aspect of the present application. As shown in FIG. 4 , the data decryption method may include steps S301 to S303.
  • step S301 based on the preset splicing rule and encrypted data, determine the XOR operation object included in the complement data in the encrypted data.
  • the encrypted data here is the encrypted data obtained by using the data encryption method in the above embodiment.
  • the preset splicing rule is the same as the splicing rule in the data encryption method in the above-mentioned embodiment, and the encrypting party and the decrypting party can pre-agreed.
  • the XOR operation object in the encrypted data has not changed. According to the splicing rule, the XOR operation object can be obtained from the complement data in the encrypted data.
  • step S302 using the XOR operation object, perform XOR operation on other bytes in the encrypted data except the XOR operation object to obtain the concatenated data.
  • the other bytes in the encrypted data except the XOR operation object are the bytes that have been XORed in the data encryption process.
  • the XOR operation object in the encrypted data is divided.
  • the XOR operation is performed again on the other bytes except the XOR operation object, and the other bytes in the encrypted data except the XOR operation object are restored to the bytes before the XOR operation in the data encryption process.
  • the concatenated data can be obtained based on the bytes and the object of the XOR operation before the XOR operation in the data encryption process.
  • the spliced data is the data after splicing the original data and the complement data.
  • step S303 the original data of the encrypted data in the spliced data is determined according to the splicing rule and the length of the complement byte.
  • the complement byte length is the byte length of the complement data.
  • the complement data can be determined according to the length of the complement byte and the splicing rule.
  • the first difference between the concatenated data and the length of the complement byte is determined if the length of the complement byte is the byte division threshold or if the length of the complement byte is not the byte division threshold is the byte length of the original data; according to the splicing rule and the byte length of the original data, determine the original data in the splicing data, that is, the original data can be obtained by removing the complement data from the splicing data.
  • a second difference between the threshold of the complemented auxiliary byte and the length of the complemented byte may be calculated; the second difference is used as the difference between the original data
  • the remainder obtained by dividing the byte length by the byte division threshold is used to obtain the byte length of the original data; according to the splicing rule and the byte length of the original data, the original data in the spliced data is determined.
  • the length of the complemented byte, the byte division threshold and the threshold of the complemented auxiliary byte are known, according to the formula (1) in the above-mentioned embodiment and the limitation of the length of the encrypted data, the calculated value of the original data is obtained. length in bytes to get the original data.
  • the complement data may include a first bit for characterizing the length of the complement byte.
  • the first bit may be located within a rightmost number of bytes of the complement data equal to the byte partition threshold.
  • the position of the first bit in the complemented data in the encrypted data can be determined based on the splicing rule.
  • the length of the complement byte is determined.
  • the splicing rule is that the complement data is spliced to the right side of the original data, the lower 4 bits in the rightmost byte in the complement data are the first bits, and the rightmost byte in the complement data is "" 0x09", it can be determined that the length of the complement byte is 9.
  • the complement data includes a second bit for characterizing the splicing rule.
  • the device for performing the data decryption method may preset the position of the second bit in the encrypted data, and determine the splicing rule by reading the value of the second bit in the encrypted data.
  • the byte partition threshold may be 8
  • the padded auxiliary byte threshold may be 16.
  • the XOR operation object may be determined based on the encrypted data and the splicing rule obtained by using the data encryption method in the above-mentioned embodiment.
  • the XOR operation is performed on other bytes in the encrypted data except the XOR operation object, and the spliced data including the original data and the complement data can be recovered.
  • the original data can be obtained from the spliced data, that is, the original data can be recovered.
  • encrypted data using algorithms such as MD5 and SM3 cannot be decrypted in reverse.
  • algorithms such as MD5 and SM3 are not applicable.
  • the data decryption method of the embodiment of the present application can perform reverse decryption on the encrypted data in the above embodiment to restore the original data.
  • the data decryption method in the embodiment of the present application is simpler and requires less computation.
  • the decryption efficiency of the data decryption method in the embodiment of the present application can be improved by more than 50 times compared with algorithms such as DES and 3DES.
  • the complemented data can be determined according to the encrypted data, and no additional key management is required, which simplifies the hardware equipment required for data decryption and reduces the cost required for data confidentiality.
  • FIG. 5 is a flowchart of another embodiment of the data decryption method provided by the second aspect of the present application.
  • the difference between FIG. 5 and FIG. 4 is that step S302 in FIG. 4 may be specifically refined into steps S3021 and S3022 in FIG. 5 .
  • step S3021 an XOR operation is performed on the second target byte by using the XOR operation object to obtain the second target byte after the XOR operation.
  • the second target byte includes other bytes in the encrypted data except the object of the XOR operation.
  • the second target byte includes the original data after the XOR operation in the encryption process and the complement bit after the XOR operation. Bytes in the data other than the object of the XOR operation. Using the XOR operation object, the XOR operation is performed on the second target byte to obtain the second target byte after the XOR operation.
  • the second target byte includes the original data after the exclusive OR operation in the encryption process.
  • the XOR operation is performed on the second target byte to obtain the second target byte after the XOR operation.
  • the second target bytes In the case where the difference between the byte length of the encrypted data and the length of the complement byte is greater than the byte division threshold, divide the second target bytes into at least two groups of the second target bytes according to the arrangement order of the second target bytes in the encrypted data.
  • the set of second target bytes includes a number of second target bytes that is a byte partition threshold.
  • an XOR operation is performed on each group of the second target bytes to obtain each group of the second target bytes after the XOR operation.
  • the first target byte can be divided into M 2 groups, where M 2 is a positive integer greater than 1.
  • an XOR operation is performed on the XOR operation object and each group of second target bytes respectively to obtain each group of second target bytes after the XOR operation. That is, perform XOR operation on the XOR operation object and the first group of second target bytes to obtain the first group of second target bytes after XOR operation; perform XOR operation on the XOR operation object and the second group of second target bytes. XOR operation to obtain the second group of second target bytes after XOR operation; and so on, until XOR operation is performed on the object of XOR operation and the second group of M2 target bytes to obtain XOR operation object. M2 group of second target bytes.
  • the XOR operation object is shifted M 2 -1 times to obtain M 2 -1 shifted XOR operation objects. That is, each shift gets a shifted XOR object.
  • the XOR operation object and the M 2 -1 shifted XOR operation objects are respectively subjected to XOR operation with each group of second target bytes to obtain each group of second target bytes after the XOR operation.
  • step S3022 based on the arrangement order of the second target bytes in the encrypted data, the concatenated data is obtained according to the second target byte after the XOR operation and the XOR operation object.
  • the second target byte after the XOR operation and the XOR operation object are arranged in the order of the bytes in the encrypted data to obtain the spliced data.
  • FIG. 6 is a schematic structural diagram of an embodiment of a data encryption apparatus according to a third aspect of the present application.
  • the data encryption apparatus 400 may include a length determination module 401 , an acquisition module 402 , a splicing module 403 and an operation module 404 .
  • the length determination module 401 may be configured to determine the length of the complement byte according to the byte length of the original data.
  • the obtaining module 402 is configured to obtain the complement data whose byte length is the length of the complement byte.
  • the splicing module 403 is used for splicing the original data and the complement data according to the preset splicing rule to obtain the splicing data.
  • the operation module 404 is configured to perform an XOR operation on a part of the bytes including the original data in the spliced data by using at least part of the bytes of the complement data to obtain encrypted data of the original data.
  • the length of the complement byte is determined according to the byte length of the original data, so as to obtain the complement data whose byte length is the length of the complement byte.
  • the original data and the spliced data are spliced according to the splicing rules to form new data, that is, the spliced data.
  • Encrypted data in the original data is obtained by performing XOR operation on part of the bytes in the spliced data including the original data by using at least part of the bytes of the complement data. After splicing, the byte length of the encrypted data is different from the byte length of the original data.
  • the value of the bytes in the encrypted data is also changed relative to the value of the bytes in the original data.
  • the amount of computation required for the complement and XOR operations is small, which is more concise and less computationally intensive than encryption algorithms such as MD5, SM3, DES, and 3DES.
  • the encryption efficiency of the data encryption method in the embodiment of the present application can be improved by more than 50 times compared with encryption algorithms such as MD5, SM3, DES, and 3DES.
  • the complemented data is dynamically generated, and the complemented data is used to participate in the XOR operation.
  • the data encryption can be realized in the data transmission device and the data storage device, and no additional hardware encryption equipment is required, and no encryption is required. Key management simplifies the hardware equipment required for data encryption and reduces the cost required for data encryption.
  • the above-mentioned length determination module 401 may be configured to: in the case that the byte length of the original data is an integer multiple of the byte division threshold, determine the byte division threshold as the complement byte length.
  • the above-mentioned length determination module 401 may be configured to: in the case that the byte length of the original data is not an integer multiple of the byte division threshold, calculate the remainder obtained by dividing the byte length of the original data by the byte division threshold ; Calculate the difference between the complement auxiliary byte threshold and the remainder, and use the difference as the length of the complement byte.
  • the complement auxiliary byte threshold is greater than the byte division threshold.
  • the byte partition threshold is 8, and the padded auxiliary byte threshold is 16.
  • the above-mentioned operation module 404 is used to: select bytes whose number is the byte division threshold in the complement data to form an XOR operation object; use the XOR operation object to perform an XOR operation on the first target byte to obtain The first target byte after the XOR operation, the first target byte includes other bytes in the spliced data except the object of the XOR operation; based on the arrangement order of the bytes in the spliced data, according to the first target after the XOR operation Bytes and XOR object to get encrypted data.
  • the above-mentioned operation module 404 is configured to: select the bytes whose rightmost number of the complement data is the byte division threshold to form an XOR operation object.
  • the above-mentioned operation module 404 is configured to: in the case that the byte length of the original data is greater than the byte division threshold, according to the arrangement order of the first target bytes in the concatenated data, divide the first target byte into at least Two groups of first target bytes, one group of first target bytes includes first target bytes whose number is the byte division threshold; using the XOR operation object, perform XOR operation on each group of first target bytes to obtain Each group of first target bytes after XOR operation.
  • the first target byte is divided into M 1 groups, where M 1 is a positive integer greater than 1.
  • the above-mentioned operation module 404 is used to: perform an XOR operation on the XOR operation object and each group of first target bytes respectively to obtain each group of first target bytes after the XOR operation; or, perform an XOR operation on the XOR operation object.
  • M 1 -1 shifts to obtain M 1 -1 shifted XOR operation objects; for the XOR operation object and M 1 -1 shifted XOR operation objects, respectively, and each group of first
  • the target bytes are XORed to obtain each group of first target bytes after the XOR operation.
  • At least some of the bytes in the complement data are randomly generated values.
  • the complement data is one piece of data in a preset complement data set that satisfies the length of the complement byte.
  • the complement data includes a first bit for representing the length of the complement byte, and the first bit may be located in the rightmost number of bytes of the complement data equal to the byte division threshold.
  • the complement data includes a second bit for characterizing the splicing rule.
  • the splicing rule is the specified splicing rule
  • the splicing rule is a rule determined according to the original data and/or the complement data.
  • FIG. 7 is a schematic structural diagram of an embodiment of a data decryption apparatus according to a fourth aspect of the present application.
  • the data decryption apparatus 500 may include a determination module 501 , an operation module 502 and a decryption module 503 .
  • the determining module 501 may be configured to determine the XOR operation object included in the complement data in the encrypted data based on the preset splicing rule and the encrypted data.
  • the operation module 502 can be configured to use the XOR operation object to perform XOR operation on other bytes in the encrypted data except the XOR operation object to obtain the concatenated data.
  • the decryption module 503 may be configured to determine the original data of the encrypted data in the spliced data according to the splicing rule and the length of the complement byte.
  • the complement byte length is the byte length of the complement data.
  • the XOR operation object can be determined based on the encrypted data and the splicing rule obtained by using the data encryption method in the above-mentioned embodiment.
  • the XOR operation is performed on other bytes in the encrypted data except the XOR operation object, and the spliced data including the original data and the complement data can be recovered.
  • the original data can be obtained from the spliced data, that is, the original data can be recovered.
  • the above-mentioned decryption module 503 may be configured to: in the case where the length of the complement byte is the byte division threshold, determine the first difference between the length of the concatenated data and the length of the complement byte as the byte length of the original data; According to the splicing rule and the byte length of the original data, determine the original data in the splicing data.
  • the above decryption module 503 can be used to: in the case where the length of the complemented byte is not the byte division threshold, calculate the second difference between the threshold of the complemented auxiliary byte and the length of the complemented byte; The difference is used as the remainder obtained by dividing the byte length of the original data by the byte division threshold to obtain the byte length of the original data; according to the splicing rule and the byte length of the original data, the original data in the spliced data is determined.
  • the byte partition threshold is 8, and the padded auxiliary byte threshold is 16.
  • the above-mentioned operation module 502 may be configured to: use an XOR operation object to perform an XOR operation on the second target byte to obtain a second target byte after the XOR operation, where the second target byte includes the encrypted data Other bytes except the object of the XOR operation; based on the arrangement order of the second target bytes in the encrypted data, and according to the second target byte after the XOR operation and the object of the XOR operation, the concatenated data is obtained.
  • the above-mentioned operation module 502 may be configured to: in the case that the difference between the byte length of the encrypted data and the length of the complement byte is greater than the byte division threshold, according to the arrangement order of the second target bytes in the encrypted data, Divide the second target bytes into at least two groups of second target bytes, and one group of second target bytes includes second target bytes whose number is the byte division threshold; The target bytes are XORed to obtain each group of second target bytes after the XOR operation.
  • the first target byte is divided into M 2 groups, where M 2 is a positive integer greater than 1.
  • the above-mentioned operation module 502 can be used to: perform an XOR operation on the XOR operation object and each group of second target bytes respectively to obtain each group of second target bytes after the XOR operation; or, perform an XOR operation on the XOR operation object.
  • M 2 -1 shifts to obtain M 2 -1 shifted XOR objects; for the XOR objects and M 2 -1 shifted XOR objects, respectively, and each group of second XOR objects
  • the target bytes are XORed to obtain each group of second target bytes after the XOR operation.
  • the complement data includes a first bit for characterizing the length of the complement byte.
  • the first bit may be located within a rightmost number of bytes of the complement data equal to the byte partition threshold.
  • the complement data includes a second bit for characterizing the splicing rule.
  • the data encryption device and the data decryption device in the above embodiments may be the same device or different devices, which are not limited herein.
  • FIG. 8 is a schematic structural diagram of an embodiment of a data encryption device according to a fifth aspect of the present application.
  • the data encryption apparatus 600 includes a memory 601 , a processor 602 , and a computer program stored on the memory 601 and executable on the processor 602 .
  • the above-mentioned processor 602 may include a central processing unit (CPU), or a specific integrated circuit (Application Specific Integrated Circuit, ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.
  • CPU central processing unit
  • ASIC Application Specific Integrated Circuit
  • Memory 601 may include Read-Only Memory (ROM), Random Access Memory (RAM), magnetic disk storage media devices, optical storage media devices, flash memory devices, electrical, optical or other physical/tangible memory storage device.
  • ROM Read-Only Memory
  • RAM Random Access Memory
  • magnetic disk storage media devices typically, magnetic disk storage media devices, optical storage media devices, flash memory devices, electrical, optical or other physical/tangible memory storage device.
  • a memory typically, includes one or more tangible (non-transitory) computer-readable storage media (eg, memory devices) encoded with software including computer-executable instructions, and when the software is executed (eg, by a or multiple processors), it is operable to perform the operations described with reference to the data encryption method according to the embodiment of the present application.
  • the processor 602 runs a computer program corresponding to the executable program code by reading the executable program code stored in the memory 601, so as to implement the data encryption method in the above-mentioned embodiment.
  • the data encryption device 600 may also include a communication interface 603 and a bus 604 .
  • the memory 601 , the processor 602 , and the communication interface 603 are connected through the bus 604 and complete the communication with each other.
  • the communication interface 603 is mainly used to implement communication between modules, apparatuses, units and/or devices in the embodiments of the present application. Input devices and/or output devices may also be accessed through the communication interface 603 .
  • Bus 604 includes hardware, software, or both, coupling the components of data encryption device 600 to each other.
  • the bus 604 may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), HyperTransport (HT) interconnect, Industrial Standard Architecture (ISA) bus, Infiniband interconnect, Low pin count (LPC) bus, memory bus, MicroChannel Architecture (MicroChannel Architecture, MCA) bus, Peripheral Component Interconnect (PCI) bus, PCI-Express (PCI-X) bus, Serial Advanced Technology Attachment (SATA) bus, Video Electronics Standards Association (Video Electronics) Standards Association Local Bus, VLB) bus or other suitable bus or a combination of two or more of these.
  • Bus 604 may include one or more buses, where appropriate. Although embodiments of this application describe and illustrate a particular bus, this application contemplates any suitable bus or interconnect.
  • FIG. 9 is a schematic structural diagram of an embodiment of a data decryption device provided by the sixth aspect of the present application.
  • the data decryption apparatus 700 includes a memory 701 , a processor 702 , and a computer program stored on the memory 701 and executable on the processor 702 .
  • the above-mentioned processor 702 may include a central processing unit (CPU), or a specific integrated circuit (Application Specific Integrated Circuit, ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.
  • CPU central processing unit
  • ASIC Application Specific Integrated Circuit
  • Memory 701 may include Read-Only Memory (ROM), Random Access Memory (RAM), magnetic disk storage media devices, optical storage media devices, flash memory devices, electrical, optical or other physical/tangible memory storage device.
  • ROM Read-Only Memory
  • RAM Random Access Memory
  • magnetic disk storage media devices typically, magnetic disk storage media devices, optical storage media devices, flash memory devices, electrical, optical or other physical/tangible memory storage device.
  • a memory typically, includes one or more tangible (non-transitory) computer-readable storage media (eg, memory devices) encoded with software including computer-executable instructions, and when the software is executed (eg, by a or multiple processors), it is operable to perform the operations described with reference to the data decryption method according to the embodiment of the present application.
  • the processor 702 runs a computer program corresponding to the executable program code by reading the executable program code stored in the memory 701, so as to implement the data decryption method in the above-mentioned embodiment.
  • the data decryption device 700 may also include a communication interface 703 and a bus
  • the memory 701 , the processor 702 , and the communication interface 703 are connected through the bus 704 and complete the communication with each other.
  • the communication interface 703 is mainly used to implement communication between modules, apparatuses, units and/or devices in the embodiments of the present application. Input devices and/or output devices may also be accessed through communication interface 703 .
  • Bus 704 includes hardware, software, or both, coupling the components of data decryption device 700 to each other.
  • the bus 704 may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), HyperTransport (HT) interconnect, Industrial Standard Architecture (ISA) bus, Infiniband interconnect, Low pin count (LPC) bus, memory bus, MicroChannel Architecture (MicroChannel Architecture, MCA) bus, Peripheral Component Interconnect (PCI) bus, PCI-Express (PCI-X) bus, Serial Advanced Technology Attachment (SATA) bus, Video Electronics Standards Association (Video Electronics) Standards Association Local Bus, VLB) bus or other suitable bus or a combination of two or more of these.
  • Bus 704 may include one or more buses, where appropriate. Although embodiments of this application describe and illustrate a particular bus, this application contemplates any suitable bus or interconnect.
  • the data encryption device and the data decryption device in the foregoing embodiments may be the same device or different devices, which are not limited herein.
  • Embodiments of the present application further provide a computer-readable storage medium, where a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the data encryption method and/or the data decryption method in the foregoing embodiments can be implemented , and can achieve the same technical effect, in order to avoid repetition, it is not repeated here.
  • the above-mentioned computer-readable storage medium may include a non-transitory computer-readable storage medium, such as read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), magnetic disk or optical disk etc., are not limited here.
  • processors may be, but are not limited to, general purpose processors, special purpose processors, application specific processors, or field programmable logic circuits. It will also be understood that each block of the block diagrams and/or flowchart illustrations, and combinations of blocks in the block diagrams and/or flowchart illustrations, can also be implemented by special purpose hardware for performing the specified functions or actions, or by special purpose hardware and/or A combination of computer instructions is implemented.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Software Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Medical Informatics (AREA)
  • Databases & Information Systems (AREA)
  • Storage Device Security (AREA)

Abstract

一种数据加、解密方法、装置、设备及存储介质，涉及数据处理领域。该加密方法包括：根据原始数据的字节长度，确定补位字节长度（S101）；获取字节长度为补位字节长度的补位数据（S102）；按照预设的拼接规则，对原始数据和补位数据进行拼接，得到拼接数据（S103）；利用补位数据的至少部分字节对拼接数据中包括原始数据的部分字节进行异或运算，得到原始数据的加密数据（S104）。能够降低数据信息安全方面的风险。

Description

数据加、解密方法、装置、设备及存储介质
相关申请的交叉引用
本申请要求享有于2020年11月02日提交的名称为“数据加、解密方法、装置、设备及存储介质”的中国专利申请202011202674.1的优先权，该申请的全部内容通过引用并入本文中。
技术领域
本申请属于数据处理领域，尤其涉及一种数据加、解密方法、装置、设备及存储介质。
背景技术
随着信息技术的发展，越来越多的信息以数据的形式存储、传输。在数据中有一部分数据为敏感数据，敏感数据对应的信息可能会涉及到个人信息安全问题或社会信息安全问题。而在存储和传输的过程中，数据可能会发生泄露或被窥探。一旦敏感数据发生泄露或被窥探，会对信息安全带来非常大的风险。
发明内容
本申请实施例提供一种数据加、解密方法、装置、设备及存储介质，能够降低数据信息安全方面的风险。
第一方面，本申请实施例提供一种数据加密方法，包括：根据原始数据的字节长度，确定补位字节长度；获取字节长度为补位字节长度的补位数据；按照预设的拼接规则，对原始数据和补位数据进行拼接，得到拼接数据；利用补位数据的至少部分字节对拼接数据中包括原始数据的部分字节进行异或运算，得到原始数据的加密数据。
第二方面，本申请实施例提供一种数据解密方法，包括：基于预设的 拼接规则和加密数据，确定加密数据中补位数据包括的异或运算对象；利用异或运算对象，对加密数据中除异或运算对象外的其他字节进行异或运算，得到拼接数据；根据拼接规则和补位字节长度，确定拼接数据中加密数据的原始数据，补位字节长度为补位数据的字节长度。
第三方面，本申请实施例提供一种数据加密装置，包括：长度确定模块，用于根据原始数据的字节长度，确定补位字节长度；获取模块，用于获取字节长度为补位字节长度的补位数据；拼接模块，用于按照预设的拼接规则，对原始数据和补位数据进行拼接，得到拼接数据；运算模块，用于利用补位数据的至少部分字节对拼接数据中包括原始数据的部分字节进行异或运算，得到原始数据的加密数据。
第四方面，本申请实施例提供一种数据解密装置，包括：确定模块，用于基于预设的拼接规则和加密数据，确定加密数据中补位数据包括的异或运算对象；运算模块，用于利用异或运算对象，对加密数据中除异或运算对象外的其他字节进行异或运算，得到拼接数据；解密模块，用于根据拼接规则和补位字节长度，确定拼接数据中加密数据的原始数据，补位字节长度为补位数据的字节长度。
第五方面，本申请实施例提供一种数据加密设备，包括：处理器以及存储有计算机程序指令的存储器；处理器执行计算机程序指令时实现第一方面的数据加密方法。
第六方面，本申请实施例提供一种数据解密设备，包括：处理器以及存储有计算机程序指令的存储器；处理器执行计算机程序指令时实现第二方面的数据解密方法。
第七方面，本申请实施例提供一种计算机存储介质，计算机存储介质上存储有计算机程序指令，计算机程序指令被处理器执行时实现第一方面的数据加密方法和/或第二方面的数据解密方法。
本申请实施例提供一种数据加、解密方法、装置、设备及存储介质，可根据原始数据的字节长度，确定补位字节长度，以获取字节长度为补位字节长度的补位数据。按照拼接规则对原始数据和拼接数据进行拼接，形成新的数据即拼接数据。通过利用补位数据的至少部分字节对拼接数据中 包括原始数据的部分字节进行异或运算，得到原始数据中的加密数据。经过拼接，加密数据的字节长度与原始数据的字节长度不同。经过异或运算，加密数据中的字节的值相对于原始数据中的字节的值也发生了改变。在未知补位数据和拼接规则的情况下，很难破解本申请实施例生成的加密数据，即使发生泄露或被窥探，泄露的或被窥探的也是加密数据，能够根据加密数据得到原始数据的可能性非常小，从而降低了数据信息安全方面的风险。在需要将加密数据恢复为原始数据的情况下，也可通过数据解密方法反向解密得到原始数据。
附图说明
为了更清楚地说明本申请实施例的技术方案，下面将对本申请实施例中所需要使用的附图作简单的介绍，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为本申请第一方面提供的数据加密方法的一实施例的流程图；
图2为本申请第一方面提供的数据加密方法的另一实施例的流程图；
图3为本申请实施例提供的数据加密流程的一示例的流程图；
图4为本申请第二方面提供的数据解密方法的一实施例的流程图；
图5为本申请第二方面提供的数据解密方法的另一实施例的流程图；
图6为本申请第三方面提供的数据加密装置的一实施例的结构示意图；
图7为本申请第四方面提供的数据解密装置的一实施例的结构示意图；
图8为本申请第五方面提供的数据加密设备的一实施例的结构示意图；
图9为本申请第六方面提供的数据解密设备的一实施例的结构示意图。
具体实施方式
下面将详细描述本申请的各个方面的特征和示例性实施例，为了使本申请的目的、技术方案及优点更加清楚明白，以下结合附图及具体实施例，对本申请进行进一步详细描述。应理解，此处所描述的具体实施例仅意在解释本申请，而不是限定本申请。对于本领域技术人员来说，本申请可以在不需要这些具体细节中的一些细节的情况下实施。下面对实施例的描述仅仅是为了通过示出本申请的示例来提供对本申请更好的理解。
随着数据信息技术的发展，越来越多的信息以数据的方式存储、传输。在承载信息的数据中存在着大量的敏感数据，敏感数据指泄漏后可能会给社会或个人带来严重危害的数据。例如，敏感数据可包括但不限于姓名、身份证号码、住址、电话、银行账号、邮箱、密码等数据。但在数据的存储和传输过程中，数据可能会发生泄露或被窥探。一旦敏感数据发生泄露或被窥探，会对个人或社会的信息安全带来非常大的风险。
本申请提供了一种数据加、解密方法、装置、设备及存储介质，能够对数据进行加密，得到加密数据。由于加密数据难以破解，即使加密数据发生泄露或被窥探，能够得到原始数据的可能性也非常小，从而降低了敏感数据信息安全方面的风险。在某些特定需要恢复原始数据的场景中，可根据与本申请中数据加密方法对应的数据解密方法，根据加密数据解密恢复得到原始数据。
本申请第一方面提供了一种数据加密方法。图1为本申请第一方面提供的数据加密方法的一实施例的流程图。如图1所示，该数据加密方法可包括步骤S101至步骤S104。
在步骤S101中，根据原始数据的字节长度，确定补位字节长度。
原始数据可包括但不限于敏感数据。由于不同的原始数据对应的信息的内容不同，不同的原始数据的字节长度也有可能不同。为了能够统一化对原始数据进行加密，需要对原始数据进行补位，使得原始数据补位后的字节长度具有某种规律，便于处理。在一些示例中，原始数据补位后的字节长度为字节划分阈值的整数倍。字节划分阈值具体可与执行数据加密方法的装置如计算机的处理器一次可运行的数据的字节长度一致，在此并不限定。例如，字节划分阈值可为8。根据原始数据的长度，以原始数据的 补位后的字节长度为字节划分阈值的整数倍为目的，可确定补位字节长度。补位字节长度可视为补位数据的字节长度。
在一些示例中，原始数据的字节长度为字节划分阈值的整数倍，可将字节划分阈值确定为补位字节长度，从而避免冗余的补位数据，能够减少后续过程中的运算量，且节省加密数据的存储空间。
在另一些示例中，原始数据的字节长度不是字节划分阈值的整数倍，可通过预设的字节划分阈值和补位辅助字节阈值，根据原始数据的字节长度，计算得到补位字节长度。可计算原始数据的字节长度与字节划分阈值相除得到的余数。计算补位辅助字节阈值与余数的差值，将该差值作为补位字节长度。其中，补位辅助字节阈值大于字节划分阈值。具体地，补位字节长度可根据算式(1)计算得到：
N＝P-(L mod Q)          (1)
其中，N为补位字节长度，P为补位辅助字节阈值，L为原始数据的字节长度，Q为字节划分阈值，mod为取余数计算。补位辅助字节阈值和字节划分阈值可根据工作场景和工作需求设定，在此并不限定。例如，P＝16，Q＝8。
在一些示例中，通过上述补位字节长度的计算得到的补位字节长度最小为8，最大为15，能够避免原始数据补位后增加过多的冗余数据，即避免过多的无用数据掺杂在加密过程中，导致原始数据对应的加密数据的字节长度过长，从而能够保证利用本申请实施例中的数据加密方法得到的原始数据的加密数据占用的存储空间更小，且加密计算速度更快。
在步骤S102中，获取字节长度为补位字节长度的补位数据。
补位数据即为对原始数据进行补位所用的数据，可视为对数据加密所使用的加密种子。
在一些示例中，补位数据可为预设的补位数据集合中的一个满足补位字节长度的数据。补位数据集合可预先设定，补位数据集合包括至少一个数据。为了能够与不同字节长度的原始数据对应，补位数据集合可包括多个字节长度不同的数据。在根据原始数据的字节长度确定补位字节长度的情况下，可在补位数据集合中选取一个字节长度为补位字节长度的数据作 为该原始数据的补位数据。
在另一些示例中，补位数据中至少部分字节为随机生成的值。即补位数据可包括完全随机生成的数据，也可包括部分随机生成的数据。补位数据中至少部分字节为随机生成的值，可保证每次加密过程中使用的补位数据具有随机性，提高加密数据被破解的难度，从而进一步提高了加密数据的安全性。在补位数据包括部分随机生成的数据的情况下，可对补位数据中的部分字节有所要求，具体要求可根据工作场景和工作需求设定，在此并不限定。例如，补位数据中可包括表征补位字节长度的第一比特位。即补位数据中的第一比特位可表征该补位数据的补位字节长度，在此并不限定第一比特位在补位数据中的具***置以及补位数据中第一比特位的数目。例如，第一比特位可位于补位数据最右侧数目为字节划分阈值的字节内，即第一比特位可位于补位数据中数目为字节划分阈值的低位字节内。
下面以一具体示例来进行补位数据的说明。假设字节划分阈值为8，补位辅助字节阈值为16，原始数据为字符串“1234567”。通过美国信息交换标准代码(American Standard Code for Information Interchange，ASCII)表，可得到该字符串转换得到的十六进制数据“0x31323334353637”。其中，0x前缀为十六进制的标志。该字符串转换得到的十六进制数据“0x31323334353637”的字节长度为7，根据上述算式(1)可计算得到补位字节长度为9。可将补位数据中的位于最右的一个字节的低4比特作为第一比特位，即补位数据包括四个第一比特位。可将补位数据中位于最右的一个字节设为“0x09”、“0xA9”、0x39等，保证该字节中的第一比特位的值能够表征补位字节长度9。补位数据中的其他字节可随机生成，如生成的补位数据可为“0xA1B2C3D4E5F637A839”。
在步骤S103中，按照预设的拼接规则，对原始数据和补位数据进行拼接，得到拼接数据。
预设的拼接规则可预先写入执行该数据加密方法的装置内，在对数据加密的情况下，读取拼接规则，按照拼接规则对原始数据和补位数据进行拼接。原始数据和补位数据的拼接体即为拼接数据。每次对数据进行加密 的过程中所采用的拼接规则可以相同，也可不同，在此并不限定。
拼接规则用于表征原始数据与补位数据进行拼接的具体方法。例如，拼接规则可包括将补位数据拼接至原始数据的最右侧。又例如，拼接规则可包括将补位数据拼接至原始数据的最左侧。再例如，拼接规则可包括将原始数据分为第一部分和第二部分，将补位数据拼接至原始数据的第一部分与第二部分之间。还例如，拼接规则可包括将补位数据分为第一部分和第二部分，将补位数据的第一部分拼接至原始数据的最左侧，将补位数据的第二部分拼接至原始数据的最右侧。拼接规则的具体内容可根据工作场景和工作需求设定，在此并不限定。
在一些示例中，补位数据中可包括用于表征拼接规则的第二比特位。即补位数据中的第二比特位可表征该补位数据与原始数据的拼接规则，在此并不限定第二比特位在补位数据中的具***置、补位数据中第二比特位的数目以及第二比特位的值与拼接规则的对应关系。例如，可将补位数据中位于最右的一个字节的高4比特作为第二比特位，即补位数据包括四个第二比特位。在该4比特中最高比特位为1，表示将补位数据拼接至原始数据的最右侧；在该4比特中最高比特位为0，表示将补位数据进行了切分，切分方式由该4比特中的低3比特表示，该4比特中的低3比特为1**表示补位数据切分为两部分，分别拼接至原始数据的最左侧和最右侧，该4比特中的低3比特为01*表示补位数据切分为三部分，将原始数据切分为两部分，将补位数据的三部分分别拼接至原始数据的最左侧、原始数据两部分之间和原始数据的最右侧。*表示0、1中的任意一个数字，不同比特位上的*可表示不同的数字。
例如，原始数据为“0x31323334353637”，拼接数据为“0xFA31CBD2ECF32D34A9”，预设的拼接规则为将拼接数据拼接至原始数据的最右侧，则得到的拼接数据为“0x31323334353637FA31CBD2ECF32D34A9”。
在另一些示例中，拼接规则可为指定拼接规则，在每次对数据加密的过程中，按照该指定拼接规则，对原始数据和补位数据进行拼接。
在又一些示例中，拼接规则为根据原始数据和/或补位数据确定的规 则，即拼接规则可根据原始数据和/或补位数据动态确定。例如，在原始数据的字节长度为L 1的情况下，拼接规则为将补位数据拼接至原始数据的最右侧；在补位字节长度为N 1的情况下，拼接规则为将补位数据切分为两部分，并分别拼接至原始数据的最左侧和最右侧；在原始数据的字节长度为L 2且补位字节长度为N 2的情况下，拼接规则为将原始数据切分为两部分，将补位数据切分为三部分，将补位数据的三部分分别拼接至原始数据的最左侧、原始数据两部分之间和原始数据的最右侧。
在步骤S104中，利用补位数据的至少部分字节对拼接数据中包括原始数据的部分字节进行异或运算，得到原始数据的加密数据。
可利用补位数据中的所有字节对拼接数据中的原始数据的字节进行异或运算，得到原始数据的加密数据。也可以利用补位数据中的部分字节对拼接数据中的原始数据和拼接数据中补位数据中的另一部分字节进行异或运算，得到原始数据的加密数据。具体可根据原始数据和补位数据来确定进行异或运算的双方，在此并不限定。通过异或运算，改变拼接数据中的原始数据，经过异或运算后的拼接数据即为原始数据的加密数据。
在本申请实施例中，根据原始数据的字节长度，确定补位字节长度，以获取字节长度为补位字节长度的补位数据。按照拼接规则对原始数据和拼接数据进行拼接，形成新的数据即拼接数据。通过利用补位数据的至少部分字节对拼接数据中包括原始数据的部分字节进行异或运算，得到原始数据中的加密数据。经过拼接，加密数据的字节长度与原始数据的字节长度不同。经过异或运算，加密数据中的字节的值相对于原始数据中的字节的值也发生了改变。在未知补位数据和拼接规则的情况下，很难破解本申请实施例生成的加密数据，即使发生泄露或被窥探，泄露的或被窥探的也是加密数据，能够根据加密数据得到原始数据的可能性非常小，从而降低了数据信息安全方面的风险。
而且，本申请实施例中补位和异或运算所需要的计算量较小，与MD5、SM3、DES与3DES等加密算法相比更为简洁且计算量小。在相同的数据量的情况下，通过测试对比，本申请实施例中的数据加密方法的加密效率相对于MD5、SM3、DES与3DES等加密算法能够提高50倍以 上。本申请实施例中动态产生补位数据，并利用补位数据参与异或运算，在数据传输装置、数据存储装置中即可实现数据的加密，不需额外设置硬件加密设备，也不需要进行密钥管理，简化了数据加密所需的硬件设备，降低了数据加密所需的成本。
图2为本申请第一方面提供的数据加密方法的另一实施例的流程图。图2与图1的不同之处在于，图1中的步骤S104可具体细化为图2中的步骤S1041至步骤S1043。
在步骤S1041中，选取补位数据中数目为字节划分阈值的字节组成异或运算对象。
为了生成便于执行数据加密方法的装置处理的数据，可对拼接数据中数据为字节划分阈值的字节分别进行异或运算。异或运算需要至少两个对象参与，异或运算对象可为参与异或运算中的对象，参与异或运算的对象也可根据异或运算对象生成，在此并不限定。
具体选取补位数据中哪些字节组成异或运算对象可根据工作场景和工作需求设定，在此并不限定。例如，可选取补位数据中最右侧的数目为字节划分阈值的字节作为异或运算对象，即可选取补位数据中数目为字节划分阈值的低位字节组成异或运算对象。如字节划分阈值为8，补位数据为“0xFA31CBD2ECF32D34A9”，异或运算对象可为“0x31CBD2ECF32D34A9”。
在步骤S1042中，利用异或运算对象，对第一目标字节进行异或运算，得到异或运算后的第一目标字节。
第一目标字节包括拼接数据中除异或运算对象外的其他字节。
在原始数据的字节长度小于字节划分阈值的情况下，第一目标字节包括拼接数据中的原始数据和补位数据中除异或运算对象外的其他字节。对应地，利用异或运算对象，对原始数据和补位数据中除异或运算对象外的字节进行异或运算，得到异或运算后的第一目标字节。
在原始数据的字节长度等于字节划分阈值的情况下，第一目标字节包括拼接数据中的原始数据。对应地，利用异或运算对象，对原始数据进行异或运算，得到异或运算后的第一目标字节。
在原始数据的字节长度大于字节划分阈值的情况下，第一目标字节包括拼接数据中的原始数据，或者包括拼接数据中的原始数据和补位数据中除异或运算对象外的字节。按照拼接数据中第一目标字节的排列顺序，将第一目标字节划分为至少两组第一目标字节。一组第一目标字节包括数目为字节划分阈值的第一目标字节。利用异或运算对象，对每一组第一目标字节进行异或运算，得到异或运算后的每一组第一目标字节。
例如，字节划分阈值为8，补位辅助字节阈值为16，原始数据的十六进制为“0x313233343536374348494E41”，根据算式(1)计算得到补位字节长度为12，随机生成补位数据“0xAAB1CBD2ECF31D243E455F6C”。拼接规则为将补位数据拼接至原始数据的右侧，对应地，拼接数据为“0x313233343536374348494E41AAB1CBD2ECF31D243E455F6C”。选取补位数据中最右侧的8个字节作为异或运算对象，即异或运算对象为“0xECF31D243E455F6C”。第一目标字节包括“0x313233343536374348494E41AAB1CBD2”，将第一目标字节可划分为两组，一组包括“0x3132333435363743”，另一组包括“0x48494E41AAB1CBD2”。
在原始数据的字节长度大于字节划分阈值的情况下，第一目标字节可划分为M 1组，M 1为大于1的正整数。
在一些示例中，可分别对异或运算对象与每一组第一目标字节进行异或运算，得到异或运算后的每一组第一目标字节。即对异或运算对象与第一组第一目标字节进行异或运算，得到异或运算后的第一组第一目标字节；对异或运算对象与第二组第一目标字节进行异或运算，得到异或运算后的第二组第一目标字节；以此类推，直至对异或运算对象与第M 1组第一目标字节进行异或运算，得到异或运算后的第M 1组第一目标字节。
下面以一示例来进行说明，假设M 1＝2，拼接数据为“0x313233343536374348494E41AAB1CBD2ECF31D243E455F6C”，原始数据为“0x313233343536374348494E41”，补位数据为“0xAAB1CBD2ECF31D243E455F6C”。异或运算对象为 “0xECF31D243E455F6C”，一组第一目标字节包括“0x3132333435363743”，另一组第一目标字节包括“0x48494E41AAB1CBD2”。可将一组第一目标字节“0x3132333435363743”与异或运算对象“0xECF31D243E455F6C”进行异或运算，得到异或运算后的一组第一目标字节；将另一组第一目标字节“0x48494E41AAB1CBD2”与异或运算对象“0xECF31D243E455F6C”进行异或运算，得到异或运算后的另一组第一目标字节。
在另一些示例中，可对异或运算对象进行M 1-1次移位，得到M 1-1个移位后的异或运算对象。即每次移位得到一个移位后的异或运算对象。分别对异或运算对象和M 1-1个移位后的异或运算对象，与每一组第一目标字节进行异或运算，得到异或运算后的每一组第一目标字节。每次移位的步长可根据工作场景和工作需求设定，在此并不限定。为了进一步提高加密数据被破解的难度，每次移位的步长可为S比特，且S不能被8整除或不能被4整除。例如，每次移位的步长为1比特。移位的方向和方式也可根据工作场景和工作需求设定，在此并不限定。例如，移位可为顺序左移并在右补0或1，其中，0或1为补充的比特位的值。又例如，移位可为顺序右移并在左补0或1，其中，0或1为补充的比特位的值。再例如，移位可为循环左移或循环右移。
下面以一具体示例来进行说明，假设M 1＝2，拼接数据为“0x313233343536374348494E41AAB1CBD2ECF31D243E455F6C”，原始数据为“0x313233343536374348494E41”，补位数据为“0xAAB1CBD2ECF31D243E455F6C”。异或运算对象为“0xECF31D243E455F6C”，一组第一目标字节包括“0x3132333435363743”，另一组第一目标字节包括“0x48494E41AAB1CBD2”。移位为循环左移，每次移位的步长为1比特。对异或运算对象进行1次移位，得到移位后的异或运算对象“0xD9E63A487C8ABED9”。可将一组第一目标字节“0x3132333435363743”与异或运算对象“0xECF31D243E455F6C”进行异或运算，得到异或运算后的一组第一目标字节；将另一组第一目标字节 “0x48494E41AAB1CBD2”与移位后的异或运算对象“0xD9E63A487C8ABED9”进行异或运算，得到异或运算后的另一组第一目标字节。
通过对异或运算对象进行移位，以及利用移位后的异或运算对象对成组的第一目标字节进行异或运算，能够进一步提高加密数据被破解的难度，从而进一步降低数据信息安全方面的风险。
在步骤S1043中，基于拼接数据中字节的排列顺序，根据异或运算后的第一目标字节和异或运算对象，得到加密数据。
即异或运算后的第一目标字节和异或运算对象按照拼接数据中字节的排列顺序排列，得到加密数据。
在上述实施例中，确定补位字节长度、对数据进行拼接以及输出加密数据可通过补位器实现，即补位字节长度算法、拼接规则均可内置于补位器内。获取补位数据可通过种子生成器实现，补位数据生成算法可内置于种子生成器内。异或运算可通过异或器实现。移位可通过移位器实现。补位器、种子生成器、异或器和移位器可设置于执行本申请的数据加密方法的装置中。下面以字节划分阈值为8，原始数据的字节长度大于字节划分阈值8为一示例来进行说明。图3为本申请实施例提供的数据加密流程的一示例的流程图。如图3所示，该数据加密流程可包括步骤S201至步骤S215。
在步骤S201中，补位器根据原始数据的字节长度，确定补位字节长度。
在步骤S202中，补位器向种子生成器请求字节长度为补位字节长度的补位数据。
在步骤S203中，种子生成器生成补位数据。
在步骤S204中，种子生成器向补位器反馈补位数据。
在步骤S205中，补位器按照拼接规则，拼接原始数据和补位数据。
在步骤S206中，补位器向异或器发送按照拼接数据中排列顺序排列的第一组字节长度为8个字节的第一目标字节和8个字节的异或运算对象，请求异或器进行异或运算。
在步骤S207中，异或器对第一组第一目标字节和异或运算对象进行异或运算。
在步骤S208中，异或器向补位器反馈异或运算后的第一组第一目标字节。
在步骤S209中，补位器向移位器发送异或运算对象，请求移位器进行移位。
在步骤S210中，移位器对异或运算对象进行第一次移位，得到第一次移位后的异或运算对象。
在步骤S211中，移位器向补位器反馈第一次移位后的异或运算对象。
在步骤S212中，补位器向异或器发送按照拼接数据中排列顺序排列的第二组字节长度为8个字节的第一目标字节和第一次移位后的异或运算对象，请求异或器进行异或运算。
在步骤S213中，异或器对第二组第一目标字节和第一次移位后的异或运算对象进行异或运算。
在步骤S214中，异或器向补位器反馈异或运算后的第二组第一目标字节。
在拼接数据还包括第三组或更多组的第一目标字节的情况下，可重复上述步骤S209至步骤S214，移位器进行第二次或更多次的移位，异或器进行第二组或更多组第一目标字节与第二次或更多次的移位后的异或运算对象之间的异或运算。
在步骤S215中，补位器按照拼接数据中字节的排列顺序，根据得到的异或运算后的第一目标字节和异或运算对象，输出加密数据。
在一些特殊情况下，可能会需要将加密数据还原为原始数据。与数据加密方法对应，本申请还提供一种数据解密方法。执行数据解密方法的装置可与执行数据加密方法的装置为同一装置，也可为不同装置，在此并不限定。图4为本申请第二方面提供的数据解密方法的一实施例的流程图。如图4所示，该数据解密方法可包括步骤S301至步骤S303。
在步骤S301中，基于预设的拼接规则和加密数据，确定加密数据中 补位数据包括的异或运算对象。
这里的加密数据即为利用上述实施例中数据加密方法得到的加密数据。预设的拼接规则与上述实施例中数据加密方法中的拼接规则相同，加密方和解密方可预先约定。
加密数据中的异或运算对象并没有发生改变，根据拼接规则，可从加密数据中的补位数据中获取到异或运算对象。
在步骤S302中，利用异或运算对象，对加密数据中除异或运算对象外的其他字节进行异或运算，得到拼接数据。
加密数据中除异或运算对象外的其他字节是在数据加密过程中进行过异或运算的字节，利用与数据加密过程中相同的异或运算对象，对加密数据中除异或运算对象外的其他字节再次进行异或运算，将加密数据中除异或运算对象外的其他字节恢复至数据加密过程中异或运算前的字节。基于恢复至数据加密过程中异或运算前的字节和异或运算对象，即可得到拼接数据。拼接数据即为原始数据与补位数据拼接后的数据。
在步骤S303中，根据拼接规则和补位字节长度，确定拼接数据中加密数据的原始数据。
补位字节长度为补位数据的字节长度。根据补位字节长度和拼接规则，可确定补位数据。在一些示例中，在补位字节长度为字节划分阈值的情况下或在补位字节长度不是字节划分阈值的情况下，将拼接数据与补位字节长度的第一差值确定为原始数据的字节长度；根据拼接规则和原始数据的字节长度，确定拼接数据中原始数据，即拼接数据去除补位数据即可得到原始数据。在另一些示例中，在补位字节长度不是字节划分阈值的情况下，可计算补位辅助字节阈值与补位字节长度的第二差值；将第二差值作为原始数据的字节长度与字节划分阈值相除得到的余数，得到原始数据的字节长度；根据拼接规则和原始数据的字节长度，确定拼接数据中原始数据。具体地，可在已知补位字节长度、字节划分阈值和补位辅助字节阈值的情况下，根据上述实施例中的算式(1)以及加密数据长度的限制，计算得到原始数据的字节长度，从而得到原始数据。
在一些示例中，补位数据中可包括用于表征补位字节长度的第一比特 位。第一比特位可位于补位数据最右侧数目为字节划分阈值的字节内。在对数据进行解密过程中，可基于拼接规则，确定补位数据中第一比特位在加密数据中的位置。通过读取第一比特位的值，确定补位字节长度。例如，拼接规则为补位数据拼接至原始数据右侧，补位数据中位于最右的一个字节中的低4比特为第一比特位，补位数据中位于最右的一个字节为“0x09”，可确定补位字节长度为9。
在一些示例中，补位数据中包括用于表征拼接规则的第二比特位。用于执行数据解密方法的装置可预先设定第二比特位在加密数据中的位置，通过在加密数据中读取第二比特位的值，确定拼接规则。
上述字节划分阈值、补位辅助字节、异或运算对象、拼接规则、原始数据、加密数据等的具体内容可参见上述实施例中的相关说明，在此不再赘述。在一些示例中，字节划分阈值可为8，补位辅助字节阈值可为16。
在本申请实施例中，可基于采用上述实施例中数据加密方法得到的加密数据和拼接规则，确定异或运算对象。利用确定的异或运算对象，对加密数据中除异或运算对象外的其他字节进行异或运算，可恢复得到包括原始数据和补位数据的拼接数据。根据拼接规则和补位字节长度，可在拼接数据中得到原始数据，即恢复得到原始数据。但在没有预先约定拼接规则以及未知补位字节长度的情况下，是很难破解本申请实施例的加密数据的，数据的信息安全能够得到保障。
而且，采用MD5、SM3等算法的加密数据无法反向解密，在需要反向解密恢复出原始数据的情况下，MD5、SM3等算法并不适用。而本申请实施例的数据解密方法能够对上述实施例中的加密数据进行反向解密，恢复出原始数据。本申请实施例中的数据解密方法与DES、3DES等算法相比更为简洁且计算量小。在需要解密恢复原始数据的场景中，在相同的数据量的情况下，通过测试对比，本申请实施例中的数据解密方法的解密效率相对于DES与3DES等算法能够提高50倍以上。且在解密过程中，根据加密数据中可确定得到补位数据，不需要额外进行密钥管理，简化了数据解密所需的硬件设备，降低了数据机密所需的成本。
图5为本申请第二方面提供的数据解密方法的另一实施例的流程图。 图5与图4的不同之处在于，图4中的步骤S302可具体细化为图5中的步骤S3021和步骤S3022。
在步骤S3021中，利用异或运算对象，对第二目标字节进行异或运算，得到异或运算后的第二目标字节。
第二目标字节包括加密数据中除异或运算对象外的其他字节。
在加密数据的字节长度与补位字节长度的差值小于字节划分阈值的情况下，第二目标字节包括加密过程中经过异或运算后的原始数据和经过异或运算的补位数据中除异或运算对象外的其他字节。利用异或运算对象，对第二目标字节进行异或运算，得到异或运算后的第二目标字节。
在加密数据的字节长度与补位字节长度的差值等于字节划分阈值的情况下，第二目标字节包括加密过程中经过异或运算后的原始数据。利用异或运算对象，对第二目标字节进行异或运算，得到异或运算后的第二目标字节。
在加密数据的字节长度与补位字节长度的差值大于字节划分阈值的情况下，按照加密数据中第二目标字节的排列顺序，将第二目标字节划分为至少两组第二目标字节。一组第二目标字节包括数目为字节划分阈值的第二目标字节。利用异或运算对象，对每一组第二目标字节进行异或运算，得到异或运算后的每一组第二目标字节。
在加密数据的字节长度与补位字节长度的差值大于字节划分阈值的情况下，第一目标字节可划分为M 2组，M 2为大于1的正整数。
在一些示例中，分别对异或运算对象与每一组第二目标字节进行异或运算，得到异或运算后的每一组第二目标字节。即对异或运算对象与第一组第二目标字节进行异或运算，得到异或运算后的第一组第二目标字节；对异或运算对象与第二组第二目标字节进行异或运算，得到异或运算后的第二组第二目标字节；以此类推，直至对异或运算对象与第M 2组第二目标字节进行异或运算，得到异或运算后的第M 2组第二目标字节。
在另一些示例中，对异或运算对象进行M 2-1次移位，得到M 2-1个移位后的异或运算对象。即每次移位得到一个移位后的异或运算对象。分别对异或运算对象和M 2-1个移位后的异或运算对象，与每一组第二目标字 节进行异或运算，得到异或运算后的每一组第二目标字节。即对异或运算对象与第一组第二目标字节进行异或运算，得到异或运算后的第一组第二目标字节；对第一次移位后的异或运算对象与第二组第二目标字节进行异或运算，得到异或运算后的第二组第二目标字节；以此类推，直至对第M 2-1次移位后的异或运算对象与第M 2组第二目标字节进行异或运算，得到异或运算后的第M 2组第二目标字节。
移位的步长、方式、方向的具体内容可参见上述实施例中的相关说明，在此不再赘述。
在步骤S3022中，基于加密数据中第二目标字节的排列顺序，根据异或运算后的第二目标字节和异或运算对象，得到拼接数据。
即异或运算后的第二目标字节和异或运算对象按照加密数据中字节的排列顺序排列，得到拼接数据。
本申请第三方面提供一种数据加密装置。图6为本申请第三方面提供的数据加密装置的一实施例的结构示意图。如图6所示，该数据加密装置400可包括长度确定模块401、获取模块402、拼接模块403和运算模块404。
长度确定模块401可用于根据原始数据的字节长度，确定补位字节长度。
获取模块402用于获取字节长度为补位字节长度的补位数据。
拼接模块403用于按照预设的拼接规则，对原始数据和补位数据进行拼接，得到拼接数据。
运算模块404用于利用补位数据的至少部分字节对拼接数据中包括原始数据的部分字节进行异或运算，得到原始数据的加密数据。
在本申请实施例中，根据原始数据的字节长度，确定补位字节长度，以获取字节长度为补位字节长度的补位数据。按照拼接规则对原始数据和拼接数据进行拼接，形成新的数据即拼接数据。通过利用补位数据的至少部分字节对拼接数据中包括原始数据的部分字节进行异或运算，得到原始数据中的加密数据。经过拼接，加密数据的字节长度与原始数据的字节长度不同。经过异或运算，加密数据中的字节的值相对于原始数据中的字节 的值也发生了改变。在未知补位数据和拼接规则的情况下，很难破解本申请实施例生成的加密数据，即使发生泄露或被窥探，泄露的或被窥探的也是加密数据，能够根据加密数据得到原始数据的可能性非常小，从而降低了数据信息安全方面的风险。
而且，本申请实施例中补位和异或运算所需要的计算量较小，与MD5、SM3、DES与3DES等加密算法相比更为简洁且计算量小。在相同的数据量的情况下，通过测试对比，本申请实施例中的数据加密方法的加密效率相对于MD5、SM3、DES与3DES等加密算法能够提高50倍以上。本申请实施例中动态产生补位数据，并利用补位数据参与异或运算，在数据传输装置、数据存储装置中即可实现数据的加密，不需额外设置硬件加密设备，也不需要进行密钥管理，简化了数据加密所需的硬件设备，降低了数据加密所需的成本。
在一些示例中，上述长度确定模块401可用于：在原始数据的字节长度为字节划分阈值的整数倍的情况下，将字节划分阈值确定为补位字节长度。
在另一些示例中，上述长度确定模块401可用于：在原始数据的字节长度不是字节划分阈值的整数倍的情况下，计算原始数据的字节长度与字节划分阈值相除得到的余数；计算补位辅助字节阈值与余数的差值，将差值作为补位字节长度，补位辅助字节阈值大于字节划分阈值。
在一些示例中，字节划分阈值为8，补位辅助字节阈值为16。
在一些示例中，上述运算模块404用于：选取补位数据中数目为字节划分阈值的字节组成异或运算对象；利用异或运算对象，对第一目标字节进行异或运算，得到异或运算后的第一目标字节，第一目标字节包括拼接数据中除异或运算对象外的其他字节；基于拼接数据中字节的排列顺序，根据异或运算后的第一目标字节和异或运算对象，得到加密数据。
在一些示例中，上述运算模块404用于：选取补位数据最右侧数目为字节划分阈值的字节组成异或运算对象。
在一些示例中，上述运算模块404用于：在原始数据的字节长度大于字节划分阈值的情况下，按照拼接数据中第一目标字节的排列顺序，将第 一目标字节划分为至少两组第一目标字节，一组第一目标字节包括数目为字节划分阈值的第一目标字节；利用异或运算对象，对每一组第一目标字节进行异或运算，得到异或运算后的每一组第一目标字节。
具体地，第一目标字节划分为M 1组，M 1为大于1的正整数。上述运算模块404用于：分别对异或运算对象与每一组第一目标字节进行异或运算，得到异或运算后的每一组第一目标字节；或者，对异或运算对象进行M 1-1次移位，得到M 1-1个移位后的异或运算对象；分别对异或运算对象和M 1-1个移位后的异或运算对象，与每一组第一目标字节进行异或运算，得到异或运算后的每一组第一目标字节。
在一些示例中，补位数据中至少部分字节为随机生成的值。
在另一些示例中，补位数据为预设的补位数据集合中的一个满足补位字节长度的数据。
在一些示例中，补位数据中包括用于表征补位字节长度的第一比特位，第一比特位可位于补位数据最右侧数目为字节划分阈值的字节内。
在一些示例中，补位数据中包括用于表征拼接规则的第二比特位。
在一些示例中，拼接规则为指定拼接规则，
在另一些示例中，拼接规则为根据原始数据和/或补位数据确定的规则。
本申请第四方面提供一种数据解密装置。图7为本申请第四方面提供的数据解密装置的一实施例的结构示意图。如图7所示，该数据解密装置500可包括确定模块501、运算模块502和解密模块503。
确定模块501可用于基于预设的拼接规则和加密数据，确定加密数据中补位数据包括的异或运算对象。
运算模块502可用于利用异或运算对象，对加密数据中除异或运算对象外的其他字节进行异或运算，得到拼接数据。
解密模块503可用于根据拼接规则和补位字节长度，确定拼接数据中加密数据的原始数据。
补位字节长度为补位数据的字节长度。
在本申请实施例中，可基于采用上述实施例中数据加密方法得到的加 密数据和拼接规则，确定异或运算对象。利用确定的异或运算对象，对加密数据中除异或运算对象外的其他字节进行异或运算，可恢复得到包括原始数据和补位数据的拼接数据。根据拼接规则和补位字节长度，可在拼接数据中得到原始数据，即恢复得到原始数据。但在没有预先约定拼接规则以及未知补位字节长度的情况下，是很难破解本申请实施例的加密数据的，数据的信息安全能够得到保障。
在一些示例中，上述解密模块503可用于：在补位字节长度为字节划分阈值的情况下，将拼接数据与补位字节长度的第一差值确定为原始数据的字节长度；根据拼接规则和原始数据的字节长度，确定拼接数据中原始数据。
在另一些示例中，上述解密模块503可用于：在补位字节长度不是字节划分阈值的情况下，计算补位辅助字节阈值与补位字节长度的第二差值；将第二差值作为原始数据的字节长度与字节划分阈值相除得到的余数，得到原始数据的字节长度；根据拼接规则和原始数据的字节长度，确定拼接数据中原始数据。
在一些示例中，字节划分阈值为8，补位辅助字节阈值为16。
在一些示例中，上述运算模块502可用于：利用异或运算对象，对第二目标字节进行异或运算，得到异或运算后的第二目标字节，第二目标字节包括加密数据中除异或运算对象外的其他字节；基于加密数据中第二目标字节的排列顺序，根据异或运算后的第二目标字节和异或运算对象，得到拼接数据。
在一些示例中，上述运算模块502可用于：在加密数据的字节长度与补位字节长度的差值大于字节划分阈值的情况下，按照加密数据中第二目标字节的排列顺序，将第二目标字节划分为至少两组第二目标字节，一组第二目标字节包括数目为字节划分阈值的第二目标字节；利用异或运算对象，对每一组第二目标字节进行异或运算，得到异或运算后的每一组第二目标字节。
具体地，第一目标字节划分为M 2组，M 2为大于1的正整数。上述运算模块502可用于：分别对异或运算对象与每一组第二目标字节进行异或 运算，得到异或运算后的每一组第二目标字节；或者，对异或运算对象进行M 2-1次移位，得到M 2-1个移位后的异或运算对象；分别对异或运算对象和M 2-1个移位后的异或运算对象，与每一组第二目标字节进行异或运算，得到异或运算后的每一组第二目标字节。
在一些示例中，补位数据中包括用于表征补位字节长度的第一比特位。第一比特位可位于补位数据最右侧数目为字节划分阈值的字节内。
在一些示例中，补位数据中包括用于表征拼接规则的第二比特位。
上述实施例中的数据加密装置和数据解密装置可为同一装置或不同装置，在此并不限定。
本申请第五方面提供了一种数据加密设备。图8为本申请第五方面提供的数据加密设备的一实施例的结构示意图。如图8所示，数据加密设备600包括存储器601、处理器602及存储在存储器601上并可在处理器602上运行的计算机程序。
在一个示例中，上述处理器602可以包括中央处理器(CPU)，或者特定集成电路(Application Specific Integrated Circuit，ASIC)，或者可以被配置成实施本申请实施例的一个或多个集成电路。
存储器601可包括只读存储器(Read-Only Memory，ROM)，随机存取存储器(Random Access Memory，RAM)，磁盘存储介质设备，光存储介质设备，闪存设备，电气、光学或其他物理/有形的存储器存储设备。因此，通常，存储器包括一个或多个编码有包括计算机可执行指令的软件的有形(非暂态)计算机可读存储介质(例如，存储器设备)，并且当该软件被执行(例如，由一个或多个处理器)时，其可操作来执行参考根据本申请实施例中数据加密方法所描述的操作。
处理器602通过读取存储器601中存储的可执行程序代码来运行与可执行程序代码对应的计算机程序，以用于实现上述实施例中的数据加密方法。
在一个示例中，数据加密设备600还可包括通信接口603和总线604。其中，如图8所示，存储器601、处理器602、通信接口603通过总线604连接并完成相互间的通信。
通信接口603，主要用于实现本申请实施例中各模块、装置、单元和/或设备之间的通信。也可通过通信接口603接入输入设备和/或输出设备。
总线604包括硬件、软件或两者，将数据加密设备600的部件彼此耦接在一起。举例来说而非限制，总线604可包括加速图形端口(Accelerated Graphics Port，AGP)或其他图形总线、增强工业标准架构(Enhanced Industry Standard Architecture，EISA)总线、前端总线(Front Side Bus，FSB)、超传输(HyperTransport，HT)互连、工业标准架构(Industrial Standard Architecture，ISA)总线、无限带宽互连、低引脚数(Low pin count，LPC)总线、存储器总线、微信道架构(MicroChannel Architecture，MCA)总线、***组件互连(Peripheral Component Interconnect，PCI)总线、PCI-Express(PCI-X)总线、串行高级技术附件(Serial Advanced Technology Attachment，SATA)总线、视频电子标准协会局部(Video Electronics Standards Association Local Bus，VLB)总线或其他合适的总线或者两个或更多个以上这些的组合。在合适的情况下，总线604可包括一个或多个总线。尽管本申请实施例描述和示出了特定的总线，但本申请考虑任何合适的总线或互连。
本申请第六方面提供了一种数据解密设备。图9为本申请第六方面提供的数据解密设备的一实施例的结构示意图。如图9所示，数据解密设备700包括存储器701、处理器702及存储在存储器701上并可在处理器702上运行的计算机程序。
在一个示例中，上述处理器702可以包括中央处理器(CPU)，或者特定集成电路(Application Specific Integrated Circuit，ASIC)，或者可以被配置成实施本申请实施例的一个或多个集成电路。
存储器701可包括只读存储器(Read-Only Memory，ROM)，随机存取存储器(Random Access Memory，RAM)，磁盘存储介质设备，光存储介质设备，闪存设备，电气、光学或其他物理/有形的存储器存储设备。因此，通常，存储器包括一个或多个编码有包括计算机可执行指令的软件的有形(非暂态)计算机可读存储介质(例如，存储器设备)，并且当该 软件被执行(例如，由一个或多个处理器)时，其可操作来执行参考根据本申请实施例中数据解密方法所描述的操作。
处理器702通过读取存储器701中存储的可执行程序代码来运行与可执行程序代码对应的计算机程序，以用于实现上述实施例中的数据解密方法。
在一个示例中，数据解密设备700还可包括通信接口703和总线
704。其中，如图9所示，存储器701、处理器702、通信接口703通过总线704连接并完成相互间的通信。
通信接口703，主要用于实现本申请实施例中各模块、装置、单元和/或设备之间的通信。也可通过通信接口703接入输入设备和/或输出设备。
总线704包括硬件、软件或两者，将数据解密设备700的部件彼此耦接在一起。举例来说而非限制，总线704可包括加速图形端口(Accelerated Graphics Port，AGP)或其他图形总线、增强工业标准架构(Enhanced Industry Standard Architecture，EISA)总线、前端总线(Front Side Bus，FSB)、超传输(HyperTransport，HT)互连、工业标准架构(Industrial Standard Architecture，ISA)总线、无限带宽互连、低引脚数(Low pin count，LPC)总线、存储器总线、微信道架构(MicroChannel Architecture，MCA)总线、***组件互连(Peripheral Component Interconnect，PCI)总线、PCI-Express(PCI-X)总线、串行高级技术附件(Serial Advanced Technology Attachment，SATA)总线、视频电子标准协会局部(Video Electronics Standards Association Local Bus，VLB)总线或其他合适的总线或者两个或更多个以上这些的组合。在合适的情况下，总线704可包括一个或多个总线。尽管本申请实施例描述和示出了特定的总线，但本申请考虑任何合适的总线或互连。
上述实施例中的数据加密设备和数据解密设备可为同一设备或不同设备，在此并不限定。
本申请实施例还提供一种计算机可读存储介质，该计算机可读存储介质上存储有计算机程序，该计算机程序被处理器执行时可实现上述实施例中的数据加密方法和/或数据解密方法，且能达到相同的技术效果，为避免 重复，这里不再赘述。其中，上述计算机可读存储介质可包括非暂态计算机可读存储介质，如只读存储器(Read-Only Memory，简称ROM)、随机存取存储器(Random Access Memory，简称RAM)、磁碟或者光盘等，在此并不限定。
需要明确的是，本说明书中的各个实施例均采用递进的方式描述，各个实施例之间相同或相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。对于装置实施例、设备实施例、计算机可读存储介质实施例而言，相关之处可以参见方法实施例的说明部分。本申请并不局限于上文所描述并在图中示出的特定步骤和结构。本领域的技术人员可以在领会本申请的精神之后，作出各种改变、修改和添加，或者改变步骤之间的顺序。并且，为了简明起见，这里省略对已知方法技术的详细描述。
上面参考根据本申请的实施例的方法、装置(***)和计算机程序产品的流程图和/或框图描述了本申请的各方面。应当理解，流程图和/或框图中的每个方框以及流程图和/或框图中各方框的组合可以由计算机程序指令实现。这些计算机程序指令可被提供给通用计算机、专用计算机、或其它可编程数据处理装置的处理器，以产生一种机器，使得经由计算机或其它可编程数据处理装置的处理器执行的这些指令使能对流程图和/或框图的一个或多个方框中指定的功能/动作的实现。这种处理器可以是但不限于是通用处理器、专用处理器、特殊应用处理器或者现场可编程逻辑电路。还可理解，框图和/或流程图中的每个方框以及框图和/或流程图中的方框的组合，也可以由执行指定的功能或动作的专用硬件来实现，或可由专用硬件和计算机指令的组合来实现。
本领域技术人员应能理解，上述实施例均是示例性而非限制性的。在不同实施例中出现的不同技术特征可以进行组合，以取得有益效果。本领域技术人员在研究附图、说明书及权利要求书的基础上，应能理解并实现所揭示的实施例的其他变化的实施例。在权利要求书中，术语“包括”并不排除其他装置或步骤；数量词“一个”不排除多个；术语“第一”、“第二”用于标示名称而非用于表示任何特定的顺序。权利要求中的任何 附图标记均不应被理解为对保护范围的限制。权利要求中出现的多个部分的功能可以由一个单独的硬件或软件模块来实现。某些技术特征出现在不同的从属权利要求中并不意味着不能将这些技术特征进行组合以取得有益效果。

Claims (22)

  1. 一种数据加密方法，包括：
    根据原始数据的字节长度，确定补位字节长度；
    获取字节长度为所述补位字节长度的补位数据；
    按照预设的拼接规则，对所述原始数据和所述补位数据进行拼接，得到拼接数据；
    利用所述补位数据的至少部分字节对所述拼接数据中包括原始数据的部分字节进行异或运算，得到所述原始数据的加密数据。
  2. 根据权利要求1所述的方法，其中，所述根据原始数据的字节长度，确定补位字节长度，包括：
    在所述原始数据的字节长度为字节划分阈值的整数倍的情况下，将所述字节划分阈值确定为所述补位字节长度；
    在所述原始数据的字节长度不是所述字节划分阈值的整数倍的情况下，计算所述原始数据的字节长度与所述字节划分阈值相除得到的余数；计算补位辅助字节阈值与所述余数的差值，将所述差值作为所述补位字节长度，所述补位辅助字节阈值大于所述字节划分阈值。
  3. 根据权利要求2所述的方法，其中，所述字节划分阈值为8，所述补位辅助字节阈值为16。
  4. 根据权利要求2所述的方法，其中，所述利用所述补位数据的至少部分字节对所述拼接数据中包括原始数据的部分字节进行异或运算，得到所述原始数据的加密数据，包括：
    选取所述补位数据中数目为所述字节划分阈值的字节组成异或运算对象；
    利用所述异或运算对象，对第一目标字节进行异或运算，得到异或运算后的所述第一目标字节，所述第一目标字节包括所述拼接数据中除所述异或运算对象外的其他字节；
    基于所述拼接数据中字节的排列顺序，根据异或运算后的所述第一目标字节和所述异或运算对象，得到所述加密数据。
  5. 根据权利要求4所述的方法，其中，所述选取所述补位数据中数目为所述字节划分阈值的字节组成异或运算对象，包括：
    选取所述补位数据最右侧数目为所述字节划分阈值的字节组成所述异或运算对象。
  6. 根据权利要求4所述的方法，其中，所述利用所述异或运算对象，对第一目标字节进行异或运算，得到异或运算后的所述第一目标字节，包括：
    在所述原始数据的字节长度大于所述字节划分阈值的情况下，按照所述拼接数据中所述第一目标字节的排列顺序，将所述第一目标字节划分为至少两组所述第一目标字节，一组所述第一目标字节包括数目为字节划分阈值的所述第一目标字节；
    利用所述异或运算对象，对每一组所述第一目标字节进行异或运算，得到异或运算后的每一组所述第一目标字节。
  7. 根据权利要求6所述的方法，其中，所述第一目标字节划分为M 1组，M 1为大于1的正整数，
    所述根据所述异或运算对象与每一组所述第一目标字节，通过异或运算，得到异或运算后的每一组所述第一目标字节，包括：
    分别对所述异或运算对象与每一组所述第一目标字节进行异或运算，得到异或运算后的每一组所述第一目标字节；
    或者，
    对所述异或运算对象进行M 1-1次移位，得到M 1-1个移位后的所述异或运算对象；分别对所述异或运算对象和M 1-1个移位后的所述异或运算对象，与每一组所述第一目标字节进行异或运算，得到异或运算后的每一组所述第一目标字节。
  8. 根据权利要求1所述的方法，其中，
    所述补位数据中至少部分字节为随机生成的值；
    或者，
    所述补位数据为预设的补位数据集合中的一个满足所述补位字节长度的数据。
  9. 根据权利要求1所述的方法，其中，
    所述补位数据中包括用于表征所述补位字节长度的第一比特位，所述第一比特位位于所述补位数据最右侧数目为所述字节划分阈值的字节内；
    所述补位数据中包括用于表征所述拼接规则的第二比特位。
  10. 根据权利要求1所述的方法，其中，
    所述拼接规则为指定拼接规则，
    或者，
    所述拼接规则为根据所述原始数据和/或补位数据确定的规则。
  11. 一种数据解密方法，包括：
    基于预设的拼接规则和加密数据，确定所述加密数据中补位数据包括的异或运算对象；
    利用所述异或运算对象，对所述加密数据中除所述异或运算对象外的其他字节进行异或运算，得到拼接数据；
    根据所述拼接规则和补位字节长度，确定所述拼接数据中所述加密数据的原始数据，所述补位字节长度为所述补位数据的字节长度。
  12. 根据权利要求11所述的方法，其中，所述根据所述拼接规则和补位字节长度，确定所述拼接数据中所述加密数据的原始数据，包括：
    在所述补位字节长度为所述字节划分阈值的情况下，将所述拼接数据与所述补位字节长度的第一差值确定为所述原始数据的字节长度；根据所述拼接规则和所述原始数据的字节长度，确定所述拼接数据中所述原始数据；
    在所述补位字节长度不是所述字节划分阈值的情况下，计算补位辅助字节阈值与所述补位字节长度的第二差值；将所述第二差值作为所述原始数据的字节长度与字节划分阈值相除得到的余数，得到所述原始数据的字节长度；根据所述拼接规则和所述原始数据的字节长度，确定所述拼接数据中所述原始数据。
  13. 根据权利要求12所述的方法，其中，所述字节划分阈值为8，所述补位辅助字节阈值为16。
  14. 根据权利要求12所述的方法，其中，所述利用所述异或运算对 象，对所述加密数据中除所述异或运算对象外的其他字节进行异或运算，得到拼接数据，包括：
    利用所述异或运算对象，对第二目标字节进行异或运算，得到异或运算后的第二目标字节，所述第二目标字节包括所述加密数据中除所述异或运算对象外的其他字节；
    基于所述加密数据中所述第二目标字节的排列顺序，根据异或运算后的所述第二目标字节和所述异或运算对象，得到所述拼接数据。
  15. 根据权利要求14所述的方法，其中，所述利用所述异或运算对象，对第二目标字节进行异或运算，得到异或运算后的第二目标字节，包括：
    在所述加密数据的字节长度与补位字节长度的差值大于所述字节划分阈值的情况下，按照所述加密数据中所述第二目标字节的排列顺序，将所述第二目标字节划分为至少两组所述第二目标字节，一组所述第二目标字节包括数目为字节划分阈值的所述第二目标字节；
    利用所述异或运算对象，对每一组所述第二目标字节进行异或运算，得到异或运算后的每一组所述第二目标字节。
  16. 根据权利要求15所述的方法，其中，所述第一目标字节划分为M 2组，M 2为大于1的正整数，
    所述利用所述异或运算对象，对每一组所述第二目标字节进行异或运算，得到异或运算后的每一组所述第二目标字节，包括：
    分别对所述异或运算对象与每一组所述第二目标字节进行异或运算，得到异或运算后的每一组所述第二目标字节；
    或者，
    对所述异或运算对象进行M 2-1次移位，得到M 2-1个移位后的所述异或运算对象；分别对所述异或运算对象和M 2-1个移位后的所述异或运算对象，与每一组所述第二目标字节进行异或运算，得到异或运算后的每一组所述第二目标字节。
  17. 根据权利要求11所述的方法，其中，
    所述补位数据中包括用于表征所述补位字节长度的第一比特位，所述 第一比特位位于所述补位数据最右侧数目为所述字节划分阈值的字节内；
    所述补位数据中包括用于表征所述拼接规则的第二比特位。
  18. 一种数据加密装置，包括：
    长度确定模块，用于根据原始数据的字节长度，确定补位字节长度；
    获取模块，用于获取字节长度为所述补位字节长度的补位数据；
    拼接模块，用于按照预设的拼接规则，对所述原始数据和所述补位数据进行拼接，得到拼接数据；
    运算模块，用于利用所述补位数据的至少部分字节对所述拼接数据中包括原始数据的部分字节进行异或运算，得到所述原始数据的加密数据。
  19. 一种数据解密装置，包括：
    确定模块，用于基于预设的拼接规则和加密数据，确定所述加密数据中补位数据包括的异或运算对象；
    运算模块，用于利用所述异或运算对象，对所述加密数据中除所述异或运算对象外的其他字节进行异或运算，得到拼接数据；
    解密模块，用于根据所述拼接规则和补位字节长度，确定所述拼接数据中所述加密数据的原始数据，所述补位字节长度为所述补位数据的字节长度。
  20. 一种数据加密设备，包括：处理器以及存储有计算机程序指令的存储器；
    所述处理器执行所述计算机程序指令时实现如权利要求1至10中任意一项所述的数据加密方法。
  21. 一种数据解密设备，包括：处理器以及存储有计算机程序指令的存储器；
    所述处理器执行所述计算机程序指令时实现如权利要求11至17中任意一项所述的数据解密方法。
  22. 一种计算机存储介质，所述计算机存储介质上存储有计算机程序指令，所述计算机程序指令被处理器执行时实现如权利要求1至10中任意一项所述的数据加密方法和/或如权利要求11至17中任意一项所述的数据解密方法。
PCT/CN2021/117032 2020-11-02 2021-09-07 数据加、解密方法、装置、设备及存储介质 WO2022089014A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011202674.1A CN112464258B (zh) 2020-11-02 2020-11-02 数据加、解密方法、装置、设备及存储介质
CN202011202674.1 2020-11-02

Publications (1)

Publication Number Publication Date
WO2022089014A1 true WO2022089014A1 (zh) 2022-05-05

Family

ID=74835766

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/117032 WO2022089014A1 (zh) 2020-11-02 2021-09-07 数据加、解密方法、装置、设备及存储介质

Country Status (2)

Country Link
CN (1) CN112464258B (zh)
WO (1) WO2022089014A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115834027A (zh) * 2023-01-06 2023-03-21 浪潮电子信息产业股份有限公司 一种消息填充方法、装置、设备及计算机可读存储介质
CN116628758A (zh) * 2023-07-21 2023-08-22 北京信安世纪科技股份有限公司 数据处理方法、装置、***及电子设备

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112464258B (zh) * 2020-11-02 2024-03-19 ***股份有限公司 数据加、解密方法、装置、设备及存储介质
CN115171247A (zh) * 2022-06-24 2022-10-11 广东汇泰龙科技股份有限公司 一种智能锁、存储方法、解密方法及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101895389A (zh) * 2010-07-16 2010-11-24 黑龙江大学 采用比例计算的基于组合编码的文件加密和解密的方法
CN102437910A (zh) * 2011-10-18 2012-05-02 国家超级计算深圳中心(深圳云计算中心) 数据加/解密校验方法及其***
CN105897402A (zh) * 2016-04-05 2016-08-24 乐视控股（北京）有限公司 参数加密方法、装置
US20170264598A1 (en) * 2010-12-02 2017-09-14 Rene-Michael Cordes Method and apparatus for performing symmetrical stream encryption of data
CN112464258A (zh) * 2020-11-02 2021-03-09 ***股份有限公司 数据加、解密方法、装置、设备及存储介质

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2003023421A (ja) * 2001-07-09 2003-01-24 C4 Technology Inc 暗号方法、そのプログラム、そのプログラムを記録した記録媒体および暗号装置並びに復号方法および復号装置
JP2013255157A (ja) * 2012-06-08 2013-12-19 Renesas Electronics Corp データ処理装置及び検証処理プログラム
CN102761557B (zh) * 2012-07-31 2016-02-24 飞天诚信科技股份有限公司 一种终端设备认证方法及装置
CN107292197B (zh) * 2017-06-29 2020-02-07 北京京东尚科信息技术有限公司 数据加密方法、解密方法、加密装置和解密装置
CN109660328A (zh) * 2018-12-26 2019-04-19 中金金融认证中心有限公司 对称块加密方法、装置、设备及介质
CN110545257B (zh) * 2019-07-22 2022-02-25 北京航盛新能科技有限公司 一种汽车can总线加密方法
CN110545176B (zh) * 2019-08-23 2021-08-13 深圳数联天下智能科技有限公司 加密和解密方法、装置以及物联网***

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101895389A (zh) * 2010-07-16 2010-11-24 黑龙江大学 采用比例计算的基于组合编码的文件加密和解密的方法
US20170264598A1 (en) * 2010-12-02 2017-09-14 Rene-Michael Cordes Method and apparatus for performing symmetrical stream encryption of data
CN102437910A (zh) * 2011-10-18 2012-05-02 国家超级计算深圳中心(深圳云计算中心) 数据加/解密校验方法及其***
CN105897402A (zh) * 2016-04-05 2016-08-24 乐视控股（北京）有限公司 参数加密方法、装置
CN112464258A (zh) * 2020-11-02 2021-03-09 ***股份有限公司 数据加、解密方法、装置、设备及存储介质

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115834027A (zh) * 2023-01-06 2023-03-21 浪潮电子信息产业股份有限公司 一种消息填充方法、装置、设备及计算机可读存储介质
CN116628758A (zh) * 2023-07-21 2023-08-22 北京信安世纪科技股份有限公司 数据处理方法、装置、***及电子设备
CN116628758B (zh) * 2023-07-21 2023-09-22 北京信安世纪科技股份有限公司 数据处理方法、装置、***及电子设备

Also Published As

Publication number Publication date
CN112464258B (zh) 2024-03-19
CN112464258A (zh) 2021-03-09

Similar Documents

Publication Publication Date Title
WO2022089014A1 (zh) 数据加、解密方法、装置、设备及存储介质
US11757656B2 (en) Efficient post-quantum anonymous attestation with signature-based join protocol and unlimited signatures
CN108463968B (zh) 可变长度数据的快速格式保留加密
US20220166771A1 (en) Mts-based mutual-authenticated remote attestation
CN110417726A (zh) 一种密钥管理方法及相关设备
US9219602B2 (en) Method and system for securely computing a base point in direct anonymous attestation
Bao et al. A new chaotic system for image encryption
CN107004084B (zh) 用于加密操作的乘法掩码
CN112152786A (zh) 无签名扩展的快速xmss签名验证和临时数采样过程
JP6735926B2 (ja) 暗号化装置、復号装置、暗号化方法、復号方法、暗号化プログラム及び復号プログラム
JP2022533950A (ja) 準群演算を含む暗号化データに対して等価演算および未満演算を実行するシステムおよび方法
Cortez et al. Cryptographic randomness test of the modified hashing function of SHA256 to address length extension attack
CN110213050B (zh) 密钥生成方法、装置及存储介质
US11165758B2 (en) Keystream generation using media data
WO2023093278A1 (zh) 数字签名门限方法和装置
WO2020044485A1 (ja) メッセージ認証装置、メッセージ認証方法及びメッセージ認証プログラム
CN112653547B (zh) 用于处理输入数据的设备和方法、车辆和存储介质
CN115883212A (zh) 信息处理方法、装置、电子设备和存储介质
JP6305658B1 (ja) メッセージ認証子生成装置
CN115473649A (zh) 攻击椭圆曲线签名算法的方法、装置、设备及存储介质
JP2011259389A (ja) メッセージ認証子生成装置、メッセージ認証子検証装置、メッセージ認証子生成方法、メッセージ認証子検証方法、およびプログラム
JP5436373B2 (ja) 秘匿性増強処理演算装置およびこれを備えた量子暗号通信端末
CN109450618B (zh) 一种基于md5的加密方法及***
Liu et al. A parallel encryption algorithm for dual-core processor based on chaotic map
TWI776416B (zh) 分層確定性錢包的門檻式簽章系統及其方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21884744

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21884744

Country of ref document: EP

Kind code of ref document: A1