CN115834201A - Data encryption method, data decryption method and data processing method for data storage system - Google Patents

Abstract

The invention relates to a data encryption method for a data storage system, which comprises the following steps: segmenting original data to be encrypted into data segments with unequal lengths (S1); inserting a string of fixed length characters in front of each data segment (S2); inserting a marker character at the end of each data segment (S3); generating a correspondence matrix based on the order of the data segments and the inserted characters (S4); encrypting (S5) the generated correspondence matrix; the sequence of the data segments is adjusted and spliced, and the adjusted data segments and the encrypted correspondence matrix are stored (S6). The invention also relates to a data decryption method for a data storage system, a data processing method for a data storage system and a computer program product for performing the method. In the embodiment of the invention, the encryption of the original data segment with larger data volume is replaced by the encryption of the corresponding matrix with smaller data volume, so that the calculation amount and occupied resources of data encryption can be effectively reduced.

Description

Data encryption method, decryption method and processing method for data storage system

technical field

The present invention relates to the field of vehicles, in particular to a data encryption method for a data storage system, a data decryption method for a data storage system, a data processing method for a data storage system and a method for performing the above Method computer program product.

Background technique

In the field of vehicles, it may be necessary to collect and store a large amount of data. For example, the event data recording device of the vehicle is used to record collision events and relevant data of the vehicle when there is a risk of collision. For vehicles with high-level driver assistance and/or automatic driving functions, it is also equipped with an automatic driving vehicle data recording system to record all data related to high-level driver assistance functions and/or automatic driving functions. The data to be recorded by the autonomous vehicle data recording system includes not only the decision-making and control signals sent by the system, vehicle dynamics and body state signals, but also video and/or image data. Generally speaking, encrypting the data stored in the vehicle can protect the security of national surveying and mapping information, personal information, and patent rights for vehicle control to a certain extent.

However, the amount of video and/or image data is far greater than the amount of relevant data such as decision-making and control signals, vehicle dynamics, and body state signals sent by the system. For example, if 2500 times of 40s are stored at 4Hz, the relevant data such as decision-making and control signals, vehicle dynamics, and body state signals usually do not exceed 100MB, while video and/or image data of 40s once It may reach the 100MB level. At the same time, due to the limited resources of the hardware and/or software security module, encrypting a large amount of data will have a great impact on the application and architecture of the hardware and/or software security module. For example, if it takes 6 seconds to encrypt 2MB of data under a certain car architecture, then the hardware and/or software security module may not be able to process other encryption requirements synchronously within these 6 seconds. If the data volume of each trigger event including video and/or pictures may reach 100MB level, this makes even hardware and/or software security modules capable of processing encryption requests synchronously, because of the required If the time is too long, there will be a power outage and/or the car is powered off while the data is still being processed in the hardware and/or software security module, resulting in the risk of unwritten data loss and/or other driving safety risks.

Therefore, how to efficiently encrypt the data of the data storage system of the vehicle, especially the data recording system of the automatic driving vehicle, has become a common technical difficulty at present.

Contents of the invention

The object of the present invention is to provide a data encryption method for a data storage system, a data decryption method for a data storage system, a data processing method for a data storage system and a method for performing the above method A computer program product to solve problems in the prior art. The core idea of the present invention is: segment the original data to be encrypted into non-equal-length data segments; respectively insert characters and mark characters before and after each data segment, wherein the mark characters can mark segment nodes and/or method; the original order of the segmented data segments is associated with the characters inserted before the data segments, and a corresponding matrix is generated based on the original order of the segmented data segments and the inserted characters, and the generated corresponding matrix is encrypted, The order of the segmented data segments with inserted characters and marked characters is disturbed, and all the processed non-equal-length data segments are spliced into one and/or several data segments. The original data (plaintext) cannot be generated only based on the adjusted one and/or certain several data segments, so that the data encryption process can be completed by encrypting the corresponding matrix with a smaller data volume. In the embodiment of the present invention, by encrypting the corresponding matrix with only a small amount of data instead of encrypting the original data with a large amount of data, the calculation amount of data encryption and the resources occupied by it can be effectively reduced, Therefore, the resources of the hardware and/or software security module are not occupied for a long time and/or high bandwidth, and at the same time, the requirement of the data storage system for storing data to be encrypted can be met.

According to a first aspect of the present invention, a data encryption method for a data storage system is provided. Described data encryption method comprises the following steps:

Step S1: Segment the original data to be encrypted into data segments of unequal length;

Step S2: Insert a string of fixed-length characters before each data segment;

Step S3: Insert a mark character at the end of each data segment;

Step S4: Generate a corresponding matrix based on the order of the data segments and the inserted characters;

Step S5: Encrypt the generated corresponding matrix;

Step S6: adjusting and concatenating the sequence of the data segments, and storing the adjusted data segments and the encrypted corresponding matrix.

Optionally, the data encryption method may include the following steps:

Step S10: storing the original data in a non-volatile memory;

Step S11: read the original data from the non-volatile memory.

Optionally, the data encryption method may include the following steps:

Step S7: Delete the original data (plaintext) stored in the non-volatile memory.

Optionally, in step S6, both the adjusted data segment and the encrypted corresponding matrix are stored in a non-volatile memory, or both the adjusted data segment and the encrypted corresponding matrix are uploaded to the data platform storage, or respectively store the adjusted data segments in a non-volatile memory and upload the encrypted corresponding matrix to the data platform for storage.

Alternatively, the original data (plaintext) cannot be translated based solely on storing the adjusted data segments without obtaining and decrypting the encrypted corresponding matrix.

Optionally, the marker character inserted at the end of the data segment is different from any character in the inserted data segment;

Optionally, the marked character is encrypted together with the corresponding matrix as an element item of the corresponding matrix, or the marked character is encrypted separately, and the storage method and storage address of the marked character are the same as those of the corresponding matrix.

Optionally, the fixed length of the characters inserted before the data segment is long enough, and the characters inserted before each data segment are guaranteed not to be repeated through an algorithm and/or a screening mechanism for generating the characters of the fixed length.

Optionally, in step S5, the generated corresponding matrix is encrypted with an integrated encryption algorithm and key.

According to a second aspect of the present invention, a data decryption method for a data storage system is provided, wherein the data decryption method is used in conjunction with the data encryption method according to the present invention. The data decryption method includes:

Step S1': extract the adjusted data and the encrypted corresponding matrix;

Step S2': Decrypt the encrypted corresponding matrix, thereby obtaining the plaintext of the matrix;

Step S3': traversing the adjusted data, and segmenting the adjusted data by identifying the mark characters in the data, thereby obtaining non-equal-length data segments to be processed;

Step S4': extracting and/or marking the characters inserted before the data segment;

Step S5': Based on the original order of the data segments corresponding to the characters in the obtained matrix plaintext, restore the order of the data segments;

Step S6': delete the character inserted before the data segment and the tag character inserted at the end of the data segment;

Step S7': Splicing the deleted data segments to obtain the original data.

According to a third aspect of the present invention, a data processing method for a data storage system is provided, the data processing method includes the data encryption method according to the present invention and the data decryption method according to the present invention.

According to a fourth aspect of the present invention, there is provided a computer program product, such as a computer-readable program carrier, including computer program instructions, and when the computer program instructions are executed by a processor, the steps of the above method are implemented.

Description of drawings

The principles, features and advantages of the present invention can be better understood by describing the present invention in more detail below with reference to the accompanying drawings. The accompanying drawings show:

Fig. 1 shows the working flowchart of the data encryption method for data storage system according to an exemplary embodiment of the present invention;

Fig. 2 shows the data flow diagram based on the data encryption method of prior art;

FIG. 3 shows a data flow diagram of a data encryption method according to another exemplary embodiment of the present invention;

FIG. 4 shows a data flow diagram of a data encryption method according to another exemplary embodiment of the present invention;

Figure 5 shows a data flow diagram of a data encryption method according to another exemplary embodiment of the present invention;

FIG. 6 shows a data flow diagram of a data encryption method according to another exemplary embodiment of the present invention;

Fig. 7 shows a working flowchart of a data encryption method for a data storage system according to another exemplary embodiment of the present invention;

Fig. 8 shows a working flowchart of a data decryption method for a data storage system according to an exemplary embodiment of the present invention;

Fig. 9 shows the original data to be encrypted according to an exemplary embodiment of the present invention;

Figure 10 illustrates segmented data according to an exemplary embodiment of the present invention;

Figure 11 illustrates segmented data with caret characters according to an exemplary embodiment of the present invention;

Figure 12 shows a corresponding matrix according to an exemplary embodiment of the present invention;

Figure 13 shows the encrypted correspondence matrix according to an exemplary embodiment of the present invention; and

FIG. 14 illustrates adjusted data segments according to an exemplary embodiment of the present invention.

Detailed ways

In order to make the technical problems, technical solutions and beneficial technical effects to be solved by the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings and multiple exemplary embodiments. It should be understood that the specific embodiments described here are only used to explain the present invention, rather than to limit the protection scope of the present invention.

Fig. 1 shows a working flowchart of a data encryption method for a data storage system according to an exemplary embodiment of the present invention. The following exemplary embodiments describe the data encryption method according to the present invention in more detail.

The data encryption method includes steps S1 to S6. In step S1, the original data to be encrypted is segmented into data segments of unequal length. In the present embodiment of the present invention, the data to be encrypted as shown in FIG. e.g. random number generator) determined. The segmented data shown in FIG. 10 has a plurality of data segments with random lengths, for example first data segment 0XAF 28, second data segment 34 2B 1E 10, third data segment 07, fourth data segment 38 22 wait. It should be noted that the data encryption method according to the present invention is not only applicable to pictures and/or video data with a large amount of data, but also applicable to all data segments that need to be recorded, for example, a part of the data segment is the decision and Data related to control signals, vehicle dynamics, and body state signals, and the other part of the data segment is picture and/or video data.

In step S2, a string of fixed-length characters is inserted before each data segment. Here, the fixed length of the characters inserted before the data segment is long enough, and the algorithm and/or screening mechanism for generating the fixed-length characters ensure that the characters inserted before each data segment are not repeated, thereby ensuring that each The characters inserted before the data segment are unique, so that the order of each data segment is associated with the characters inserted before the data segment in subsequent steps. It can be understood that the characters inserted before the data segment can be set as the inserted characters through a preset algorithm (such as random extraction, splicing characters in the data segment or within a certain range before and after the data segment) . As shown in Figure 11, the segmented data with inserted characters, the first character 19 is inserted before the first data segment 0X AF 28, the second character 10 is inserted before the second data segment 34 2B 1E 10, and the third The third character 12 is inserted before the data segment 07, and the fourth character 01 is inserted before the fourth data segment 3822.

In step S3, mark characters are inserted at the end of each data segment. Here, the marking character is different from any character in the inserted data segment, so that the marking character can be identified during decryption. It can be understood that, since the marking character marks the end of each data segment, the segmentation mode of the data segment can be marked by the marking character. Segmented data with inserted characters as shown in FIG. Marking characters 5F are inserted at the end of the data segments 38 and 22, respectively.

In step S4, a correspondence matrix is generated based on the order of the data segments and the inserted characters. In the current embodiment of the present invention, for example, the first column of the corresponding matrix shown in Fig. 12 is the order of the data segment, and the second column is the inserted character, thus in the corresponding matrix the order of the data segment and The characters inserted before the data segment are associated. Since the characters inserted before each data segment are different from each other, the sequence of the data segments may have a one-to-one correspondence with the characters inserted before the data segment.

In step S5, the generated corresponding matrix is encrypted. The corresponding matrix encrypted by a preset encryption algorithm is exemplarily shown in FIG. 13 . It can be understood that since the order of the data segment is associated with the characters inserted before the data segment, and the data volume of the corresponding matrix is much smaller than the data volume of the original data segment, the encryption of the original data segment is replaced by the encryption of the corresponding matrix The calculation amount of encryption can be effectively reduced, so that resources of hardware and/or software security modules are not occupied for a long time and/or with high bandwidth.

In order to explain this advantage simply and clearly, the change of data volume is shown by comparing the data flow diagrams in Fig. 2 and Fig. 3 . FIG. 2 shows a data flow diagram of a data encryption method based on the prior art, wherein the random access memory 3 directly transmits the original data to the hardware and/or software security module 2 for encryption processing. Exemplarily, the amount of raw data that may be required by the autonomous vehicle data recording system for each trigger event is 100MB, but under a certain architecture, it takes, for example, 10s to encrypt 100MB of data, which is too long. This will not only cause the hardware and/or software security module 2 may not be able to handle other encryption needs synchronously during this time, but also cause power failure and/or power off of the car while the data is still in the hardware and/or software security module 2 is processed, resulting in the risk of data loss that has not been written. Fig. 3 shows a data flow diagram of a data encryption method according to another exemplary embodiment of the present invention. The difference from the technical solution shown in Figure 2 is that after the adjusted data and the corresponding matrix are generated based on the original data in the computing unit 1, the corresponding matrix data in the random access memory 3 is then transmitted to the hardware and/or software The security module 2 performs encryption processing. Exemplarily, the data volume of the corresponding matrix generated based on the original data volume of 100 MB may only be 10 ^-6 MB, thereby effectively reducing the calculation amount of encryption, thereby not occupying the hardware and/or software security module 2 for a long time. resource.

In the current embodiment of the present invention, the generated corresponding matrix is encrypted by an integrated encryption algorithm and key. Correspondingly, when decrypting the corresponding matrix, an adapted decryption algorithm and key can be used to restore the corresponding matrix. It should be noted that the mark characters can be encrypted together with the corresponding matrix as element items of the corresponding matrix, or can be encrypted separately.

In step S6, the sequence of the data segments is adjusted and spliced, and the adjusted data segments and the encrypted corresponding matrix are stored. The adjusted data segment is shown in FIG. 14 , wherein the order of the data segment composed of the segmented data segment and the characters inserted before and after it can be set in a random order based on a specific algorithm, for example. Regarding the storage location of the data, the adjusted data segment and the encrypted corresponding matrix can be stored together in the non-volatile memory 4 as in the optional embodiment shown in Figure 3; it can also be as shown in Figure 4 The adjusted data segment and the encrypted corresponding matrix are uploaded to the data platform 5 for storage as in the optional embodiment. It can be understood that, since characters and mark characters are inserted before and after each data segment and the order of the data segments has been disturbed, even after the stored data segment or a part of the stored data segment is extracted by specific means, The extracted data segment or a part of the extracted data segment cannot be interpreted correctly without deciphering the encrypted corresponding matrix.

In an optional embodiment, the adjusted data segment and the encrypted corresponding matrix can be stored separately, for example, the adjusted data segment is stored in the non-volatile memory 4 as shown in FIG. 5 , The encrypted corresponding matrix is uploaded to the data platform 5 for storage. It can be understood that for the adjusted data segment, the original data (plaintext) cannot be translated without obtaining and decrypting the corresponding matrix in the data platform 5, thereby further improving the security of the data.

Fig. 7 shows a working flowchart of a data encryption method for a data storage system according to another exemplary embodiment of the present invention. Only the differences from the embodiment shown in FIG. 1 are described below, and the same steps are not described repeatedly for the sake of brevity.

The method may include steps S10, S11 and S7. These steps are better described below in conjunction with the data flow diagram of the data encryption method of another embodiment described in FIG. 6 . In step S10 , the original data is stored in the non-volatile memory 4 . It can be understood that, in the optional embodiments shown in FIGS. 3 to 5 , the adjusted data segment and the encrypted corresponding matrix are stored in the nonvolatile memory 4 and /or Data Platform 5. Considering that the data in the random access memory 3 will be lost when the encryption process is powered off or the vehicle is powered off, the original data in the random access memory 3 will be previously processed and encrypted as shown in Figure 6. It is transmitted to the non-volatile memory 4, thereby ensuring that the original data is still stored in the non-volatile memory 4 when the encryption process is powered off or the vehicle is powered off, thereby reducing the risk of data loss.

In step S11, the original data is read from the non-volatile memory 4 . In an alternative embodiment shown in FIG. 6 , raw data is transferred from the non-volatile memory 4 to the random access memory 3 .

After finishing storing the adjusted data segment and the encrypted corresponding matrix in step S6, the original data (plaintext) stored in the non-volatile memory 4 is deleted in step S7. This way not only prevents the original data from leaking and further improves the security of data storage, but also saves the storage space of the non-volatile memory 4 for subsequent data storage and encryption processes without risk of data loss.

Fig. 8 shows a working flowchart of a data decryption method for a data storage system according to an exemplary embodiment of the present invention. The following exemplary embodiments describe the data decryption method according to the present invention in more detail.

The method comprises steps S1' to S7'. In step S1', the adjusted data and the encrypted corresponding matrix are extracted.

In step S2', the encrypted corresponding matrix is decrypted, thereby obtaining the plaintext of the matrix. In the current embodiment of the invention, the decryption can eg be performed by means of an integrated decryption algorithm and key, wherein the decryption algorithm is adapted to the encryption algorithm used in the data encryption method.

In step S3', the adjusted data is traversed, and the adjusted data is segmented by identifying the marking characters in the data, thereby obtaining the non-equal-length data segment to be processed. Here, the mark character is different from any character in the inserted data segment. It can be understood that, since the marking character is marked at the end of each data segment, the segmentation method of the data segment can be restored by identifying the marking character, and thus the data segment of unequal length to be processed can be obtained.

In step S4', the characters inserted before the data segment are extracted and/or marked. The characters are a string of fixed-length characters inserted before the data segment. Since the obtained matrix plaintext contains information about the inserted characters, the inserted characters before the data segment can be extracted and/or marked, for example based on the obtained matrix plaintext.

In step S5', based on the obtained original order of the data segments corresponding to the characters in the matrix plaintext, restore the order of the data segments. It can be understood that since the original order of the data segments in the corresponding matrix is associated with the character inserted before the data segment, the order of the data segments can be restored based on the obtained matrix plaintext.

In step S6', the characters inserted before the data segment and the tag characters inserted at the end of the data segment are deleted.

In step S7', the deleted data segments are spliced, thereby obtaining the original data.

In addition, it should be noted that the sequence number of the steps described here does not necessarily represent the sequence, but is just a reference number, and the sequence can be changed according to the actual situation, as long as the technical purpose of the present invention can be achieved.

While specific embodiments of the invention have been described in detail herein, they have been presented for purposes of illustration only and should not be construed as limiting the scope of the invention. Various alternatives and modifications can be made without departing from the spirit and scope of the invention.

Claims (10)

1. A data encryption method for a data storage system, wherein the data encryption method comprises the following steps: Step S1: Segment the original data to be encrypted into data segments of unequal length; Step S2: Insert a string of fixed-length characters before each data segment; Step S3: Insert a mark character at the end of each data segment; Step S4: Generate a corresponding matrix based on the order of the data segments and the inserted characters; Step S5: Encrypt the generated corresponding matrix; Step S6: adjusting and concatenating the sequence of the data segments, and storing the adjusted data segments and the encrypted corresponding matrix. 2. The data encryption method according to claim 1, wherein the data encryption method further comprises the steps of: Step S10: storing the original data in a non-volatile memory; Step S11: read the original data from the non-volatile memory. 3. The data encryption method according to any one of the preceding claims, wherein, in step S6, both the adjusted data segment and the encrypted corresponding matrix are stored in a non-volatile memory, or the adjusted Both the data segment and the encrypted corresponding matrix are uploaded to the data platform for storage, or the adjusted data segments are stored in a non-volatile memory and the encrypted corresponding matrix is uploaded to the data platform for storage. 4. The data encryption method according to any one of the preceding claims, wherein the fixed length of the character inserted before the data segment is long enough, and the algorithm and/or screening mechanism for generating the fixed-length character Ensure that the characters inserted before each data segment are not repeated; and/or the marker character inserted at the end of said data segment is different from any character in the inserted data segment; and/or The original data (plaintext) cannot be translated based on the adjusted data segments alone without obtaining and decrypting the encrypted corresponding matrix. 5. The data encryption method according to any one of the preceding claims, wherein the data encryption method further comprises the steps of: Step S7: Delete the original data (plaintext) stored in the non-volatile memory. 6. The data encryption method according to any one of the preceding claims, wherein the marking characters are encrypted together with the corresponding matrix as element items of the corresponding matrix, or the marking characters are encrypted separately. 7. The data encryption method according to any one of the preceding claims, wherein, in step S5, the generated corresponding matrix is encrypted by an integrated encryption algorithm and key. 8. A data decryption method for a data storage system, the data decryption method is used in conjunction with the data encryption method according to any one of claims 1 to 7, wherein the data decryption method comprises: Step S1': extract the adjusted data and the encrypted corresponding matrix; Step S2': Decrypt the encrypted corresponding matrix, thereby obtaining the plaintext of the matrix; Step S3': traversing the adjusted data, and segmenting the adjusted data by identifying the mark characters in the data, thereby obtaining non-equal-length data segments to be processed; Step S4': extracting and/or marking the characters inserted before the data segment; Step S5': Based on the original order of the data segments corresponding to the characters in the obtained matrix plaintext, restore the order of the data segments; Step S6': delete the character inserted before the data segment and the tag character inserted at the end of the data segment; Step S7': Splicing the deleted data segments to obtain the original data. 9. A data processing method for a data storage system, the data processing method comprising the data encryption method according to any one of claims 1 to 7 and the data encryption method for a data storage system according to claim 8 decryption method. 10. A computer program product, such as a computer-readable program carrier, comprising computer program instructions which, when executed by a processor, implement the steps of the method according to any one of the preceding claims.

Images