CN113326522A - Data processing method, device, equipment and computer storage medium - Google Patents

Abstract

The embodiments of the present application provide a data processing method, apparatus, electronic device, and computer storage medium. The method includes: receiving a data storage request from a user, and generating a user key random number and a file of the user according to the data storage request. key random number; splicing the user's user key random number and file key random number to obtain a first character string, encrypting the first character string to obtain a first data key; according to the first data key, encrypt the user data, and store the encrypted data; obtain the user password, generate a target password according to the user password, and splicing the target password and the random number of the user key to obtain the first password. Two character strings, encrypt the second character string to obtain a second data key; the second data key is used to determine the user key random number of the user when the encrypted user data is operated.

Description

A data processing method, apparatus, device and computer storage medium

technical field

The present application relates to the technical field of data security storage of financial technology (Fintech), and in particular, to a data processing method, apparatus, electronic device and computer storage medium.

Background technique

With the development of computer technology, more and more technologies are applied in the financial field, and the traditional financial industry is gradually transforming into financial technology. However, due to the security and real-time requirements of the financial industry, higher requirements are also placed on technology.

Traditional bank safes are used to protect users' physical property, such as gold, silver, jewelry, and circulating banknotes. With the advancement of digitization, users' digital data has become an increasingly important asset, such as ID cards, bank cards, etc., making data Safe deposit boxes have become an indispensable customer-facing capability for today's digital banks.

In the related art, in the process of storing the user's data through the data safe, the single encryption key generated by the service provider's own system background is often used to encrypt the user data, that is, the single-layer system key is used to encrypt the user's data. However, the security of this encryption method is not high. Once the encryption key is leaked, it is less difficult to crack the user's original data, which will increase the security risk of the user's data.

SUMMARY OF THE INVENTION

The present application provides a data processing method, an apparatus, an electronic device and a computer storage medium, which can solve the problem of relatively high security risk when encrypting user data in the related art.

The technical solution of the present application is realized as follows:

The embodiment of the present application provides a data processing method, and the method includes:

Receive a user's data storage request, and generate the user's user key random number and file key random number according to the data storage request;

Splicing the user key random number and the file key random number of the user to obtain a first character string, encrypting the first character string to obtain a first data key;

Encrypting user data according to the first data key, and storing the encrypted user data; obtaining a user password, generating a target password according to the user password, and randomizing the target password and the user key The numbers are spliced to obtain the second string;

The second character string is encrypted to obtain a second data key; the second data key is used to determine the user key random number of the user when the encrypted user data is operated.

In some embodiments, the method further includes:

After receiving the operation request for the encrypted user data, decrypt the second data key according to the user password to obtain the user key random number of the user;

Encrypting the file key random number and the decrypted user key random number, and regenerating the first data key;

Decrypt the encrypted user data according to the regenerated first data key to obtain the user data; and operate the user data according to the operation request.

In some embodiments, the method further includes:

Based on the blockchain data storage method, the operation behavior of the user data will be recorded.

In some embodiments, the method further includes:

According to the identity document (ID) of the user, obtain the public key distributed by a third-party trusted organization;

Obtain the encrypted random number of the user key, and destroy the random number of the user key of the user; The key random number is encrypted;

Encrypting the encrypted user key random number to obtain a third data key;

The third data key is stored.

In some embodiments, the method further includes:

According to the user's ID, obtain the private key distributed by the third-party trusted organization;

Decrypt the third data key through identity authentication to obtain the encrypted random number of the user key;

The user key random number of the user is obtained; the user key random number of the user is obtained by decrypting the encrypted user key random number with the private key of the third-party trusted organization.

In some embodiments, the method further includes:

In the case of obtaining the user key random number of the user and the reset user password, based on the user's user key random number and the reset user password, an updated second data key is obtained; The reset user password is obtained after the user is authenticated.

In some embodiments, the method further includes:

In the case of determining that the user password is changed, decrypt the second data key according to the user password before the change, and obtain the user key random number of the user;

Based on the user's user key random number and the changed user password, an updated second data key is obtained.

The embodiment of the present application also proposes a data processing device, the device includes a generation module, an encryption module and a storage module, wherein,

A generating module, configured to receive a user's data storage request, and generate the user's user key random number and file key random number according to the data storage request;

The encryption module is used for splicing the random number of the user key and the random number of the file key of the user to obtain a first character string, encrypting the first character string to obtain a first data key, according to the first character string data key, encrypting user data; obtaining a user password, generating a target password according to the user password, splicing the target password and the random number of the user key to obtain a second string, and encrypting the second character string to obtain a second data key; the second data key is used to determine the user key random number of the user when the encrypted user data is operated;

The storage module is used to store encrypted user data.

An embodiment of the present application provides an electronic device, the device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, where the processor implements one or more of the foregoing techniques when executing the program The data processing method provided by the program.

An embodiment of the present application provides a computer storage medium, where a computer program is stored in the computer storage medium; after the computer program is executed, the data processing method provided by one or more of the foregoing technical solutions can be implemented.

The embodiments of the present application provide a data processing method, apparatus, electronic device, and computer storage medium. The method is applied to a server system. The method includes: receiving a data storage request from a user, and generating a data storage request according to the data storage request. the random number of the user key and the random number of the file key of the user; splicing the random number of the user key of the user and the random number of the file key to obtain the first character string, and encrypting the first character string to obtain the first character string. a data key; according to the first data key, the user data is encrypted, and the encrypted user data is stored.

It can be seen that, in the embodiment of the present application, the first layer of encryption is firstly performed based on the random number of the user key and the random number of the file key generated by the server system to obtain the first data key; The user data is encrypted at the second layer; that is, in the process of storing the user data, the above-mentioned two-layer encryption method is used to realize encryption. It has high security, which can effectively improve the security of users when storing data and reduce security risks.

Description of drawings

1a is a schematic flowchart of a data processing method in an embodiment of the present application;

Fig. 1b is the schematic flow chart of adopting SM4 algorithm to encrypt the first character string in the embodiment of the present application;

Fig. 1c is a schematic flow chart of encrypting user data in an embodiment of the present application;

FIG. 1d is a schematic flowchart of operating user data according to a user operation request in an embodiment of the present application;

1e is a schematic flowchart of a user changing or resetting a password in an embodiment of the present application;

2 is a schematic flowchart of a data encryption method according to an embodiment of the application;

3 is a schematic diagram of the composition and structure of a data processing apparatus according to an embodiment of the present application;

FIG. 4 is a schematic structural diagram of an electronic device provided by an embodiment of the present application.

Detailed ways

The present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the embodiments provided herein are only used to explain the present application, and are not intended to limit the present application. In addition, the embodiments provided below are only some of the embodiments for implementing the present application, rather than all the embodiments for implementing the present application. In the case of no conflict, the technical solutions described in the embodiments of the present application can be combined arbitrarily. implement.

It should be noted that, in the embodiments of the present application, the terms "comprising", "comprising" or any other variants thereof are intended to cover non-exclusive inclusion, so that a method or device including a series of elements not only includes the explicitly stated elements, but also other elements not expressly listed or inherent to the practice of the method or apparatus. Without further limitation, an element defined by the phrase "comprises a..." does not preclude the presence of additional related elements (eg, steps in a method or a device) in which the element is included. A unit in an apparatus, for example, a unit may be part of a circuit, part of a processor, part of a program or software, etc.).

The term "and/or" in this text is only an association relationship to describe the associated objects, indicating that there can be three kinds of relationships, for example, I and/or J, it can mean: I exist alone, I and J exist simultaneously, exist independently J these three cases. In addition, the term "at least one" herein refers to any combination of any one or more of at least two of the plurality, for example, including at least one of I, J, and R, can mean including from I, Any one or more elements selected from the set of J and R.

For example, the data processing method provided by the embodiment of the present application includes a series of steps, but the data processing method provided by the embodiment of the present application is not limited to the steps described. Similarly, the data processing device provided by the embodiment of the present application includes a A series of modules, but the data processing apparatus provided by the embodiments of the present application is not limited to including the modules explicitly described, and may also include modules that need to be set for acquiring relevant task data or performing processing based on the task data.

The embodiments of the present application can be applied to a computer system composed of a client and a server, and can operate with many other general-purpose or special-purpose computing system environments or configurations. Here, the client can be a thin client, a thick client, a handheld or laptop device, a microprocessor-based system, a set-top box, a programmable consumer electronics product, a network personal computer, a small computer system, etc., and the server can be Small computer systems, large computer systems, and distributed cloud computing technology environments including any of the above, etc.

Electronic devices such as the client and the server can implement corresponding functions through the execution of the program modules. Generally, program modules may include routines, programs, object programs, components, logic, data structures, etc. that perform particular tasks or implement particular abstract data types. The computer system/server may be implemented in a distributed cloud computing environment where tasks are performed by remote processing devices that are linked through a communications network. In a distributed cloud computing environment, program modules may be located on local or remote computing system storage media including storage devices.

In the related art, there are differences in the storage methods of user assets in the physical world and the digital world; here, Table 1 shows the storage methods of the above two user assets in three aspects: asset elements, storage methods and storage requirements. difference in aspects.

Table 1

In the related art, when user data storage service providers such as cloud disk, Weiyun, etc., when storing data such as customer address book, photos, videos, etc., the storage services provided by them mostly use the system background to generate a single encryption key, that is, The user data is encrypted by a single-layer system key; however, this encryption method is not very secure. Once the encryption key is leaked, it is less difficult to crack the user's original data, which will increase the security risk of the user's data.

In view of the above technical problems, the following embodiments are proposed.

In some embodiments of the present application, the data processing method may be implemented by using a processor in a data processing apparatus, and the above-mentioned processor may be an application specific integrated circuit (ASIC), a digital signal processor (Digital Signal Processor, DSP), Digital Signal Processing Device (DSPD), Programmable Logic Device (Programmable Logic Device, PLD), Field Programmable Gate Array (Field Programmable Gate Array, FPGA), Central Processing Unit (Central Processing Unit, CPU) ), at least one of a controller, a microcontroller, and a microprocessor.

Fig. 1a is a schematic flowchart of a data processing method in an embodiment of the present application. As shown in Fig. 1a, the method includes the following steps:

Step 100: Receive a data storage request from a user, and generate a user key random number and a file key random number of the user according to the data storage request.

In the embodiment of the present application, the user sends a data storage request to the server through the client, and the server receives the user's data storage request; exemplarily, the server may be a cloud storage server; here, the source of the cloud storage server is not limited , for example, may be provided by a cloud storage service provider, or may be obtained in other ways.

Exemplarily, the data in the data storage request represents the data assets of the user, for example, an ID card, a bank card, an address book, and the like.

Exemplarily, after the server receives the data storage request of each user, the system background independently generates a pair of key random numbers for each user, which are respectively the user key random number and the file key random number; this application implements The example takes a user as an example to illustrate.

Here, the random number of the file key represents the random number seed generated by the server system for encrypting user data, and is stored in the server database for safekeeping. The random number of the user key represents the random number seed generated by the server system for encrypting user data, which is used for encrypted custody by a third-party trusted organization, and encrypted storage of the hash value of the user password, without leaving any traces in the whole process. That is, while generating the user's key random number, the key escrow will be directly based on a third-party trusted organization; the third-party trusted organization indicates that the third party is authoritative, publicly recognized, and has relevant technical capabilities. institution.

Exemplarily, the third-party trusted institution may be China Financial Certification Authority (CFCA), or may be other third-party trusted institutions.

Here, by entrusting the random number of the user key to a third-party trusted organization, it is guaranteed that neither the service provider nor the trusted organization can decrypt the user data, and the keys are kept separately to ensure the security of data storage.

Step 101: splicing the user's user key random number and the file key random number to obtain a first character string, and encrypting the first character string to obtain a first data key.

Exemplarily, after obtaining the random number of the user key and the random number of the file key of the user according to step 100, the user's random number of the user key and the random number of the file key are spliced to obtain the first character string. Here, the splicing sequence of the two may be set according to actual conditions, which is not limited in this embodiment of the present application.

In one embodiment, assuming that the character string corresponding to the random number of the user key is "abc" and the character string corresponding to the random number of the file key is "def", the first character string obtained after splicing may be "abcdef" ", or "defabc".

In the embodiment of the present application, after the first character string is obtained, the first character string is encrypted using the first encryption algorithm; here, the type of the first encryption algorithm is not limited, for example, it may be the block symmetric encryption algorithm SM4, It can also be other standard encryption algorithms; the following takes the packet symmetric encryption algorithm SM4 (SM4 algorithm for short) as an example for description.

The SM4 algorithm is a block symmetric cipher algorithm used to implement data encryption/decryption operations to ensure the confidentiality of data and information. The block length of this algorithm is 128 bits, and the key length is 128 bits. (The hexadecimal representation is 32 bits, the plaintext and the key are the same length) The encryption algorithm and the key expansion algorithm both use a 32-round non-linear iterative structure.

Exemplarily, in the process of encrypting the first character string by using the SM4 algorithm, if the first character string is less than 128 bits, the number of digits is filled with 0; Here, if Xi (i=0, 1, 2, ..., 31) is used to represent the state of the column in the encryption process, the initial state X0, X1, X2, X3, after 32 rounds of iterations, will get 32 column expansion Status X0, X1, ... X31. The encryption time-round key is expressed as (rk0, rk1, .

Step 102: Encrypt the user data according to the first data key, and store the encrypted user data.

Exemplarily, after obtaining the first data key according to step 101, use the first data key to encrypt the user data, and use the first encryption algorithm again to encrypt the user data encrypted by the first data key to obtain the encrypted data. For user data, the encrypted user data is stored in the server database; at the same time, the first data key is destroyed.

In the embodiment of the present application, data encryption is performed according to the first data key obtained from the random number of the user key and the random number of the file key, and the data is not directly encrypted by the user password; since the random number of the user key depends on the user password for decryption and restoration, It enables users to access and export their own data through their own passwords. Without the authentication of independent passwords, the background cannot decrypt user data, effectively ensuring the security of user data.

Step 103: Obtain a user password, generate a target password according to the user password, splicing the target password and the random number of the user key to obtain a second character string, encrypt the second character string, and obtain a second data key; the second data key The user key random number used to determine the user when operating on encrypted user data.

Exemplarily, after the server receives the above-mentioned data storage request from the user, it first authenticates the user; after determining to pass the identity authentication, the user will set his own password through the front-end page of the client, that is, the user password, which is At the time, the server can obtain the user password, and then, according to the user password, generate the target password.

Here, the type of the identity authentication method is not limited, for example, it can be identity authentication based on biological features, such as fingerprints, iris, etc., or identity authentication in other ways.

Exemplarily, the target password may be the user password, or may be the data encrypted by the user password according to the second encryption algorithm; here, the second encryption algorithm may be the SM3 algorithm, or may be other standard encryption algorithms; wherein, the SM3 algorithm It is a hash algorithm. In the cryptographic system, it is mainly used for digital signature and verification, message authentication code generation and verification, and random number generation. For the data that the user needs to encrypt, that is, the user password, a hash value of a fixed length (32 bytes) will be generated after encryption.

Exemplarily, after obtaining the target password according to the user password, splicing the target password and the user key random number, and using the first encryption algorithm to encrypt the second string obtained by the splicing to obtain the second data key; If the second data key is obtained, the random number of the user key is destroyed. Here, the splicing process of the target password and the random number of the user key is the same as the splicing process of the random number of the user key and the random number of the file key, and the encryption process of the second character string is the same as the encryption process of the first character string. It is not repeated here.

In the embodiment of the present application, after the second data key is generated, the random number of the user key is destroyed, so if the user wants to operate the encrypted user data later, the second data key is used to The random number of the user key can be determined, and the random number of the user key is encrypted based on the user password. Therefore, through the second data key, it can be ensured that the user data can be restored only when the user key is authenticated, and the user data can be restored. Security of operational data.

Figure 1c is a schematic flow chart of encrypting user data in the embodiment of the present application. As shown in Figure 1c, after the server receives the data storage request sent by the user, it will perform identity authentication on the user; After authentication, the user sets a password; then, the server obtains the user password, encrypts the user password through the SM3 algorithm, and obtains the user password hash value; when the server receives the above data storage request, the server background will generate the user password. key random number and file key random number; encrypt the string concatenated by the user key random number and the file key random number through the SM4 algorithm to obtain the first data key; the first data key is used to Encryption is performed, and the SM4 algorithm is used to encrypt the first data key again to obtain encrypted user data, and the first data key is destroyed. The hash value of the user password and the random number of the user key are spliced together, and the spliced string is encrypted by the SM4 algorithm to obtain the second data key, and the random number of the user key is destroyed; It can be restored only under the condition of key authentication.

In some embodiments, the above method may further include: after receiving the operation request for the encrypted user data, decrypting the second data key according to the user password to obtain the random number of the user key of the user; The key random number and the decrypted user key random number are encrypted, and the first data key is regenerated; according to the regenerated first data key, the encrypted user data is decrypted to obtain the user data; according to the operation request , to operate on user data.

Here, the type of the user's operation request is not limited in this embodiment of the present application. For example, it may be an operation request for uploading data, an operation request for querying data, or an operation request for modifying data.

Fig. 1d is a schematic flowchart of operating user data according to a user operation request in an embodiment of the present application. As shown in Fig. 1d, after the server receives the operation request sent by the user, password authentication is performed; After authentication, according to the user password, use the SM4 algorithm to decrypt the second data key to obtain the decrypted user key random number; then, use the SM4 algorithm to perform the file key random number and the decrypted user key random number. encrypt, and regenerate the first data key; use the SM4 algorithm to decrypt the user data encrypted by the first data key to obtain the user data. Further, according to the type of the operation request, corresponding operations are performed on the user data; for example, data is viewed or exported.

In some embodiments, the above method may further include: recording the operation behavior of the user data based on the blockchain data storage method.

In the embodiment of this application, by storing the operation behaviors for user data, such as uploading, querying, modifying and other operation behaviors of user data, the blockchain data can ensure that the user's operation behaviors cannot be edited and can be traced back after the event. Facilitate the management of user data.

Exemplarily, various operating behaviors of user data undergo professional and comprehensive legal compliance assessment, and complete and comprehensive legal terms authorization agreements are signed with users and data users. Clearly not tampered with, clear authorized content, clear authorized scope and authorized period.

In some embodiments, the above method may further include: obtaining a public key and a private key distributed by a third-party trusted organization according to the user's ID; obtaining an encrypted random number of the user's key, and determining the random number of the user's user key. The encrypted random number of the user key is obtained by encrypting the random number of the user's user key with the public key of a third-party trusted organization; the encrypted random number of the user key is encrypted to obtain the third data key; stores the third data key.

In this embodiment of the application, the server obtains the user's ID, and applies for a certificate to a third-party trusted authority through the user's ID. The third-party trusted authority independently allocates a pair of public and private key certificates for each user, that is, each user corresponds to Assign a pair of public and private keys; here, the user's ID is uniquely assigned by the server system when the user registers.

Encrypt the user's user key random number with the public key of the third-party trusted organization to obtain the encrypted user key random number, and then use the first encryption algorithm, for example, the SM4 algorithm to encrypt the encrypted user key random number. Encrypt to obtain the third data key; store the third data key in the server database.

In some embodiments, the above method may further include: the server decrypts the third data key by means of identity authentication, and obtains the encrypted random number of the user key; obtains the random number of the user's user key; The key random number is obtained by decrypting the encrypted user key random number with the private key of the third-party trusted organization.

Exemplarily, in the case that the user forgets to set the password, that is, the server cannot obtain the correct user password, the third data key obtained above can be decrypted by means of identity authentication, and the encrypted user key can be obtained randomly. The encrypted user key random number is decrypted through the private key assigned to the user by a third-party trusted organization to obtain the user key random number; then, the file key random number and the obtained user key random number are decrypted. Encryption is performed to regenerate the first data key; according to the regenerated first data key, the user data is decrypted, and then the user data is obtained.

It can be seen that the embodiment of the present application supports the retrieval of user data through identity authentication methods such as online biometric authentication or one-time password (One Time Password, OTP) SMS verification and other identity authentication methods when the user forgets the password, and the user key is random. The plaintext does not leave any traces on the ground.

In some embodiments, the above method may further include: in the case of obtaining the user's user key random number and the reset user password, obtaining an update based on the user's user key random number and the reset user password. The second data key after reset; the reset user password is obtained after the user is authenticated.

Exemplarily, when the user forgets to set the password, the user needs to reset the password; after the server determines that the user has passed the identity authentication, the user resets the password, and the server sends the reset password of the user to a third-party trusted organization, The third-party trusted organization further verifies the password. After confirming that the verification is passed, the server obtains the reset user password; after obtaining the random number of the user key and the reset user password, the user password can be obtained according to the user password. , obtain the updated target password, and then splicing the updated target password with the random number of the user key to obtain the updated second string, and use the first encryption algorithm to encrypt the updated second string to obtain The updated second data key.

In some embodiments, the above method may further include: when it is determined that the user password is changed, decrypting the second data key according to the user password before the change to obtain the user's user key random number; The user key random number and the changed user password are obtained to obtain the updated second data key.

Exemplarily, when the user changes the password, the user needs to change the password; if it is determined that the user password is changed, the second data key is decrypted according to the user password before the change to obtain the random number of the user's user key; The changed user password is spliced with the random number of the user key to obtain an updated second character string, and the updated second character string is encrypted using the first encryption algorithm to obtain an updated second data key.

In the embodiment of the present application, when the user changes the password, it is not necessary to use the unchanged user password to first decrypt the data, and then use the changed user password to encrypt the data for saving. Instead, after the user key random number is obtained by decrypting the second data key, the updated second data key is obtained by encrypting the changed user password and the user key random number. It can be seen that the embodiment of the present application does not involve re-encryption and decryption of user data, such a design makes background processing lighter, improves system performance, and reduces the probability of data storage errors caused by password changes.

Fig. 1e is a schematic flowchart of a user changing or resetting a password in the embodiment of the present application. As shown in Fig. 1e, after the server receives the operation request sent by the client, it will perform identity authentication on the user; After authentication, the user resets the password; the server sends the reset user password to the third-party trusted organization. After receiving the reset user password, the third-party trusted organization sends it to the user through OTP SMS verification. Verification code, the user backfills the verification code on the client side, and the server side decrypts the third data key after confirming that the verification code is passed, obtains the encrypted random number of the user key, and uploads the encrypted random number of the user key to the third-party trusted organization; the third-party trusted organization decrypts the encrypted random number of the user key through the private key assigned to the user, so that the server obtains the random number of the user key; then, the server resets the random number based on The hash value of the updated user password and the obtained random number of the user key are used to obtain the updated second data key, and finally the pre-updated second data key is destroyed.

The embodiments of the present application propose a data processing method, device, electronic device and computer storage medium. The method is applied to a server system. The method includes: receiving a data storage request from a user, and generating a user key of the user according to the data storage request Random number and file key random number; splicing the user's user key random number and file key random number to obtain the first character string, encrypting the first character string to obtain the first data key; according to the first data encryption key, encrypt user data, and store the encrypted user data. It can be seen that, in the embodiment of the present application, the first layer of encryption is firstly performed based on the random number of the user key and the random number of the file key generated by the server system to obtain the first data key; The user data is encrypted at the second layer; that is, in the process of storing the user data, the above-mentioned two-layer encryption method is used to realize encryption. It has high security, which can effectively improve the security of users when storing data and reduce security risks.

In order to better reflect the purpose of the present application, further description will be made on the basis of the above-mentioned embodiments of the present application.

FIG. 2 is a schematic flowchart of a data encryption method according to an embodiment of the present application. As shown in FIG. 2 , the process may include:

Step A1: splicing the random number of the user key and the random number of the file key, encrypting the spliced character string through the SM4 algorithm, and obtaining the first data key; the first data key is used to encrypt the user data, and then again The first data key is encrypted by using the SM4 algorithm, the encrypted user data is obtained, and the first data key is destroyed.

Step A2: splicing the hash value of the user password and the random number of the user key, encrypting the spliced string through the SM4 algorithm, obtaining a second data key, and storing the second data key.

Step A3: Encrypt the random number of the user key hosted by the third-party trusted organization, and encrypt the encrypted random number of the user key again through the SM4 algorithm to obtain a third data key.

Exemplarily, the above three steps may be performed simultaneously.

It can be seen that in the embodiment of the present application, only the user can view and export the data, the service provider cannot independently decipher the user data, and the security of data storage is guaranteed; if the user forgets to set the password in a special case, the third party is also supported. The trusted authority retrieves the key after identity authentication and decrypts the user data.

Exemplarily, the embodiments of the present application support two data decryption methods: one is that the user decrypts data through password authentication under normal circumstances; the other is that when the user forgets the password, the key is retrieved through a third-party trusted organization. , decrypt the data; the algorithm used in the decryption process and the encryption process is exactly the same, the only difference is that the decryption key of the decryption algorithm is obtained by inversely transforming its encryption key; for example, when the SM4 algorithm decrypts the round encryption The keys are used in the following order: (rk31,rk30,…,rk0).

In the embodiment of the present application, part of the keys are entrusted to a third-party trusted organization, so that neither the service provider nor the trusted organization can crack the user data independently, and the data stored by the user is more secure and reliable; in addition, it also relies on user authentication, The user sets an independent user password, the user key is encrypted and the user key is stored, and the user data cannot be cracked by the service provider without user authentication, which effectively ensures the user's ability to control personal data; when the user forgets the password, he can also use the online identity After authentication, the key is retrieved from a third-party trusted organization; the user's entire operation behavior is stored in the blockchain, which ensures the non-tampering and subsequent traceability of data storage and use; effectively improves the security of data in encrypted storage and use Compared with the existing cloud storage service providers, it has obvious optimization and improvement in security and personal data privacy protection.

Further, the encryption storage technology involved in the embodiments of this application is also applied to the data safe product, which is a financial-level secure encrypted storage data product independently developed for users, and supports users to keep various certificates and documents, such as identities. Documents, bank cards, driving licenses, academic certificates, real estate certificates, business licenses, financial statements, etc., are convenient for users to manage and use the data assets they own. It can realize secure storage based on multiple encryption technologies and user authentication, and adopts technologies such as blockchain storage and biometric verification to ensure the safety of users in the process of storing and using their data assets.

FIG. 3 is a schematic structural diagram of a data processing apparatus according to an embodiment of the present application. As shown in FIG. 3 , the apparatus includes a generation module 300, an encryption module 301, and a storage module 302, wherein,

The generating module 300 is used for receiving the data storage request of the user, and generating the user key random number and the file key random number of the user according to the data storage request;

The encryption module 301 is used for splicing the user's user key random number and the file key random number to obtain a first character string, encrypting the first character string to obtain a first data key, and according to the first data key, The user data is encrypted; the user password is obtained, the target password is generated according to the user password, the target password and the random number of the user key are spliced to obtain a second string, and the second string is encrypted to obtain a second data key; the second data The key is used to determine the user's user key random number when operating on the encrypted user data;

The storage module 302 is used for storing encrypted user data.

In some embodiments, the above-mentioned apparatus further includes a decryption module, which is used for:

After receiving the operation request for the encrypted user data, decrypt the second data key according to the user password to obtain the random number of the user's user key;

Encrypting the file key random number and the decrypted user key random number, and regenerating the first data key;

Decrypt the encrypted user data according to the regenerated first data key to obtain the user data; and operate the user data according to the operation request.

In some embodiments, the storage module 302 is further configured to:

Based on the blockchain data storage method, the operation behavior of user data will be recorded.

In some embodiments, the encryption module 301 is further configured to:

According to the user's ID, obtain the public key assigned by the third-party trusted organization;

Obtain the encrypted random number of the user key, and destroy the random number of the user's user key; the encrypted random number of the user key is encrypted by the public key of the third-party trusted organization. owned;

The encrypted random number of the user key is encrypted to obtain a third data key.

The storage module 302 is further configured to: store the third data key.

In some embodiments, the decryption module is also used to:

According to the user's ID, obtain the private key assigned by the third-party trusted organization;

Decrypt the third data key through the identity authentication method to obtain the encrypted random number of the user key;

Obtain the user's user key random number; the user's user key random number is obtained by decrypting the encrypted user key random number with the private key of the third-party trusted organization.

In some embodiments, the encryption module 301 is further configured to:

In the case of obtaining the user's user key random number and the reset user password, the updated second data key is obtained based on the user's user key random number and the reset user password; The user password is obtained after the user is authenticated.

In some embodiments, the encryption module 301 is further configured to:

When it is determined that the user password is changed, decrypt the second data key according to the user password before the change, and obtain the user's user key random number;

Based on the user's user key random number and the changed user password, the updated second data key is obtained.

In practical applications, the above-mentioned generation module 300, encryption module 301, storage module 302 and decryption module can all be implemented by a processor located in an electronic device, and the processor can be an ASIC, DSP, DSPD, PLD, FPGA, CPU, control at least one of a device, a microcontroller, and a microprocessor.

In addition, each functional module in this embodiment may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit. The above-mentioned integrated units can be implemented in the form of hardware, or can be implemented in the form of software function modules.

If the integrated unit is implemented in the form of software function modules and is not sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this embodiment is essentially or correct. Part of the contribution made by the related art or all or part of the technical solution can be embodied in the form of a software product, the computer software product is stored in a storage medium, and includes several instructions to make a computer device (which can be a personal computer). , server, or network device, etc.) or processor (processor) executes all or part of the steps of the method in this embodiment. The aforementioned storage medium includes: U disk, mobile hard disk, read only memory (Read Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk and other media that can store program codes.

Specifically, a computer program instruction corresponding to a data processing method in this embodiment may be stored on a storage medium such as an optical disk, a hard disk, a U disk, etc. When the computer program instruction corresponding to a data processing method in the storage medium When read or executed by an electronic device, any one of the data processing methods in the foregoing embodiments is implemented.

Based on the same technical concept as the foregoing embodiments, see FIG. 4 , which shows an electronic device 400 provided by an embodiment of the present application, which may include: a memory 401 and a processor 402; wherein,

memory 401 for storing computer programs and data;

The processor 402 is configured to execute the computer program stored in the memory to implement any one of the data processing methods in the foregoing embodiments.

In practical applications, the above-mentioned memory 401 may be a volatile memory (volatile memory), such as RAM; or a non-volatile memory (non-volatile memory), such as ROM, flash memory (flash memory), hard disk (Hard Disk) Drive, HDD) or solid-state drive (Solid-State Drive, SSD); or a combination of the above types of memory, and provide instructions and data to the processor 402.

The above-mentioned processor 402 may be at least one of ASIC, DSP, DSPD, PLD, FPGA, CPU, controller, microcontroller, and microprocessor. It can be understood that, for different audit management platforms, the electronic device used to implement the above processor function may also be other, which is not specifically limited in the embodiment of the present application.

In some embodiments, the functions or modules included in the apparatus provided in the embodiments of the present application may be used to execute the methods described in the above method embodiments, and the specific implementation may refer to the descriptions in the above method embodiments. No longer.

The above descriptions of the various embodiments tend to emphasize the differences between the various embodiments, and the similarities or similarities can be referred to each other. For the sake of brevity, details are not repeated herein.

The methods disclosed in each method embodiment provided in this application can be combined arbitrarily without conflict to obtain a new method embodiment.

The features disclosed in each product embodiment provided in this application can be combined arbitrarily without conflict to obtain a new product embodiment.

The features disclosed in each method or device embodiment provided in this application can be combined arbitrarily without conflict to obtain a new method embodiment or device embodiment.

As will be appreciated by those skilled in the art, the embodiments of the present application may be provided as a method, a system, or a computer program product. Accordingly, the application may take the form of a hardware embodiment, a software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media having computer-usable program code embodied therein, including but not limited to disk storage, optical storage, and the like.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present application. It will be understood that each flow and/or block in the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to the processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing device to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing device produce Means for implementing the functions specified in a flow or flow of a flowchart and/or a block or blocks of a block diagram.

These computer program instructions can also be loaded on a computer or other programmable data processing device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process such that The instructions provide steps for implementing the functions specified in the flow or blocks of the flowcharts and/or the block or blocks of the block diagrams.

The above are only preferred embodiments of the present application, and are not intended to limit the protection scope of the present application.

Claims (10)

1. A method of data processing, the method comprising:

receiving a data storage request of a user, and generating a user key random number and a file key random number of the user according to the data storage request;

splicing the user key random number and the file key random number of the user to obtain a first character string, and encrypting the first character string to obtain a first data key;

encrypting user data according to the first data key, and storing the encrypted user data;

acquiring a user password, generating a target password according to the user password, and splicing the target password and the user key random number to obtain a second character string;

encrypting the second character string to obtain a second data key; the second data key is used for determining a user key random number of the user when the encrypted user data is operated.

2. The method of claim 1, further comprising:

after receiving an operation request aiming at the encrypted user data, decrypting the second data key according to the user password to obtain a user key random number of the user;

encrypting the file key random number and the decrypted user key random number to regenerate the first data key;

decrypting the encrypted user data according to the regenerated first data key to obtain the user data; and operating the user data according to the operation request.

3. The method of claim 2, further comprising:

and recording the operation behavior aiming at the user data based on a block chain data storage mode.

4. The method of claim 1, further comprising:

acquiring a public key distributed by a third-party trusted authority according to the identity identification number ID of the user;

obtaining an encrypted user key random number, and destroying the user key random number of the user; the encrypted user key random number is obtained by encrypting the user key random number of the user through a public key of a third-party trusted authority;

encrypting the encrypted user key random number to obtain a third data key;

storing the third data key.

5. The method of claim 4, further comprising:

acquiring a private key distributed by a third-party trusted authority according to the ID of the user;

decrypting the third data key in an identity authentication mode to obtain the encrypted user key random number;

obtaining a user key random number of the user; and the user key random number of the user is obtained by decrypting the encrypted user key random number through a private key of the third-party trusted authority.

6. The method of claim 5, further comprising:

under the condition of obtaining the user key random number of the user and the reset user password, obtaining an updated second data key based on the user key random number of the user and the reset user password; and the reset user password is obtained after the identity authentication of the user is carried out.

7. The method of claim 1, further comprising:

under the condition that the user password is determined to be changed, decrypting a second data key according to the user password before changing to obtain a user key random number of the user;

and obtaining an updated second data key based on the user key random number of the user and the changed user password.

8. A data processing apparatus, characterized in that the apparatus comprises:

the generation module is used for receiving a data storage request of a user and generating a user key random number and a file key random number of the user according to the data storage request;

the encryption module is used for splicing the user key random number and the file key random number of the user to obtain a first character string, encrypting the first character string to obtain a first data key, and encrypting user data according to the first data key; acquiring a user password, generating a target password according to the user password, splicing the target password and the user key random number to obtain a second character string, and encrypting the second character string to obtain a second data key; the second data key is used for determining a user key random number of the user when the encrypted user data is operated;

and the storage module is used for storing the encrypted user data.

9. An electronic device, characterized in that the device comprises a memory, a processor and a computer program stored on the memory and executable on the processor, which when executing the program implements the method of any of claims 1 to 7.

10. A computer storage medium on which a computer program is stored, characterized in that the computer program, when being executed by a processor, carries out the method of any one of claims 1 to 7.

Images