Personal data security protection method, electronic equipment and storage medium

Abstract

The invention discloses a personal data security protection method, electronic equipment and a storage medium, and the method comprises the steps: 1, a mobile device authenticates according to user biological characteristics, a password module generates user identity information which comprises a user master key, a public key, a private key and a user identification code after the authentication is passed, the master key and the private key are stored in the mobile device, and the user identification code is stored in the mobile device; the identification code is fed back to the user; 2, the mobile device encrypts the private key by using the master key and the identification code, and sends the public key and the encrypted private key to a cloud backup to complete registration; 3, when the user logs in the mobile device, inputting the identification code to obtain the encrypted private key and the random number from the cloud, decrypting the encrypted private key and the random number by using the master key after the biological characteristic authentication is passed, and comparing and checking with the local private key; and when the new device is logged in, the decrypted private key storage is obtained through the same operation, and the new device generates a new master key encryption private key and sends the new master key encryption private key to the cloud for replacement. According to the invention, the security management of the user key can be realized, so that the user identity security and the user data security can be effectively ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of personal data security protection, and specifically to a personal data security protection method, system and device. Background Art

[0002] With the development of computer network communication technology, the role of personal digitalization in the future society will become increasingly important. It will become the foundation and core pillar of the digitalization of the entire society, and the changes in the scale of the industry it brings may far exceed the digital systems of traditional organizations. However, in this process, personal data is often illegally obtained, leaked, and tampered with. Therefore, how to effectively solve the problem of personal data security has always attracted much attention. The traditional data security protection is mostly based on a centralized key management system, that is, encrypted data is stored in the hands of service providers, and the encryption keys are also in the hands of service providers. However, this centralized architecture is inherently unsafe. On the one hand, there is a risk that data can be used at will by service providers; on the other hand, once hacked, it will cause significant losses.

[0003] At present, the data security architecture mainly includes five parts: identity authentication, data protection, authorization and access control, and log audit. Identity authentication mainly solves the problem of user login, and mostly uses username and password login, but username and password are easy to forget and are also stored in the hands of cloud service providers; data protection mainly solves the problem of data confidentiality, and mostly uses international or domestic symmetric encryption algorithms, but the keys are generated by the key management center and controlled by the service provider. Therefore, user data can be viewed and used by service providers at will, posing a great risk to user privacy and security. Summary of the invention

[0004] The present invention aims to solve the deficiencies of the above-mentioned prior art and proposes a personal data security protection method, electronic device and storage medium, in order to realize decentralized private key management, so that the user's private key can be in the hands of the user, thereby effectively ensuring the user's identity security and user data security.

[0005] In order to achieve the above-mentioned purpose, the present invention adopts the following technical scheme:

[0006] The present invention is characterized in that a personal user data security protection method based on a mobile device is applied in a network environment composed of a mobile device and a cloud server, and includes the following steps:

[0007] S1. The mobile device authenticates the user based on the user's biometrics. If the authentication is successful, S2 is executed. Otherwise, S1 is returned.

[0008] S2. The password module on the mobile device generates the user's identity information, including: a user master key, a user public key, a user private key, and a user identification code, and directly stores the user master key and the user private key on the mobile device, and feeds back the user identification code to the corresponding user;

[0009] S3, the mobile device encrypts the user private key based on the user master key to obtain an encrypted first private key pri_key_sec1;

[0010] At the same time, a symmetric key is generated based on the user identification code to encrypt the user private key and obtain the encrypted second private key pri_key_sec2;

[0011] Finally, the user public key, the encrypted first private key pri_key_sec1, and the encrypted second private key pri_key_sec2 are sent to the cloud server for backup storage, thereby completing the user's identity information registration;

[0012] S4. When the user logs in to the mobile device, he / she enters his / her own user identification code and obtains the first encryption private key pri_key_sec1 and the first random number from the cloud server. At the same time, after the user's biometrics are authenticated on the mobile device, the user master key is obtained, thereby decrypting pri_key_sec1 to obtain the decrypted first user private key;

[0013] The decrypted first user private key is compared with the locally stored user private key. If they are the same, it means that the verification is passed and S5 is executed; otherwise, return to S4;

[0014] When the user logs in to a new mobile device, after the user's biometrics are authenticated on the mobile device, the user enters his / her own user identification code to obtain the second encrypted private key pri_key_sec2 and the second random number from the cloud server, and decrypts pri_key_sec2 based on the user identification code to obtain the decrypted second user private key and store it on the new mobile device;

[0015] The cryptographic module on the new mobile device generates a new user master key and stores it on the new mobile device, thereby using the new user master key to encrypt the decrypted second user private key, obtaining the encrypted second private key pri_key_sec2' and sending it to the cloud server, so that the cloud server replaces pri_key_sec1 with pri_key_sec2';

[0016] S5. Perform strong identity authentication on the user based on digital signature technology. If the authentication is successful, execute S6. Otherwise, return to S4.

[0017] S6. The mobile device uses a local password module to generate an encryption key for user data, which is used to encrypt the user data to obtain encrypted user data; then uses the user public key to encrypt the encryption key to obtain an encryption key result, and the user stores the encrypted user data and the encryption key result on a cloud server or mobile device, and obtains a storage path, and finally saves the storage path on the cloud server.

[0018] The personal data security protection method described in the present invention is also characterized in that in S5, the random number is digitally signed in combination with the user's private key and the hash algorithm, and the signature result is sent to the cloud server for verification. If the cloud server uses the public key to decrypt the signature result and compares it with the random number, it means that the signature verification is successful; if the cloud server uses the public key to decrypt the signature result and compares it with the random number, it means that the signature verification fails, thereby completing the user's strong identity authentication.

[0019] An electronic device of the present invention includes a memory and a processor, wherein the memory is used to store a program that supports the processor to execute the personal data security protection method, and the processor is configured to execute the program stored in the memory.

[0020] The present invention provides a computer-readable storage medium, wherein a computer program is stored on the computer-readable storage medium, and the computer program executes the steps of the personal data security protection method when the computer program is executed by a processor.

[0021] Compared with the prior art, the present invention has the following beneficial effects:

[0022] The present invention realizes the secure management of user private keys through mobile devices, and stores user private keys locally on user mobile devices through decentralized storage of user private keys, and realizes reading of private keys in combination with biometric identification of mobile devices, thereby realizing that user private keys are in the hands of users and ensuring the security of user data. The present invention realizes secure encryption of user private keys by designing user master keys, and realizes secure encryption of backup of user private keys by designing user identification codes, ensuring that users are unaware and that user identity information can be restored when changing devices, thereby achieving the purpose of not relying on mobile devices and being widely applicable. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 Provides a schematic diagram of the overall method flow for an embodiment of the present invention;

[0024] Figure 2 A user identity registration flow chart provided by an embodiment of the present invention;

[0025] Figure 3A user identity authentication flow chart provided for an embodiment of the present invention;

[0026] Figure 4 A data storage flow chart provided by an embodiment of the present invention;

[0027] Figure 5 A data security write flow chart provided by an embodiment of the present invention;

[0028] Figure 6 A data security reading flow chart provided by an embodiment of the present invention;

[0029] Figure 7 A block diagram of the internal units of the system provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0030] In this embodiment, Figure 1 As shown, a personal data security protection method is applied in a network environment consisting of a mobile device and a cloud server, and is performed in the following steps:

[0031] Step 1: Based on the local biometric recognition of the mobile device, including face and fingerprint, if the device does not support it, gestures can be added to achieve authentication between the user and the mobile device.

[0032] In this embodiment, biometrics based on the local mobile device are used. If the device does not support biometrics, gesture recognition can be added, and fingerprint recognition and face recognition are preferentially supported. When the mobile device does not support biometrics, gesture authentication recognition is added.

[0033] Step 2: The password module of the mobile device generates user identity information, including: user master key, user public key, user private key, and user identification code. The user master key and user private key are stored locally on the mobile device and can only be read after biometric authentication. The user identification code is saved and remembered by the user.

[0034] In this embodiment, domestic cryptographic algorithms are used, including symmetric cryptographic algorithm SM4, asymmetric cryptographic algorithm SM2, and hash algorithm SM3, wherein the symmetric key is 128 bits, the private key length is 256 bits, the public key length is 512 bits, and the user identification code is composed of a 64-bit user master key and a 128-bit key. The 128-bit key of the user identification code is data that has been processed and obfuscated according to certain rules, and is memorized and collected by the user. At the same time, combined with the local file management of the mobile terminal device, the user master key and the user private key are saved in the keystore file, and are set to be accessible only after biometric authentication.

[0035] Step 3, the mobile device encrypts the user's private key based on the user master key to obtain the first encrypted private key pri_key_sec1. The user identification code encrypts the user's private key according to certain rules to obtain the second encrypted private key pri_key_sec2. Upload the user's public key, the first encrypted private key pri_key_sec1 and the second encrypted private key pri_key_sec2 to the cloud server for storage to complete the user identity registration. The rule definition can refer to the following method, and the user can also define it by himself: the 128-bit symmetric key string generated by the mobile device password module, and the letters are all uppercase. First, the numbers in the 128-bit symmetric key string are replaced by 0 and 9, 1 and 8, 2 and 7, 3 and 6, 4 and 5. Finally, the letters in the 128-bit symmetric key string are replaced by A and Z, BY, C and X,... to obtain a new 128-bit string, plus the user master key is the user identification code, which the user needs to remember and collect. When decrypting, the symmetric key can be generated in reverse according to the above rules.

[0036] When the user passes the biometric identification and generates the user identity information, the user identity information will be processed securely. Specifically, the user master key and user private key are stored in the keystore, and can only be accessed after setting the biometric authentication. The user private key is encrypted with the user master key, recorded as the first encrypted private key pri_key_sec1, and the user private key is encrypted with the identification code, recorded as the second encrypted private key pri_key_sec2. The user public key, the first encrypted private key pri_key_sec1, and the second encrypted private key pri_key_sec2 are placed in the cloud server for backup storage.

[0037] Specifically, the following steps are also included:

[0038] a) Through biometric identification of mobile devices, the relationship between users and devices is bound;

[0039] b) After completing biometric identification, the user identity information is generated locally on the mobile device, including the user master key, user public key, user private key, and user identification code;

[0040] c) Securely process the user identity information, use a cryptographic symmetric algorithm, and encrypt the user's private key with the user's master key, recorded as the first encrypted private key pri_key_sec1; use a national secret symmetric algorithm, and encrypt the user's private key with the user identification code according to the rules, recorded as the second encrypted private key pri_key_sec2.

[0041] Specifically, the user identification code consists of a 64-bit user master key and a 128-bit key, where the user master key is a 64-bit uuid string generated by the system, and the 128-bit national secret symmetric key is processed by specific rules and is memorized by the user and not uploaded to the cloud. The rule definition can refer to the following method, and the user can also define it by himself: First, the numbers in the 128-bit symmetric key string are replaced by 0 and 9, 1 and 8, 2 and 7, 3 and 6, 4 and 5, and then the letters in the 128-bit symmetric key string are replaced by A and Z, BY, C and X, ... to obtain a new 128-bit string, plus the user master key is the user identification code. When the encrypted private key is decrypted, the key is restored by the cryptographic unit to obtain a 128-bit key, and the second encrypted private key pri_key_sec2 is decrypted.

[0042] d) The user identity information after security processing, including the user public key, the first encrypted private key pri_key_sec1 and the second encrypted private key pri_key_sec2, is backed up in the cloud server storage.

[0043] Step 4. When the user logs in to the mobile device, he enters the user identification code, obtains the first encrypted private key pri_key_sec1 and the first random number from the cloud server, obtains the user master key based on the biometric authentication of the mobile device, decrypts the first encrypted private key pri_key_sec1, obtains the decrypted first user private key and compares it with the local private key. If they are the same, it means that the verification is passed and execute step 5; otherwise, return to step 4.

[0044] When the user logs in to the new mobile device, the user enters the user identification code, obtains the second encrypted private key pri_key_sec2 and the second random number from the cloud server, and decrypts the second encrypted private key pri_key_sec2 based on the user identification code to obtain the decrypted second user private key and store it on the new mobile device;

[0045] A new user master key is generated on the new mobile device and stored on the new mobile device. The decrypted second user private key is encrypted using the new user master key to obtain the encrypted second private key pri_key_sec2' and send it to the cloud server, so that the cloud server replaces pri_key_sec1 with pri_key_sec2'.

[0046] Step 5. Combine the user's private key obtained by decryption and the hash algorithm to digitally sign the random number, and send the signature result to the cloud server for verification. If the cloud server uses the public key to decrypt the signature result and compare it with the random number, it means that the signature verification is successful; if the cloud server uses the public key to decrypt the signature result and compare it with the random number, it means that the signature verification fails, thereby completing the user's strong identity authentication, that is, based on the first-level biometric authentication of the mobile device, and then based on the comparison of the local private key to perform the second-level verification authentication, and finally combine the digital signature to achieve the third-level identity authentication.

[0047] Step 6: Use the local password module of the mobile device to generate a data encryption key to encrypt personal user data, and then use the user's public key to encrypt the encryption key to form encrypted data and encryption key data. The individual user decides whether to store in the cloud or in private storage, and saves the data storage path on the cloud data directory server.

[0048] When users save personal data, they first select a storage location, including cloud storage and private storage (mobile phone, NAS, etc.), call the domestic cryptographic unit module, generate a data encryption key, encrypt personal user data, record it as security data, and then use the user's public key to encrypt the encryption key, record it as a security key. According to the storage location, upload the security data and security key to the storage space, return to the storage location, and save it on the cloud data directory server.

[0049] When a user reads personal data, the data overview and physical storage location are first returned from the data directory, and the security data and security key are downloaded based on the physical storage location. The user's private key is obtained and the security key is decrypted through the local biometrics of the mobile device. The security data is decrypted using the key, and the original data is finally obtained.

[0050] like Figure 2 As shown, user identity registration is carried out in the following steps:

[0051] Step 1. On the login registration page, select the register button to register your user identity;

[0052] Step 2: Enable the local biometric recognition function of the mobile device. If it is not enabled, the user needs to enter the biometric information. If it is already enabled, the biometric authentication can be called directly. If the device does not support the biometric recognition function, it is necessary to add gesture password entry to realize the identity recognition between the user and the device.

[0053] Step 3: After the biometric identification is passed, the domestic cryptographic unit and identity management unit are called to generate the user master key, user public key, user private key, and user identification code, and the user identity data is securely processed, including encrypting the private key with the master key and encrypting the private key with the identification code, and storing the master key and private key in the local keystore;

[0054] Specifically, after biometric recognition and user identity security processing, a user identification code is generated, and the software page reminds the user to remember and save it for the recovery of the user's private key when the device is replaced later.

[0055] Step 4: Back up the securely processed user identity information including the user public key, the first encrypted private key pri_key_sec1 and the second encrypted private key pri_key_sec2 in cloud storage.

[0056] like Figure 3 As shown, user identity authentication is performed in the following steps:

[0057] Step 1: On the login and registration page, enter the user identification code;

[0058] Step 2. Click the login button to complete user authentication.

[0059] Determine whether the local biometric recognition function of the mobile device is enabled. If it is not enabled, the user needs to enter the biometric information; if it is enabled, the biometric authentication can be called directly; if the device does not support the biometric recognition function, it is necessary to add gesture password entry to realize the identity recognition of the user and the device;

[0060] Step 3: After the biometric identification is passed, the password unit and identity management unit are called for authentication;

[0061] Specifically, determine whether the device has the user master key and user private key locally, that is, whether it is a new device. If so (re-authentication of old device), request to obtain the user encryption private key pri_key_sec1 through the user identification code, and decrypt the user private key through the local master key; if not (new device login), request to obtain the user encryption private key pri_key_sec2 through the user identification code, decrypt it, and then regenerate the master key to encrypt the user private key, and replace the user encryption private key pri_key_sec1 on the cloud server. Finally, strong authentication of user identity is achieved through digital signature.

[0062] like Figure 4As shown in the figure, the personal data storage process defines personal data types, including personal unstructured data, personal structured data, and semi-structured OCR recognized data. For personal unstructured data, after symmetric key encryption, the physical location of storage is returned to the data directory; for structured data, it is converted according to entity objects, a json file is generated, and after symmetric key encryption, the physical location of storage is returned to the data directory; for semi-structured OCR recognized data, the recognized structured data is converted according to entity objects, a json file is generated, and after symmetric key encryption, the physical location of storage is returned to the data directory. Among them, the data storage location can be selected by the user, including public cloud storage and private cloud storage, and the security data and security keys are packaged for storage, and the physical storage location of the data is returned.

[0063] like Figure 5 As shown, the personal data security writing process is as follows:

[0064] Step 1: At the current node, call the data directory unit, process personal data according to the personal data storage standard, encrypt personal data using the national secret symmetric algorithm, and obtain secure data;

[0065] Step 2: Call the cryptographic unit to generate a data encryption symmetric key, encrypt the symmetric key with the user's public key, and obtain a security key;

[0066] Step 3: Select a personal data storage location, public cloud storage or private cloud storage, store the security data and security keys together, and return the data to the physical storage location;

[0067] Step 4: Store the physical storage location of the above data in the data directory service to implement the personal data security write process.

[0068] like Figure 6 As shown, the personal data security reading process is as follows:

[0069] Step 1: At the current node, call the cloud data directory unit to obtain a data overview, including data type, data size, data identifier, data physical storage path, etc.

[0070] Step 2: Check the data details and download the data from the storage space to the local device according to the data identifier and the physical storage path of the data, including security data and security keys;

[0071] Step 3: Based on the biometric authentication of the mobile device, read the local user private key to decrypt the security key, use the security key to decrypt the security data, and then display the interface.

[0072] like Figure 7As shown, the personal data security protection system includes a biometric recognition unit, a domestic cryptographic unit, an identity management unit and a data directory unit.

[0073] The biometric unit authenticates the mobile device through local biometrics or gestures. At the same time, the storage and reading of the local user master key and user private key of the device must also be subject to biometric authentication.

[0074] The domestic password generation unit is used to generate user identity information of a user master key, a user public key, a user private key, and a user identification code locally on the mobile device;

[0075] The user identity management unit is used to securely process user identity information, including local storage of user master keys and user private keys; encrypting user private keys using user master keys and encrypting user private keys using user identification codes;

[0076] In user data protection, the data directory and security unit use the national secret symmetric algorithm to encrypt personal data and encryption keys on the one hand, and store the physical address of the encrypted data in the data directory on the other hand to achieve the separation of application and data.

[0077] It should be noted that the implementation process of the functions and effects of each unit module of the system is specifically described in the implementation process of the corresponding steps in the above method, which will not be repeated here.

[0078] A personal data security protection generating device comprises: a processor, a memory and an application, wherein the application is stored in the memory and is configured to be executed by the processor, and the processor implements the above-mentioned personal data security protection method when executing the application.

Claims

1. A personal user data security protection method based on a mobile device, characterized in that: It is applied in a network environment consisting of mobile devices and cloud servers, and includes the following steps: S1. The mobile device authenticates the user based on the user's biometrics. If the authentication is successful, S2 is executed. Otherwise, S1 is returned. S2. The password module on the mobile device generates the user's identity information, including: a user master key, a user public key, a user private key, and a user identification code, and directly stores the user master key and the user private key on the mobile device, and feeds back the user identification code to the corresponding user; S3, the mobile device encrypts the user private key based on the user master key to obtain an encrypted first private key pri_key_sec1; At the same time, a symmetric key is generated based on the user identification code to encrypt the user private key and obtain the encrypted second private key pri_key_sec2; Finally, the user public key, the encrypted first private key pri_key_sec1, and the encrypted second private key pri_key_sec2 are sent to the cloud server for backup storage, thereby completing the user's identity information registration; S4. When the user logs in to the mobile device, he / she enters his / her own user identification code and obtains the first encryption private key pri_key_sec1 and the first random number from the cloud server. At the same time, after the user's biometrics are authenticated on the mobile device, the user master key is obtained, thereby decrypting pri_key_sec1 to obtain the decrypted first user private key; The decrypted first user private key is compared with the locally stored user private key. If they are the same, it means that the verification is passed and S5 is executed; otherwise, return to S4; When the user logs in to a new mobile device, after the user's biometrics are authenticated on the mobile device, the user enters his / her own user identification code to obtain the second encrypted private key pri_key_sec2 and the second random number from the cloud server, and decrypts pri_key_sec2 based on the user identification code to obtain the decrypted second user private key and store it on the new mobile device; The cryptographic module on the new mobile device generates a new user master key and stores it on the new mobile device, thereby using the new user master key to encrypt the decrypted second user private key, obtaining the encrypted second private key pri_key_sec2' and sending it to the cloud server, so that the cloud server replaces pri_key_sec1 with pri_key_sec2'; S5. Perform strong identity authentication on the user based on digital signature technology. If the authentication is successful, execute S6. Otherwise, return to S4. S6. The mobile device uses a local password module to generate an encryption key for user data, which is used to encrypt the user data to obtain encrypted user data; then uses the user public key to encrypt the encryption key to obtain an encryption key result, and the user stores the encrypted user data and the encryption key result on a cloud server or mobile device, and obtains a storage path, and finally saves the storage path on the cloud server.

2. The personal data security protection method according to claim 1, characterized in that: In S5, the random number is digitally signed in combination with the user's private key and the hash algorithm, and the signature result is sent to the cloud server for verification. If the cloud server uses the public key to decrypt the signature result and compares it with the random number, it means that the signature verification is successful; if the cloud server uses the public key to decrypt the signature result and compares it with the random number, it means that the signature verification fails, thereby completing the user's strong identity authentication.

3. An electronic device, comprising a memory and a processor, characterized in that: The memory is used to store a program that supports the processor to execute the personal data security protection method described in claim 1 or 2, and the processor is configured to execute the program stored in the memory.

4. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the personal data security protection method according to claim 1 or 2 are executed.

Images