Data processing method, device, electronic device and medium

Abstract

The embodiments of the present application disclose a data processing method, device, electronic device and medium, which are applied to the field of cloud technology, and specifically to the field of cloud security technology. The method includes: obtaining the client account data of the authorized target client in the storage client, and obtaining the storage key for the client account data, encrypting the client account data based on the storage key, obtaining the encrypted client account data, and storing the encrypted client account data. When the output instruction for the client account data is obtained in the storage client, based on the stored encrypted client account data, the client account data is restored and output in the client interface of the storage client. The embodiments of the present application can improve the security of data storage. The present application relates to blockchain technology, such as writing encrypted client account data into the blockchain.

Description

Technical Field

[0001] The present application relates to the field of cloud technology, and in particular to a data processing method, device, electronic device and medium. Background Art

[0002] At present, as users need to remember more and more client account data, the demand for unified storage of multiple client account data is also increasing. The existing client account data storage method is usually to manually add data and upload it to a remote server for storage. However, if the data is intercepted by hackers during the data transmission process, it is easy to cause data leakage, which in turn brings risks and losses to users. Therefore, how to improve the security of data storage in the process of storing client account data has become an urgent problem to be solved. Summary of the invention

[0003] The embodiments of the present application provide a data processing method, device, electronic device and medium, which can improve the security of data storage.

[0004] On the one hand, an embodiment of the present application provides a data processing method, the method comprising:

[0005] Obtaining client account data of an authorized target client in a storage client, and obtaining a storage key for the client account data;

[0006] Encrypting the client account data based on the storage key to obtain encrypted client account data, and storing the encrypted client account data;

[0007] When an output instruction for the client account data is obtained in the storage client, the client account data is restored and outputted on the client interface of the storage client based on the stored encrypted client account data.

[0008] On the one hand, an embodiment of the present application provides a data processing device, the device comprising:

[0009] An acquisition module, used to acquire the client account data of the authorized target client in the storage client, and acquire a storage key for the client account data;

[0010] an encryption module, configured to encrypt the client account data based on the storage key, obtain the encrypted client account data, and store the encrypted client account data;

[0011] An output module is used to restore and output the client account data on the client interface of the storage client based on the stored encrypted client account data when an output instruction for the client account data is obtained in the storage client.

[0012] On the one hand, an embodiment of the present application provides an electronic device, which includes a processor and a memory, wherein the memory is used to store a computer program, the computer program includes program instructions, and the processor is configured to call the program instructions to execute some or all of the steps in the above method.

[0013] On the one hand, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program, and the computer program includes program instructions, which, when executed by a processor, are used to execute some or all of the steps in the above method.

[0014] Accordingly, according to one aspect of the present application, a computer program product or computer program is provided, the computer program product or computer program comprising program instructions, the program instructions being stored in a computer-readable storage medium. A processor of a computer device reads the program instructions from the computer-readable storage medium, and the processor executes the program instructions, so that the computer device performs the data processing method provided above.

[0015] In the embodiment of the present application, the client account data of the authorized target client can be obtained in the storage client, and the storage key for the client account data can be obtained, the client account data can be encrypted based on the storage key to obtain the encrypted client account data, and the encrypted client account data can be stored. When the output instruction for the client account data is obtained in the storage client, the client account data can be restored and outputted in the client interface of the storage client based on the stored encrypted client account data. By implementing the above-mentioned method, when the authorized client account data is obtained, the data can be encrypted and stored in the storage client using the storage key. Subsequently, the client account data can be restored and outputted more securely through the encrypted stored data, thereby improving the security of data storage. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0017] Figure 1aA schematic diagram of an application architecture provided for an embodiment of the present application;

[0018] Figure 1b A schematic diagram of an application architecture provided for an embodiment of the present application;

[0019] Figure 2 A flowchart of a data processing method provided in an embodiment of the present application;

[0020] Figure 3a A schematic diagram of a scenario for determining a target client provided in an embodiment of the present application;

[0021] Figure 3b A schematic diagram of a scenario for determining a target client provided in an embodiment of the present application;

[0022] Figure 4 A schematic diagram of a scenario for encrypting data provided in an embodiment of the present application;

[0023] Figure 5a A schematic diagram of a scenario for outputting client account data provided in an embodiment of the present application;

[0024] Figure 5b A schematic diagram of a scenario for outputting client account data provided in an embodiment of the present application;

[0025] Figure 6 A flowchart of a data processing method provided in an embodiment of the present application;

[0026] Figure 7a A schematic diagram of a data processing scenario provided in an embodiment of the present application;

[0027] Figure 7b A schematic diagram of a data processing scenario provided in an embodiment of the present application;

[0028] Figure 7c A schematic diagram of a data processing scenario provided in an embodiment of the present application;

[0029] Figure 7d A schematic diagram of a data processing scenario provided in an embodiment of the present application;

[0030] Figure 8 A schematic diagram of the structure of a data processing device provided in an embodiment of the present application;

[0031] Fig. 9 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0032] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0033] The data processing method proposed in the embodiment of the present application can be implemented in an electronic device, which can be a server or a terminal device. Among them, the server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The terminal device can be a smart phone, a tablet computer, a laptop, a desktop computer, a smart speaker, a smart watch, etc., but is not limited to this.

[0034] The embodiments of the present application may involve technical fields related to cloud technology, such as cloud security technology, where cloud security refers to the general term for security software, hardware, users, organizations, and security cloud platforms based on cloud computing business model applications. Cloud security integrates emerging technologies and concepts such as parallel processing, grid computing, and unknown virus behavior judgment. It monitors abnormal software behavior in the network through a large number of meshed clients, obtains the latest information on Trojans and malicious programs on the Internet, and sends it to the server for automatic analysis and processing, and then distributes solutions to viruses and Trojans to each client. Secure storage of data can be achieved by executing the technical solution of this application and using cloud security services.

[0035] See also Figure 1a , Figure 1a The following is a schematic diagram of an application architecture provided in an embodiment of the present application, through which the data processing method proposed in the present application can be executed. Figure 1a As shown, Figure 1a It may include an electronic device (here the electronic device is taken as a terminal device as an example) and a storage server. Among them, the terminal device can obtain the client account data of the authorized client by executing the technical solution of the present application, and encrypt the client account data, and the terminal device stores the encrypted client account data through the storage client and the storage server, thereby improving the security of data storage. And, when the client account data needs to be viewed in the storage client, the terminal device can obtain the encrypted client account data from the storage client or the storage server, and restore and output the client account data based on the encrypted client account data in the storage client. Optionally, the storage server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server.

[0036] In one possible implementation, see Figure 1b , Figure 1bA schematic diagram of an application architecture provided in an embodiment of the present application, in Figure 1a On the basis of the storage client, a management client may also be included. Before installing the storage client, the terminal device needs to send a client download request for the storage client to the management client. After the management client verifies the user identity information of the target user carried in the client download request, the storage client installation data package and the client login password are sent to the terminal device. Based on this, the terminal device can install and log in to the storage client, and then obtain or restore the output client account data in the logged-in storage client.

[0037] Understandably, Figure 1a and Figure 1b The application architecture proposed in the embodiment of the present application is only exemplified, and does not limit the specific architecture of the technical solution of the present application. That is, the technical solution of the present application can also provide other forms of application architecture. For the sake of convenience, unless otherwise specified, the data processing methods mentioned later are all based on the application in Figure 1b The application architecture shown is used as an example for explanation.

[0038] Optionally, in some embodiments, the electronic device may execute the data processing method to improve the security of data storage according to actual business needs. For example, the technical solution of the present application may be applied to the scenario of uniformly storing client account data of multiple clients. The electronic device may encrypt the client account data of multiple authorized clients through the technical solution of the present application and store it in the storage client or storage server. When receiving the output instruction, the storage client may restore and output the encrypted client account data.

[0039] Optionally, the data involved in this application, such as encrypted client account data, user identity information of the target user, etc., can be stored in a database, or can be stored in a blockchain, such as through a blockchain distributed system, which is not limited in this application. For example, a storage server can be a node in a blockchain.

[0040] Among them, blockchain is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, encryption algorithm, etc. Blockchain is essentially a decentralized database, a string of data blocks generated by cryptographic methods. Each data block contains a batch of network transaction information, which is used to verify the validity of its information (anti-counterfeiting) and generate the next block. Blockchain can include the underlying blockchain platform, platform product service layer, and application service layer.

[0041] The underlying blockchain platform can include processing modules such as user management, basic services, smart contracts, and operation monitoring. Among them, the user management module is responsible for the identity information management of all blockchain participants, including maintaining public and private key generation (account management), key management, and the maintenance of the correspondence between the user's real identity and the blockchain address (authority management), etc., and, under authorization, supervises and audits the transactions of certain real identities and provides risk control rule configuration (risk control audit); the basic service module is deployed on all blockchain node devices to verify the validity of business requests, and records valid requests to storage after consensus is reached. For a new business request, the basic service first adapts the interface for parsing and authentication (interface adaptation), and then encrypts the business information through the consensus algorithm (consensus management). The smart contract module is responsible for the registration and issuance of contracts, as well as contract triggering and contract execution. Developers can define the contract logic in a programming language and publish it to the blockchain (contract registration). According to the logic of the contract terms, the key or other events are called to trigger the execution and complete the contract logic. It also provides the function of contract upgrade and cancellation. The operation monitoring module is mainly responsible for the deployment, configuration modification, contract setting, cloud adaptation and real-time status visualization output of the product during the product release process, such as alarm, network monitoring, node equipment health monitoring, etc.

[0042] The platform product service layer provides the basic capabilities and implementation framework of typical applications. Developers can build on these basic capabilities and superimpose business features to complete the blockchain implementation of business logic. The application service layer provides application services based on blockchain solutions for business participants to use. For example, in this application, data storage functions can be provided through blockchain, and the stored data, such as encrypted client account data, can be provided to target users.

[0043] It is understood that the above scenarios are only examples and do not constitute a limitation on the application scenarios of the technical solutions provided in the embodiments of the present application. The technical solutions of the present application can also be applied to other scenarios. For example, it is known to those skilled in the art that with the evolution of the system architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0044] Based on the above description, the present application embodiment proposes a data processing method, which can be executed by the electronic device mentioned above. Here, the electronic device is taken as a terminal device for example. Figure 2 , Figure 2 A flow chart of a data processing method provided in an embodiment of the present application. Figure 2 As shown, the process of the data processing method of the embodiment of the present application may include the following:

[0045] S201. Obtain client account data of an authorized target client in a storage client, and obtain a storage key for the client account data.

[0046] The target client may be a web client or an application client installed in a terminal device, and the client account data may include information such as a user name and password for logging into the target client. In addition, there may be one or more target clients, and correspondingly, the acquired client account data may be one or more. The data processing process and principle of the client account data for each target client are the same, and here the target client and the corresponding client account data are one as an example for explanation.

[0047] In a possible implementation, the terminal device determines the target client in a specific manner as follows: according to the client authorization operation in the storage client, output a client authorization list, the client authorization list includes M clients to be authorized, M is a positive integer, and according to the selection operation for the M clients to be authorized, the selected client to be authorized is determined as the target client. Wherein, the selection operation can be a click operation, a long press operation, a sliding operation or a voice instruction operation for the client to be authorized that needs to be authorized in the client authorization list. Wherein, the selection operation for the M clients to be authorized can be a selection operation to determine one target client, or a selection operation to determine multiple target clients, such as a batch selection operation for the M clients to be authorized. And when the terminal device detects the selection operation for the client to be authorized, the client to be authorized is determined as an authorized target client, and after authorization, the terminal device has the authority to access the target client at any time through the storage client, and based on the authority, the terminal device can obtain the historical account data of the target client or the account data after the historical account data is modified in the storage client, and use the historical account data or the modified account data as the client account data.

[0048] For example, Figure 3a As shown, Figure 3a A schematic diagram of a scenario for determining a target client provided in an embodiment of the present application, wherein a terminal device outputs a client authorization list in a storage client according to a client authorization operation in a storage client, wherein the client authorization list has multiple clients to be authorized (such as client 1, client 2, client 3, client 4...), and a target user can search for the client name through a search bar or quickly retrieve the corresponding client to be authorized by the first letter of the client name, and the terminal device can determine the selected client to be authorized as the target client (such as client 1, client 2, client 3, client 4...) according to the selection operation in the client authorization list. Figure 3aThe target client is client 3), and after authorization, the client account data of the target client can be obtained in the storage client.

[0049] For example, Figure 3b As shown, Figure 3b A schematic diagram of a scenario for determining a target client provided in an embodiment of the present application, wherein the terminal device outputs a client authorization list in the storage client according to the client authorization operation in the storage client, and the client authorization list has multiple clients to be authorized (such as client 1, client 2, client 3, client 4...), and the target user can determine multiple target clients by triggering a batch selection control, that is, in Figure 3b In (1), after the batch selection control is detected to be triggered, a circular icon corresponding to each client to be authorized can be viewed in the client authorization list, and batch selection can be performed by selecting operations in the circular icons, and all the clients to be authorized can be selected by triggering the all-select control; Figure 3b In (2), after selecting the circular icons corresponding to client 1 and client 3, there is an icon in the circular icons to indicate that they are checked. After clicking the confirmation control, the terminal device determines the selected client to be authorized as the target client (such as Figure 3b (2) refers to client 1, client 3, etc.).

[0050] In one possible implementation, the terminal device obtains the storage key for the client account data by generating an encrypted random number for encrypting the client account data, obtaining an encrypted account key for encrypting the encrypted random number, and using the encrypted random number and the encrypted account key as the storage key.

[0051] S202: Encrypt the client account data based on the storage key to obtain the encrypted client account data, and store the encrypted client account data.

[0052] In one possible implementation, the terminal device encrypts the client account data based on the storage key, specifically by encrypting the client account data based on the encrypted random number to obtain account encrypted data, and encrypting the encrypted random number based on the encrypted account key to obtain random number encrypted data, and determining the account encrypted data and the random number encrypted data as the encrypted client account data. Encrypting both the client account data and the encrypted random number before storing can effectively increase the difficulty of decrypting the encrypted client account data, thereby improving security. After obtaining the encrypted client account data, the terminal device stores the encrypted client account data in a storage client in the terminal device, and then can obtain the stored encrypted data in the storage client and restore and output it.

[0053] For example, Figure 4 As shown, Figure 4 A scenario diagram of encrypted data provided for an embodiment of the present application, wherein, when the electronic device obtains the client account data of the target client in the storage client, it uses a random number source or a random number generator to obtain an encrypted random number, and obtains encrypted account data based on the encrypted random number, and then encrypts the encrypted random number based on the preselected and packaged encrypted account key in the storage client to obtain random number encrypted data, and obtains the encrypted client account data based on the encrypted account data and the random number encrypted data.

[0054] S203: When an output instruction for the client account data is obtained in the storage client, the client account data is restored and outputted on the client interface of the storage client based on the stored encrypted client account data.

[0055] In one possible implementation, the specific way in which the terminal device obtains the output instruction for the client account data in the storage client may be to output the client authorized list according to the account data viewing operation in the storage client, and the client authorized list includes N authorized clients, where N is a positive integer. When a selection operation for a target client among the N authorized clients is detected, the output instruction for the client account data is obtained in the storage client. Then, the client account data corresponding to the selected target client will be output in the client interface of the storage client. Among them, the selection operation may be a click operation, a long press operation, a sliding operation, or a voice instruction operation for the target client in the client authorized list.

[0056] For example, Figure 5a As shown, Figure 5a A schematic diagram of a scenario for outputting client account data provided in an embodiment of the present application, wherein a terminal device outputs a client authorized list in a storage client according to an account data viewing operation in a storage client, the client authorized list having multiple authorized clients (such as client 1, client 3, ...), the storage client storing client account data of each authorized client, a target user can search for a client name through a search bar or quickly retrieve a corresponding authorized client by the first letter of the client name, and the terminal device can select a target client (such as client 3) in the client authorized list (such as client 1). Figure 5a(1)), that is, after obtaining the output instruction for the client account data, the client account data details page (i.e., the client interface) of the target client will pop up, and the detailed client account data (such as user name, password, private relative information, homepage address of the target client, etc.) can be viewed on the details page, that is, the client account data can be restored and output based on the encrypted client account data in the client interface of the storage client and viewed (such as Figure 5a (2)).

[0057] For example, Figure 5b As shown, Figure 5b A schematic diagram of a scenario for outputting client account data provided by an embodiment of the present application, wherein when viewing client account data, an encrypted display control (such as Figure 5b (1)), the target user can trigger the encrypted display control so that the client account data is not directly displayed in plain text (such as Figure 5b (2)) to prevent the client account data from being directly displayed on the client interface and being seen by other users.

[0058] In one possible implementation, the terminal device restores and outputs the client account data on the client interface of the storage client based on the stored encrypted client account data. Specifically, the stored encrypted client account data is obtained in the storage client, and the random number encrypted data included in the encrypted client account data is decrypted using the decryption account key corresponding to the encryption account key to obtain the encrypted random number, and the account encrypted data included in the encrypted client account data is decrypted based on the encrypted random number obtained by decryption to obtain the client account data, and the decrypted client account data is output on the client interface. The encrypted account data and the decrypted account data may be the same or different.

[0059] In the embodiment of the present application, the client account data of the authorized target client can be obtained in the storage client, and the storage key for the client account data can be obtained, the client account data can be encrypted based on the storage key to obtain the encrypted client account data, and the encrypted client account data can be stored. When the output instruction for the client account data is obtained in the storage client, the client account data can be restored and outputted in the client interface of the storage client based on the stored encrypted client account data. By implementing the method proposed in the embodiment of the present application, when the authorized client account data is obtained, the data can be encrypted and stored in the storage client using the storage key. Subsequently, the client account data can be restored and outputted more securely through the encrypted stored data, thereby improving the security of data storage.

[0060] Please attend Figure 6, Figure 6 The present invention provides a flow chart of a data processing method according to an embodiment of the present invention. The method can be executed by the electronic device mentioned above. Here, the electronic device is a terminal device as an example for explanation. Figure 6 As shown, the process of the data processing method in the embodiment of the present application may include the following:

[0061] S601: Obtain client account data of an authorized target client in a storage client, and obtain a storage key for the client account data.

[0062] The specific implementation of determining the target client can refer to the relevant description of the above step S201, which will not be repeated here.

[0063] In one possible implementation, the specific method for the terminal device to obtain the client account data of the authorized target client in the storage client may be to obtain the existing historical account data in the target client based on the storage client, and use the historical account data as the client account data; or, when a modification operation on the historical account data is detected in the storage client, the account data after the modification of the historical account data is determined as the client account data. That is, after the storage client is authorized to access the target client at any time, the terminal device can obtain the historical account data in the target client through the storage client, and encrypt or store the historical account data as the client account data. If the historical account data is detected to be modified in the storage client, the modified historical account data is obtained, and it is encrypted or stored as the client account data; if the modified historical account data is stored as the client account data, the encrypted client account data obtained based on the historical account data will be stored before. That is, the terminal device will use the latest account data as the client account data.

[0064] In one possible implementation, the storage key for data encryption may include an encrypted random number and an encrypted account key, so the terminal device may obtain the storage key for the client account data by: generating an encrypted random number for the client account data, obtaining the encrypted account key generated based on the client account data, and determining the encrypted random number and the encrypted account key as the storage key. It can be understood that the encrypted account key is a key generated based on the client account data and dedicated to the target user, for example, the encrypted account key may be generated based on the user name in the client account data, or may be generated based on the user name in the storage client used to encrypt or store the client account data. Each time the same or different client account data is encrypted based on the storage key of the target user, the encrypted account key may be the same or different. For example, the same encrypted account key may be used when performing encryption operations on the client account data of all authorized target clients, or different encrypted account keys may be used for different target clients when performing encryption operations on the client account data of all authorized target clients. Furthermore, the encrypted random number can be generated using a random number source or a random number generator, and each time an encryption operation is performed on client account data, a new encrypted random number is generated, that is, the encrypted random number is different each time encryption is performed; the target user is the user to whom the terminal device belongs.

[0065] In one possible implementation, before the terminal device obtains the client account data of the authorized target client in the storage client, it needs to install and log in the storage client. Therefore, the specific implementation may be that the terminal device sends a client download request of the target user for the storage client to the management client, and the client download request includes the user identity information of the target user. And the terminal device will obtain the client installation data packet and the client login password of the storage client sent by the management client, the client installation data packet encapsulates the user identity information, and the user identity information and the client login password have a mapping relationship, wherein, since the client login password can be generated based on the user identity information (such as a valid identity document in the user identity information), the client login password and the user identity information of the target user have a mapping relationship. Then the terminal device can install the storage client based on the client installation data packet, and when it is detected that the installed storage client encapsulates the user identity information with the client login password, the storage client is logged in based on the client login password, and the client login password can be modified after logging in to the storage client, and the terminal device can obtain the client account data in the logged in storage client. The management client may be a web page or an application client, etc. The client download request may also include the storage space required by the target user, and the user identity information including the target user's name, contact information, valid ID, etc. Optionally, in addition to logging in to the storage client through the client login password, the terminal device may also log in through a third-party authentication method (such as using other clients), or may also log in through face recognition of the target user.

[0066] Optionally, after the administrator of the management client has reviewed and approved the user identity information of the target user, the management server corresponding to the management client will initialize the storage client, and the specific method may be:

[0067] (1) The management server creates a user name for the target user in the storage server, generates a corresponding client login password, allocates a storage space of a specified size to the target user in the storage server based on the instruction of the client download request, and sets the access permission of the storage space to allow only the target user to read and write;

[0068] (2) The management server generates an encryption account key and a decryption account key corresponding to the target user based on the user identity information, and encapsulates the encryption account key, the decryption account key, the network address of the storage server, and the user name of the target user in the storage server into a client installation data packet of the storage client, so that the terminal device can directly obtain the required information from the storage client installed based on the client installation data packet;

[0069] (3) The management server will also set a recovery password (such as a valid ID) for restoring the storage server and an acquisition password for obtaining data from the storage server. Only after the acquisition password is successfully verified can the terminal device obtain the client account data from the storage server, and the recovery password and acquisition password will be sent to the terminal device;

[0070] (4) The management server will also create a user record of the target user in the user information database, which records the user identity information of the target user, and a storage client recovery file, which includes the user name in the storage server and the network address where the target user stores the client account data in the storage server, as well as the encrypted account key and the encrypted account key. After the data in the storage client of the terminal device is lost or the data file in the storage client is damaged, or the storage client needs to be reinstalled and the client installation data package is lost, the storage client can be restored in the management server through the recovery password, that is, after the management client verifies that the recovery password is correct, the management server will query the relevant information of the target user from the user information database, and based on the relevant information queried, restore the data of the storage client or return the client installation data package, etc. It can be understood that the management server can manage the storage server, that is, it can create a storage space in the storage server that is readable only by a specified user, and obtain or back up the data in the storage server.

[0071] Optionally, the terminal device may first download and install a storage client for initialization operations, and send an application request carrying the user identity information of the target user to the management client through the storage client. After the management client receives the user identity information and reviews it, the management server creates a user name in the storage server, generates an encryption account key and a decryption account key, and sends the network address, encryption account key, decryption account key and user name of the storage server to the storage client, and the terminal device can set a client login password in the storage client.

[0072] S602: Encrypt the client account data based on the storage key to obtain the encrypted client account data.

[0073] In a possible implementation, the specific method of encrypting the client account based on the storage key can refer to the relevant description of the above step S202, which will not be repeated here.

[0074] Optionally, the encryption method for client account data can be to symmetrically encrypt the client account data based on the encrypted random number, such as using a symmetric encryption algorithm (such as Data Encryption Standard (DES), Advanced Encryption Standard (AES), Triple Data Encryption Algorithm (3DES), etc.) and using the encrypted random number as the symmetric encryption key to encrypt the client account data, that is, the encrypted random number (also known as the key) is used as a parameter and input into the encryption algorithm that converts plaintext into ciphertext, so that the client account data (plaintext) is encrypted to obtain the account encrypted data (ciphertext). Accordingly, when the account encrypted data is encrypted, the encrypted random number used in the above encryption is used as a parameter to decrypt the account encrypted data (ciphertext) to obtain the client account data (plaintext).

[0075] Optionally, the encryption method for the encrypted random number can be symmetric encryption or asymmetric encryption of the encrypted random number based on the encrypted account key. If it is symmetric encryption, the encryption method for the encrypted random number can be the same as the method for encrypting the client account data (but the specific symmetric encryption algorithm used can be different). Accordingly, when the random number encrypted data is decrypted to obtain the encrypted random number, it can be decrypted using the decryption account key corresponding to the encryption account key. At this time, the encryption account key and the encryption account key are the same; if it is asymmetric encryption, the encryption method for the encrypted random number can be to use an asymmetric encryption algorithm (Elliptic Curve Cryptography (ECC), Digital Signature Algorithm (DSA), etc.) and use the encryption account key as the asymmetric encryption key to encrypt the encrypted random number to obtain the random number encrypted data. Accordingly, when decrypting, the decryption account key used is different from the encryption account key.

[0076] S603: Store the encrypted client account data in the storage client, and send the encrypted client account data to the storage server, so that the storage server stores the encrypted client account data.

[0077] In one possible implementation, after logging into the storage client, the terminal device will establish a connection relationship with the storage server through the network address of the storage server encapsulated in the storage client, and can upload, download or delete the encrypted client account data based on the connection relationship.

[0078] Specifically, establishing a connection relationship is to initiate a connection request to the storage server based on the network address, carrying the user name and password of the target user. After the storage server verifies the user name and the corresponding password, it returns a connection response message. When the terminal device receives the connection response message, it indicates that the connection relationship is successfully established, and then the storage space on the storage server is mapped to the virtual partition on the terminal device. The virtual partition is a disk for storing data on a remote server virtualized by the terminal device. Like a local disk, the terminal device can read data on the virtual partition through the storage client and view the memory space occupancy of the virtual partition.

[0079] Furthermore, when a terminal device reads data from a storage space (virtual partition) of a storage server through a storage client, this may be implemented based on a network protocol. Specifically, the network protocol may be a Common Internet File System (CIFS) protocol, which may provide the storage client with services for accessing the storage space on a storage server and receiving the required data returned by the storage server. Alternatively, the network protocol may be a Hypertext Transfer Protocol (HTTP), which implements data transmission in a bytecode manner, thereby improving data transmission efficiency and reducing the time it takes for a terminal device to obtain encrypted client account data from a storage server.

[0080] Based on this, after the terminal device stores the encrypted client account data through the storage client, it will send the encrypted client account data to the storage server based on the connection relationship and using the CIFS protocol, and the storage server will store the encrypted client account data in the storage space previously created for the target user. Among them, if the client account data is the modified account data, the encrypted client account data based on the modified account data will be stored, that is, the encrypted client account data based on the historical account data can be replaced by the encrypted client account data based on the modified account data.

[0081] Optionally, the management server can periodically back up the data in the storage server, such as using a tape library backup device or transferring the data to a third-party cloud storage server for backup, which can reduce server operating costs. When the data in the storage client and the data in the storage server are deleted, the terminal device can restore the data in the storage client and the storage server through the management server. Further, the management client can charge the target user a monthly subscription or other fee based on the size of the storage space allocated to the target user. When the target user pays the fee, the terminal device's storage client and storage server are stopped from using the storage server.

[0082] S604: When an output instruction for the client account data is obtained in the storage client, the client account data is restored and outputted in the client interface of the storage client based on the stored encrypted client account data.

[0083] In one possible implementation, when an output instruction is obtained, the terminal device restores and outputs the client account data on the client interface based on the encrypted client account data stored in the storage client; or, when an output instruction is obtained and the encrypted client account data cannot be obtained from the storage client (for example, the encrypted client account data stored in the storage client is deleted), the terminal device obtains the encrypted client account data from the storage server based on the connection relationship and the acquisition password, and restores and outputs the client account data on the client interface based on the encrypted client account data obtained from the storage server.

[0084] Among them, the specific method for the terminal device to restore and output the client account data on the client interface based on the encrypted client account data obtained from the storage server may be to first verify the data received from the storage server using a digital signature, and the digital signature is used to verify the integrity of the received data and the identity of the data sender to ensure the security of the received data. After the verification is passed, the received encrypted client account data is decrypted and output using the corresponding decryption account key and encrypted random number.

[0085] In addition, during the use of the storage client, the storage client will continue to run in the background, so the connection between the terminal device and the storage server will always be maintained. After the terminal device detects that the storage client has exited (the storage client process is closed), it will disconnect from the storage server and the virtual partition will disappear from the terminal device.

[0086] For example, see Figure 7a-7d , Figure 7a-7d A schematic diagram of a data processing scenario provided in an embodiment of the present application, wherein Figure 7a In the process, the terminal device sends a client download request of the target user for the storage client to the management client to apply to the management client for the use of the storage client. After the review is passed, the management server performs the initialization operation, that is, creates a user name and storage space, generates relevant keys (encryption account key and decryption account key) and relevant passwords (client login password, acquisition password, recovery password), encapsulates the relevant information (network address of the storage server, user, relevant keys) in the client installation data package, sends the client installation data package and relevant passwords to the terminal device, and creates a user record of the target user in the user information database; in the process, the terminal device sends a client download request of the target user for the storage client to the management client, and applies to the management client for the use of the storage client. Figure 7b In the example, the terminal device connects to the storage server, that is, the terminal device installs the storage client based on the client installation data package, and logs in to the storage client using the client login password, reads the network address of the storage server in the storage client, and the terminal device sends a connection request based on the network address. The storage server establishes a connection relationship with the terminal device after the identity authentication is passed, and the terminal device maps the storage space in the storage server to a virtual partition; in the example, the terminal device connects to the storage server based on the client installation data package, and the terminal device installs the storage client based on the client installation data package, and logs in to the storage client using the client login password, and reads the network address of the storage server in the storage client, and sends a connection request based on the network address, and the storage server establishes a connection relationship with the terminal device after the identity authentication is passed. Figure 7c In the embodiment of the present invention, (1) data encryption upload, i.e., the terminal device obtains the client account data through the storage client, encrypts the client account data to obtain the encrypted client account data, and the terminal device uploads the encrypted client account data to the storage server based on the connection relationship, and the storage server stores the data in the storage space; (2) data download encryption, i.e., the terminal device accesses the storage server through the storage client, receives the encrypted client account data sent by the storage server, decrypts the encrypted client account data, and outputs the encrypted client account data on the client interface of the storage client; Figure 7d In the process, (1) the connection with the storage server is disconnected, that is, after the terminal device detects that the storage client has exited, the connection with the storage server is disconnected, and the virtual partition in the terminal device disappears; (2) billing, that is, the management client charges by monthly subscription or other methods according to the size of the storage space applied for by the target user.

[0087] In the embodiment of the present application, the client account data of the authorized target client can be obtained in the storage client, and the storage key for the client account data can be obtained, the client account data can be encrypted based on the storage key to obtain the encrypted client account data, the encrypted client account data can be stored in the storage client, and the encrypted client account data can be sent to the storage server so that the storage server can store the encrypted client account data, and when the output instruction for the client account data is obtained in the storage client, the client account data can be restored and outputted in the client interface of the storage client based on the stored encrypted client account data. By implementing the method proposed in the embodiment of the present application, when the client account data is obtained, the storage key can be used to encrypt and store it in the storage client, so that even if it is intercepted during the data transmission process, the specific data cannot be obtained, which can reduce the risk of data leakage and improve the security of data storage. Subsequently, the client account data can be restored and outputted more safely through the encrypted stored data, and the data can be backed up. Even if the storage client data is deleted or damaged, the data in the storage client can be restored to ensure that important data will not be lost, and the client account data of multiple clients can be securely stored through the storage client and the storage server, which improves the user experience and convenience.

[0088] See also Figure 8 , Figure 8 This is a schematic diagram of the structure of a data processing device provided in this application. It should be noted that: Figure 8 The data processing device shown is used to execute the application Figure 2 and Figure 6 For the convenience of explanation, only the part related to the embodiment of the present application is shown, and the specific technical details are not disclosed. Figure 2 and Figure 6 The data processing device 800 may include: an acquisition module 801, an encryption module 802, and an output module 803. Among them:

[0089] The acquisition module 801 is used to acquire the client account data of the authorized target client in the storage client, and acquire the storage key for the client account data;

[0090] An encryption module 802 is used to encrypt the client account data based on the storage key to obtain the encrypted client account data and store the encrypted client account data;

[0091] The output module 803 is used to restore and output the client account data on the client interface of the storage client based on the stored encrypted client account data when an output instruction for the client account data is obtained in the storage client.

[0092] In a possible implementation, when the acquisition module 801 is used to acquire the storage key for the client account data, it is specifically used to:

[0093] Generate an encrypted random number for the client account data, and obtain an encrypted account key generated based on the client account data;

[0094] Determine the encrypted random number and the encrypted account key as the storage key;

[0095] The encryption module 802 is used to encrypt the client account data based on the storage key to obtain the encrypted client account data, specifically for:

[0096] Encrypting the client account data based on the encrypted random number to obtain account encrypted data;

[0097] Encrypting the encrypted random number based on the encrypted account key to obtain random number encrypted data;

[0098] The account encrypted data and the random number encrypted data are determined as the encrypted client account data.

[0099] In a possible implementation, when the output module 803 obtains an output instruction for the client account data in the storage client, based on the stored encrypted client account data, when restoring and outputting the client account data on the client interface of the storage client, it is specifically configured to:

[0100] When the output instruction is obtained, the random number encrypted data is decrypted based on the decryption account key corresponding to the encryption account key to obtain the encrypted random number;

[0101] Decrypting the account encrypted data based on the encrypted random number obtained by decryption to obtain the client account data;

[0102] The client account data obtained by decryption is output on the client interface.

[0103] In one possible implementation, when the encryption module 802 is used to store the encrypted client account data, it is specifically used to:

[0104] storing the encrypted client account data in the storage client, and sending the encrypted client account data to a storage server so that the storage server stores the encrypted client account data;

[0105] The output module 803 is used to, when an output instruction for the client account data is obtained in the storage client, restore and output the client account data on the client interface of the storage client based on the stored encrypted client account data, specifically to:

[0106] When the output instruction is obtained, the client account data is restored and outputted on the client interface based on the encrypted client account data stored in the storage client; or

[0107] When the output instruction is obtained, the encrypted client account data is obtained from the storage server, and the client account data is restored and output on the client interface based on the encrypted client account data obtained from the storage server.

[0108] In a possible implementation, the acquisition module 801 is further configured to:

[0109] Outputting a client authorization list according to the client authorization operation in the storage client; the client authorization list includes M clients to be authorized, where M is a positive integer;

[0110] According to the selection operation on the M clients to be authorized, the selected client to be authorized is determined as the target client.

[0111] In a possible implementation, when the acquisition module 801 is used to acquire the client account data of the authorized target client in the storage client, it is specifically used to:

[0112] Acquire the existing historical account data in the target client based on the storage client, and use the historical account data as the client account data; or

[0113] When a modification operation on the historical account data is detected in the storage client, account data after the historical account data is modified is determined as the client account data.

[0114] In a possible implementation, the acquisition module 801 is further configured to:

[0115] Sending a client download request of a target user for the storage client to a management client; the client download request includes user identity information of the target user;

[0116] Acquire a client installation data packet and a client login password of the storage client sent by the management client; the client installation data packet encapsulates the user identity information, and the user identity information and the client login password have a mapping relationship;

[0117] Installing the storage client based on the client installation data package, and logging into the storage client based on the client login password when detecting that the user identity information having the mapping relationship with the client login password is encapsulated in the installed storage client;

[0118] The step of acquiring the client account data of the authorized target client in the storage client includes:

[0119] The client account data is obtained in the logged-in storage client.

[0120] In the embodiment of the present application, the acquisition module acquires the client account data of the authorized target client in the storage client, and acquires the storage key for the client account data. The encryption module encrypts the client account data based on the storage key to obtain the encrypted client account data, and stores the encrypted client account data. When the output module acquires the output instruction for the client account data in the storage client, based on the stored encrypted client account data, the client account data is restored and output in the client interface of the storage client. By implementing the above-mentioned proposed device, when the authorized client account data is acquired, the data can be encrypted and stored in the storage client using the storage key. Subsequently, the client account data can be restored and output more securely through the encrypted stored data, thereby improving the security of data storage.

[0121] Each functional module in each embodiment of the present application can be integrated into one module, or each module can exist physically separately, or two or more modules can be integrated into one module. The above integrated modules can be implemented in the form of hardware or software functional modules, which is not limited in the present application.

[0122] See also Fig. 9 , Fig. 9 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Fig. 9As shown, the electronic device 900 includes: at least one processor 901 and a memory 902. Optionally, the electronic device may further include a network interface 903. The processor 901, the memory 902 and the network interface 903 may exchange data, the network interface 903 is controlled by the processor 903 to send and receive messages, the memory 902 is used to store a computer program, the computer program includes program instructions, and the processor 901 is used to execute the program instructions stored in the memory 902. The processor 901 is configured to call the program instructions to execute the above method.

[0123] Among them, the memory 902 may include a volatile memory (volatile memory), such as a random-access memory (RAM); the memory 902 may also include a non-volatile memory (non-volatile memory), such as a flash memory (flash memory), a solid-state drive (SSD), etc.; the memory 902 may also include a combination of the above types of memory.

[0124] The processor 901 may be a central processing unit (CPU). In one embodiment, the processor 901 may also be a graphics processing unit (GPU). The processor 901 may also be a combination of a CPU and a GPU.

[0125] In a possible implementation, the memory 902 is used to store program instructions. The processor 901 may call the program instructions to perform the following steps:

[0126] Obtaining client account data of an authorized target client in a storage client, and obtaining a storage key for the client account data;

[0127] Encrypting the client account data based on the storage key to obtain encrypted client account data, and storing the encrypted client account data;

[0128] When an output instruction for the client account data is obtained in the storage client, the client account data is restored and outputted on the client interface of the storage client based on the stored encrypted client account data.

[0129] In a possible implementation, when the processor 901 is used to obtain the storage key for the client account data, it is specifically used to:

[0130] Generate an encrypted random number for the client account data, and obtain an encrypted account key generated based on the client account data;

[0131] Determine the encrypted random number and the encrypted account key as the storage key;

[0132] When the processor 901 is used to encrypt the client account data based on the storage key to obtain the encrypted client account data, it is specifically used to:

[0133] Encrypting the client account data based on the encrypted random number to obtain account encrypted data;

[0134] Encrypting the encrypted random number based on the encrypted account key to obtain random number encrypted data;

[0135] The account encrypted data and the random number encrypted data are determined as the encrypted client account data.

[0136] In a possible implementation, when the processor 901 obtains an output instruction for the client account data in the storage client, based on the stored encrypted client account data, when restoring and outputting the client account data on the client interface of the storage client, the processor 901 is specifically configured to:

[0137] When the output instruction is obtained, the random number encrypted data is decrypted based on the decryption account key corresponding to the encryption account key to obtain the encrypted random number;

[0138] Decrypting the account encrypted data based on the encrypted random number obtained by decryption to obtain the client account data;

[0139] The client account data obtained by decryption is output on the client interface.

[0140] In a possible implementation, when the processor 901 is used to store the encrypted client account data, it is specifically used to:

[0141] storing the encrypted client account data in the storage client, and sending the encrypted client account data to a storage server so that the storage server stores the encrypted client account data;

[0142] When the processor 901 obtains an output instruction for the client account data in the storage client, based on the stored encrypted client account data, when restoring and outputting the client account data on the client interface of the storage client, the processor 901 is specifically configured to:

[0143] When the output instruction is obtained, the client account data is restored and outputted on the client interface based on the encrypted client account data stored in the storage client; or

[0144] When the output instruction is obtained, the encrypted client account data is obtained from the storage server, and the client account data is restored and output on the client interface based on the encrypted client account data obtained from the storage server.

[0145] In a possible implementation, the processor 901 is further configured to:

[0146] Outputting a client authorization list according to the client authorization operation in the storage client; the client authorization list includes M clients to be authorized, where M is a positive integer;

[0147] According to the selection operation on the M clients to be authorized, the selected client to be authorized is determined as the target client.

[0148] In a possible implementation, when the processor 901 is used to obtain the client account data of the authorized target client in the storage client, it is specifically used to:

[0149] Acquire the existing historical account data in the target client based on the storage client, and use the historical account data as the client account data; or

[0150] When a modification operation on the historical account data is detected in the storage client, account data after the historical account data is modified is determined as the client account data.

[0151] In a possible implementation, the processor 901 is further configured to:

[0152] Sending a client download request of a target user for the storage client to a management client; the client download request includes user identity information of the target user;

[0153] Acquire a client installation data packet and a client login password of the storage client sent by the management client; the client installation data packet encapsulates the user identity information, and the user identity information and the client login password have a mapping relationship;

[0154] Installing the storage client based on the client installation data package, and logging into the storage client based on the client login password when detecting that the user identity information having the mapping relationship with the client login password is encapsulated in the installed storage client;

[0155] The step of acquiring the client account data of the authorized target client in the storage client includes:

[0156] The client account data is obtained in the logged-in storage client.

[0157] In a specific implementation, the data processing device 800, processor 901, memory 902, etc. described above can execute the implementation method described in the above method embodiment, and can also execute the implementation method described in the embodiment of the present application, which will not be repeated here.

[0158] A computer (readable) storage medium is also provided in an embodiment of the present application, wherein the computer storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a processor, the processor can execute some or all of the steps performed in the above method embodiment. Optionally, the computer storage medium may be volatile or non-volatile. The computer-readable storage medium may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function, etc.; the data storage area may store data created according to the use of blockchain nodes, etc.

[0159] The term "multiple" as used herein refers to two or more than two. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the related objects are in an "or" relationship.

[0160] A person skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer storage medium, which can be a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

[0161] The above disclosure is only part of the embodiments of the present application, which certainly cannot be used to limit the scope of rights of the present application. Ordinary technicians in this field can understand that all or part of the processes of implementing the above embodiments and equivalent changes made according to the claims of the present application are still within the scope covered by the present application.

Claims

1. A data processing method, characterized in that: The method comprises: Sending a client download request of a target user for a storage client to a management client, wherein the client download request includes user identity information of the target user; Obtaining a client installation data packet and a client login password of the storage client sent by the management client; the client installation data packet is encapsulated and generated by the management server corresponding to the management client after the management client has reviewed and approved the identity information of the target user; the user identity information is encapsulated in the client installation data packet, and the user identity information and the client login password have a mapping relationship; Installing the storage client based on the client installation data package, and logging into the storage client based on the client login password when detecting that the user identity information having the mapping relationship with the client login password is encapsulated in the installed storage client; Acquire the client account data of the authorized target client in the logged-in storage client, and acquire the storage key for the client account data; Encrypting the client account data based on the storage key to obtain encrypted client account data, and storing the encrypted client account data; When an output instruction for the client account data is obtained in the storage client, the client account data is restored and outputted on the client interface of the storage client based on the stored encrypted client account data.

2. The method according to claim 1, characterized in that The obtaining of a storage key for the client account data includes: Generate an encrypted random number for the client account data, and obtain an encrypted account key generated based on the client account data; Determine the encrypted random number and the encrypted account key as the storage key; The step of encrypting the client account data based on the storage key to obtain the encrypted client account data includes: Encrypting the client account data based on the encrypted random number to obtain account encrypted data; Encrypting the encrypted random number based on the encrypted account key to obtain random number encrypted data; The account encrypted data and the random number encrypted data are determined as the encrypted client account data.

3. The method according to claim 2, characterized in that When an output instruction for the client account data is obtained in the storage client, based on the stored encrypted client account data, the client account data is restored and outputted on the client interface of the storage client, including: When the output instruction is obtained, the random number encrypted data is decrypted based on the decryption account key corresponding to the encryption account key to obtain the encrypted random number; Decrypting the account encrypted data based on the encrypted random number obtained by decryption to obtain the client account data; The client account data obtained by decryption is output on the client interface.

4. The method according to claim 1, characterized in that: The encrypted client account data is stored, including: storing the encrypted client account data in the storage client, and sending the encrypted client account data to a storage server so that the storage server stores the encrypted client account data; When an output instruction for the client account data is obtained in the storage client, based on the stored encrypted client account data, the client account data is restored and outputted on the client interface of the storage client, including: When the output instruction is obtained, the client account data is restored and outputted on the client interface based on the encrypted client account data stored in the storage client; or When the output instruction is obtained, the encrypted client account data is obtained from the storage server, and the client account data is restored and output on the client interface based on the encrypted client account data obtained from the storage server.

5. The method according to claim 1, characterized in that: The method further comprises: Outputting a client authorization list according to the client authorization operation in the storage client; the client authorization list includes M clients to be authorized, where M is a positive integer; According to the selection operation on the M clients to be authorized, the selected client to be authorized is determined as the target client.

6. The method according to claim 1, characterized in that The step of obtaining the client account data of the authorized target client in the logged-in storage client includes: Acquire the existing historical account data in the target client based on the storage client, and use the historical account data as the client account data; or When a modification operation on the historical account data is detected in the storage client, account data after the historical account data is modified is determined as the client account data.

7. A data processing device, characterized in that: The device comprises: An acquisition module is used to send a client download request of a target user for a storage client to a management client, wherein the client download request includes the user identity information of the target user; obtain a client installation data packet and a client login password of the storage client sent by the management client; the client installation data packet is encapsulated and generated by a management server corresponding to the management client after the management client has reviewed and approved the identity information of the target user; the user identity information is encapsulated in the client installation data packet, and the user identity information has a mapping relationship with the client login password; the storage client is installed based on the client installation data packet, and when it is detected that the user identity information having the mapping relationship with the client login password is encapsulated in the installed storage client, the storage client is logged in based on the client login password; the client account data of the authorized target client is obtained in the logged in storage client, and a storage key for the client account data is obtained; an encryption module, configured to encrypt the client account data based on the storage key, obtain the encrypted client account data, and store the encrypted client account data; An output module is used to restore and output the client account data on the client interface of the storage client based on the stored encrypted client account data when an output instruction for the client account data is obtained in the storage client.

8. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory is used to store a computer program, the computer program comprises program instructions, and the processor is configured to call the program instructions to execute the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a processor, the processor is caused to perform the method according to any one of claims 1 to 6.

Images