A data processing method, device, equipment and storage medium

Abstract

The present application discloses a data processing method, apparatus, device and storage medium, the method is applied to a first device, the method includes: decrypting user identification data based on a received first user password to obtain a predicted user identification; obtaining an actual user identification associated with the first user password; if the predicted user identification is the same as the actual user identification, determining that the first user password verification is successful, decrypting first encrypted data based on the first user password to obtain a first user password factor, the first encrypted data including the encrypted first user password factor; generating a first password based at least on the first user password factor; encrypting or decrypting a target object using the first password. This solution can not only enable users to participate in the encryption or decryption process, but also has high security.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and is related to but not limited to data processing methods, devices, equipment and storage media. Background Art

[0002] With the continuous development of storage technology, how to improve storage security is particularly important. At present, the security of storage is mainly improved through encrypted storage.

[0003] The encrypted storage process includes encryption and decryption processes. For the encryption and decryption process, the first solution is to encrypt and decrypt the text through the device's built-in random password; the second solution is to encrypt and decrypt the text through the user password. For the first solution, on the one hand, the user cannot participate in the encryption and decryption process; on the other hand, the organization that provides encryption and decryption has the ability to decrypt the text, which is less secure. For the second solution, although the user can participate in the encryption and decryption process, encryption and decryption of the text through the user password is less secure. Summary of the invention

[0004] The present application provides a data processing method and apparatus, device, and storage medium, which can not only enable users to participate in the encryption or decryption process, but also has high security.

[0005] The technical solution of this application is implemented as follows:

[0006] The present application provides a data processing method, which is applied to a first device and includes:

[0007] decrypting the user identification data based on the received first user password to obtain a predicted user identification;

[0008] Obtaining an actual user identification associated with the first user password;

[0009] If the predicted user identifier is the same as the actual user identifier, it is determined that the first user password verification is successful, and the first encrypted data is decrypted based on the first user password to obtain a first user password factor, where the first encrypted data includes the encrypted first user password factor;

[0010] generating a first password based at least on the first user password factor;

[0011] The target object is encrypted or decrypted using the first password.

[0012] The present application provides a data processing apparatus, which is deployed on a first device; the apparatus includes:

[0013] A prediction unit, configured to decrypt the user identification data based on the received first user password to obtain a predicted user identification;

[0014] An obtaining unit, configured to obtain an actual user identifier associated with the first user password;

[0015] a decryption unit, configured to determine that the first user password verification is successful if the predicted user identifier is the same as the actual user identifier, and decrypt the first encrypted data based on the first user password to obtain a first user password factor, wherein the first encrypted data includes the encrypted first user password factor;

[0016] a generating unit, configured to generate a first password based at least on the first user password factor;

[0017] A processing unit is used to encrypt or decrypt the target object using the first password.

[0018] The present application also provides an electronic device, comprising: a memory and a processor, wherein the memory stores a computer program that can be run on the processor, and the processor implements the above-mentioned data processing method when executing the program.

[0019] The present application also provides a storage medium on which a computer program is stored. When the computer program is executed by a processor, the above-mentioned data processing method is implemented.

[0020] The data processing method, device, equipment and storage medium provided by the present application include: decrypting user identification data based on the received first user password to obtain a predicted user identification; obtaining an actual user identification associated with the first user password; if the predicted user identification is the same as the actual user identification, then determining that the verification of the first user password is successful, decrypting the first encrypted data based on the first user password to obtain a first user password factor, the first encrypted data including the encrypted first user password factor; generating a first password based at least on the first user password factor; encrypting or decrypting the target object through the first password. In this way, first, the first password is obtained based on the user password, which can ensure that the user participates in the encryption or decryption process; second, the scheme does not encrypt or decrypt the target object through the first user password, but determines the first password based on the user password factor obtained from the first user password, and encrypts or decrypts the target object through the first password, which increases the difficulty of cracking the first password and further improves security; third, when verifying, the scheme verifies based on the predicted user identification and the actual user identification; rather than directly verifying based on the password, so the scheme does not need to store the user password, reduces the channel for leakage of the user password, and further improves security. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 An optional structural diagram of a data processing system provided in an embodiment of the present application;

[0022] Figure 2 An optional structural diagram of a data processing system provided in an embodiment of the present application;

[0023] Figure 3 An optional flow chart of the data processing method provided in the embodiment of the present application

[0024] Figure 4 An optional flowchart of a data processing method provided in an embodiment of the present application;

[0025] Figure 5 An optional flow chart of the data processing method provided in the embodiment of the present application;

[0026] Figure 6 An optional flow chart of the data processing method provided in the embodiment of the present application;

[0027] Figure 7 An optional flow chart of the data processing method provided in the embodiment of the present application;

[0028] Figure 8 An optional structural diagram of a data processing device provided in an embodiment of the present application;

[0029] Fig. 9 An optional structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0030] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the specific technical solution of the application will be further described in detail below in conjunction with the drawings in the embodiments of the present application. The following embodiments are used to illustrate the present application, but are not used to limit the scope of the present application.

[0031] In the following description, reference is made to “some embodiments”, which describe a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0032] In the following description, the terms "first\second\third" are used only as examples to distinguish different objects, and do not represent a specific order for the objects, nor do they have a limitation on the order of precedence. It is understandable that "first\second\third" can be interchanged with a specific order or order of precedence where permitted, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein.

[0033] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0034] To facilitate understanding, some technical terms in this application are explained.

[0035] An object may refer to various types of data, such as text data, video data, audio data, or image data.

[0036] The target object refers to the object to be encrypted or decrypted in this application.

[0037] The embodiments of the present application may provide a data processing method and apparatus, a device and a storage medium. In practical applications, the data processing method may be implemented by a data processing apparatus, and each functional entity in the data processing apparatus may be collaboratively implemented by hardware resources of an electronic device (such as the first device), such as computing resources such as a processor, and communication resources (such as for supporting various communication methods such as optical cables and cellular communications).

[0038] The data processing method provided in the embodiment of the present application is applied to a data processing system, and the data processing system includes a first device. The first device decrypts user identification data based on a received first user password to obtain a predicted user identification; obtains an actual user identification associated with the first user password; if the predicted user identification is the same as the actual user identification, it is determined that the first user password verification is successful, decrypts first encrypted data based on the first user password to obtain a first user password factor, and the first encrypted data includes an encrypted first user password factor; generates a first password based at least on the first user password factor; and encrypts or decrypts a target object using the first password.

[0039] In one example, the data processing system may further include a second device and / or a third device. The second device may communicate with the first device, for example, the second device may back up the first user password factor; the third device may communicate with the first device, for example, the third device may receive the first user password and forward the received first user password to the first device.

[0040] As an example, the structure of data processing system 10 may be as follows: Figure 1 As shown, it includes: a first device 101 and a third device 102; the first device 101 and the third device 102 can communicate with each other.

[0041] The first device 101 can communicate directly with the third device 102; or the first device 101 can also communicate with the third device 102 through an application server. For example, the data processing system 10 can also include an application server 103. The target service (for example, a hosted storage service) runs on the third device 102, and the third device 102 communicates with the server 103 through an application programming interface (API) provided by the target service, and the server 103 communicates with the first device 101.

[0042] The first device 101 is used to receive various data sent by the third device 102, and process and store the received data. In the embodiment of the present application, the first device 101 can be used to receive an object sent by the third device 102, and encrypt and store the object; or it can also be used to decrypt the encrypted object and send it to the third device 102. The first device 101 can be a fixed storage device such as a memory, a hard disk, a floppy disk, or the first device 101 can also be a removable storage device such as a mobile hard disk, or the first device 101 can also be a cloud storage device.

[0043] The third device 102 is used to send objects to the first device 101, or to receive objects sent by the first device. The third device 102 may include a mobile terminal device (such as a mobile phone, a tablet computer, etc.) or a non-mobile terminal device (such as a desktop computer, etc.).

[0044] As another example, the structure of data processing system 10 may be as follows: Figure 2 As shown, the first device 101, the third device 102 and the second device 104 are included. The second device 104 can communicate with the first device 101 and the third device 102.

[0045] The second device 104, which may also be referred to as a third-party trusted certificate service agency device, is used to receive and store data sent by the first device 101 or the third device 102 (for example, it may store an encrypted second user password factor), and send the processed data to the first device 101 or the third device 102.

[0046] Next, combine Figure 1 or Figure 2 The schematic diagram of the data processing system shown illustrates various embodiments of the data processing method and apparatus, device and storage medium provided in the embodiments of the present application.

[0047] In a first aspect, an embodiment of the present application provides a data processing method, which is applied to a data processing device; wherein the data processing device can be deployed in Figure 1 or Figure 2The first device 101 in the embodiment of the present application is described below.

[0048] Figure 3 The following is a flow chart of an optional data processing method. The data processing method provided in the embodiment of the present application is used to encrypt or decrypt each object. The processing process for each object is similar. Now, the process is described in detail by taking the target object as an example. The data processing method may include but is not limited to Figure 3 S301 to S305 shown.

[0049] S301. The first device decrypts user identification data based on a received first user password to obtain a predicted user identification.

[0050] Specifically, the first device receives the first user password, and decrypts the user identification data based on the first user password to obtain the predicted user identification.

[0051] Regarding the first device receiving the first user password, in a possible implementation, the first device receives a first operation of the user, and receives the first user password input by the user based on the first operation.

[0052] In another possible implementation, the third device receives the user's first operation and receives the first user password input by the user based on the first operation. The third device sends the received first user password to the first device, and the first device receives the first user password sent by the third device.

[0053] For the first device to decrypt the user identification data based on the first user password to obtain the predicted user identification, it can be implemented as follows: the first device calls the first decryption algorithm, decrypts the user identification data by the first user password or the system password obtained based on the first user password, and obtains the predicted user identification.

[0054] The system password is a password for the system corresponding to the first user password.

[0055] Optionally, before decrypting to obtain the predicted user, the first device may also obtain user identification data based on the first user.

[0056] The embodiment of the present application does not impose a unique limitation on the timing of obtaining user identification data, and can be configured according to timing requirements.

[0057] The first device creates an identity document (ID) for the first user, and calls a first encryption algorithm to encrypt the user ID of the first user using the first user password or a system password obtained based on the first user password to obtain user ID data.

[0058] The user identifier of the first user is used to uniquely point to the first user. The embodiment of the present application does not limit the form of the first user identifier, and can be configured according to actual needs. For example, the first user identifier can be a combination of numbers, or a combination of letters, or a combination of numbers and letters, etc.

[0059] The embodiment of the present application does not specifically limit the algorithm for creating the user identification of the first user. For example, the algorithm for creating the user identification of the first user may include a random algorithm or a hash algorithm, etc.

[0060] It should be noted that the encryption password of the first encryption algorithm and the decryption password of the first decryption algorithm should be consistent. For example, when the encryption password of the first decryption algorithm is the first user password, the corresponding encryption password of the first encryption algorithm is the first user password; when the decryption password of the first decryption algorithm is the system password, the encryption password of the first decryption algorithm is the encryption password.

[0061] S302: The first device obtains an actual user identifier associated with the first user password.

[0062] The first device regenerates the user identification based on the input first user password by adopting the same method as the first device obtains the user identification data based on the first user as the actual user identification associated with the first user password.

[0063] S303: If the predicted user identifier is the same as the actual user identifier, it is determined that the first user password verification is successful, and the first device decrypts the first encrypted data based on the first user password to obtain a first user password factor.

[0064] The first encrypted data includes an encrypted first user password factor.

[0065] The first encrypted data may be data obtained by encrypting the first user password factor, or the first encrypted data may be data obtained by packaging the first user password factor into a file (eg, a folder or a compressed file) and then encrypting the file.

[0066] The first user password factor is used to obtain the password for encrypting or decrypting the target object. The embodiment of the present application does not limit the form of the first user password factor and can be configured according to actual needs.

[0067] For example, the first user password factor may be a group of random numbers, or the first user password factor may be a combination of a group of random numbers and letters, and so on.

[0068] S303 can be implemented as follows: the first device determines whether the predicted user identifier is the same as the actual user identifier. If the predicted user identifier is the same as the actual user identifier, it is determined that the first user password verification is successful. The first device calls the second decryption algorithm, obtains a decryption password based on the first user password, and decrypts the first encrypted data using the decryption password to obtain the first user password factor. If the predicted user identifier is not the same as the actual user identifier, it is determined that the first user password verification has failed, and the process ends.

[0069] The embodiment of the present application does not impose a unique limitation on the type of the second decryption algorithm, and it can be configured according to actual needs.

[0070] In a possible implementation, the second decryption algorithm may include: a packet data algorithm (SM4 decryption algorithm) of a wireless local area network standard. For example, the second decryption algorithm may include an SM4DNCRYPT (D, P) algorithm, where D represents a decryption object and P represents a decryption password. It can be understood that D includes the first encrypted data; and P includes the first user password or a system password generated based on the first user password.

[0071] In another possible implementation, the second decryption algorithm may include: an asymmetric encryption algorithm (SM2 algorithm).

[0072] Optionally, before executing S303, the data processing method provided in the embodiment of the present application may further include a registration process.

[0073] The registration process of the first user may include: the first device receives the first user password, creates the first user for the first user password, creates a first user password factor for the first user, and encrypts the first user password factor based on the first user password to obtain first encrypted data.

[0074] The embodiment of the present application does not impose a unique limitation on the algorithm for creating the first user password factor. For example, the algorithm for creating the first user password factor may include a random algorithm, a hash algorithm, or the like.

[0075] The embodiment of the present application does not impose any unique limitation on the second encryption algorithm for encrypting the first user password factor.

[0076] In a possible implementation, the second encryption algorithm may include: a packet data algorithm (SM4 encryption algorithm) of a wireless local area network standard. For example, the second encryption algorithm may include an SM4ENCRYPT (S, P) algorithm.

[0077] In another possible implementation, the second encryption algorithm may include: Advanced Encryption Standard (AES) algorithm.

[0078] It should be noted that the second encryption algorithm should correspond to the second decryption algorithm. For example, when the second decryption algorithm is SM4DECRYPT(D, P) algorithm, the corresponding second encryption algorithm of the registration process is SM4ENCRYPT(S, P) algorithm, where S represents the encryption object and P represents the encryption password. It can be understood that S includes the first user password factor; P includes the first user password or the system password generated based on the first user password.

[0079] It should be noted that the encryption password of the second encryption algorithm should be consistent with the decryption password of the second decryption algorithm.

[0080] For example, when the decryption password of the second decryption algorithm is the first user password, the corresponding encryption password of the second encryption algorithm is also the first user password; when the decryption password of the second decryption algorithm is the system password, the corresponding encryption password of the second encryption algorithm is also the system password.

[0081] It should be noted that during the registration process, the received first user password is not stored, in other words, the first user password is destroyed immediately after use, so that the probability of leakage of the first user password can be reduced and security can be improved.

[0082] S304: The first device generates a first password based at least on the first user password factor.

[0083] In a possible implementation, the first device uses a first password generation algorithm to generate the first password according to a first user password factor.

[0084] In another possible implementation, the first device uses a first password generation algorithm to generate a first password according to a first user password factor and an object password factor for a target object.

[0085] The embodiment of the present application does not limit the algorithm type of the first password generation algorithm, and it can be configured according to actual needs.

[0086] In one example, the first password generation algorithm may include: a hash algorithm, or a message digest algorithm 5 (MD5) algorithm, or a secure hash algorithm (SHA) algorithm.

[0087] In another example, the first password generation algorithm may include: a hash algorithm and a random password generation algorithm (eg, a GENPSW algorithm), or an MD5 algorithm and a random password generation algorithm, or a SHA algorithm and a random password generation algorithm.

[0088] S305: The first device encrypts or decrypts the target object using the first password.

[0089] The target object may include a target object to be encrypted and a target object to be decrypted, wherein the target object to be encrypted may also be referred to as a first target object, and the target object to be decrypted may also be referred to as a second target object.

[0090] In a possible implementation, S305 may be implemented as follows: the first device calls a third encryption algorithm to encrypt the first target object using a first password.

[0091] In another possible implementation, S305 may be implemented as follows: the first device calls a third decryption algorithm to decrypt the second target object using the first password.

[0092] The embodiment of the present application does not limit the algorithm types of the third encryption algorithm and the third decryption algorithm, and can be configured according to actual needs. For example, the third encryption algorithm may include an SM4 encryption algorithm or an SM2 encryption algorithm; the third decryption algorithm may include an SM4 decryption algorithm or an SM2 decryption algorithm.

[0093] It should be noted that the third decryption algorithm should correspond to the second encryption algorithm. For example, when the third encryption algorithm is SM4ENCRYPT algorithm, the third decryption algorithm is SM4DECRYPT.

[0094] The data processing scheme provided by the embodiment of the present application includes: decrypting the user identification data based on the received first user password to obtain the predicted user identification; obtaining the actual user identification associated with the first user password; if the predicted user identification is the same as the actual user identification, then determining that the verification of the first user password is successful, decrypting the first encrypted data based on the first user password to obtain the first user password factor, the first encrypted data including the encrypted first user password factor; generating the first password based at least on the first user password factor; encrypting or decrypting the target object through the first password. In this way, first, the first password is obtained based on the user password, which can ensure that the user participates in the encryption or decryption process; second, the scheme does not encrypt or decrypt the target object through the first user password, but determines the first password based on the user password factor obtained from the first user password, and encrypts or decrypts the target object through the first password, which increases the difficulty of cracking the first password and further improves security; third, when verifying, the scheme verifies based on the predicted user identification and the actual user identification; rather than directly verifying based on the password, so the scheme does not need to store the user password, reduces the channel for leakage of the user password, and further improves security.

[0095] It should be noted that the data processing process provided in the embodiment of the present application may not store the first user password, that is, for each stage of data processing (encryption or decryption, etc.), the user needs to enter the first user password, the first device receives the first user password, and performs encryption or decryption operations based on the first user password. In this way, the possibility of the first user password being stolen or the device storing the first user password illegally decrypting files can be avoided during the storage of the first user password, thereby further improving the security of the data.

[0096] Next, the process in S303 where the first device decrypts the first encrypted data based on the first user password to obtain the first user password factor is described. This process includes but is not limited to the following implementation mode A or implementation mode B.

[0097] Implementation A, decrypting the first encrypted data using the first user password;

[0098] In implementation mode B, the first encrypted data is decrypted by a system password generated by the first user password.

[0099] The system password is a password for the system corresponding to the first user password.

[0100] Implementation A may include: the first device calls the second decryption algorithm, decrypts the first encrypted data using the first user password, and obtains the first user password factor.

[0101] For example, the first user password factor S1 can be obtained by the following formula (1).

[0102] S1=SM4DECRYPT(D1,P0) formula (1);

[0103] Among them, S1 represents the first user password factor, D1 represents the first encrypted data, SM4ENCRYPT represents the SM4 decryption algorithm (first decryption algorithm), and P0 represents the first user password.

[0104] Implementation B may include but is not limited to the following S3021 and S3022.

[0105] S3021. The first device generates a system password corresponding to the first user password based on the first user password.

[0106] The first device uses the second password generation algorithm to generate a system password corresponding to the first user password according to the first user password.

[0107] The implementation of this application does not limit the algorithm type of the second password generation algorithm, and can be configured according to actual needs. Among them, the second password generation algorithm can be the same as the first password generation algorithm, or it can be different from the first password generation algorithm.

[0108] For example, the system password P1 can be obtained by the following formula (2).

[0109] P1=GEMPSW(SM3(SALT0+P0)) formula (2);

[0110] Among them, P1 represents the system password, GEMPSW represents the random password generation algorithm, SM3 represents the salted hash algorithm, SALT0 represents the salt value, P0 represents the first user password, and GEMPSW and SM3 constitute the second password generation algorithm.

[0111] S3022. The first device decrypts the first encrypted data using the system password to obtain the first user password factor.

[0112] The first device calls the second decryption algorithm and decrypts the first encrypted data through the system password to obtain the first user password factor.

[0113] For example, the first user password factor can be obtained by the following formula (3).

[0114] S1=SM4DECRYPT(D1,P1) formula (3);

[0115] Among them, S1 represents the first user password factor, SM4ENCRYPT represents the SM4 decryption algorithm, D1 represents the first encrypted data, and P1 represents the system password.

[0116] Optionally, the process in which the first device obtains the first encrypted data may include but is not limited to the following implementation A1 or implementation B1.

[0117] Implementation A1 corresponds to implementation A, and first encrypted data is obtained by encrypting with the first user password;

[0118] Implementation method B1 corresponds to implementation method B, and the first encrypted data is obtained by encrypting the system password generated by the first user password.

[0119] Implementation A1 may include: the first device calls a second encryption algorithm, encrypts a first user password factor using a first user password, and obtains first encrypted data.

[0120] For example, the first encrypted data can be obtained by the following formula (4).

[0121] D1=SM4ENCRYPT(S1,P0) formula (4);

[0122] Among them, D1 represents the first encrypted data, SM4ENCRYPT represents the SM4 encryption algorithm (the second encryption algorithm), S1 represents the first user password factor, and P0 represents the first user password.

[0123] Implementation method B1 may include: the first device uses a second password generation algorithm to generate a system password corresponding to the first user password according to the first user password; then the first device calls a second encryption algorithm to encrypt the first user password factor through the system password to obtain first encrypted data.

[0124] For example, the system password P1 can be obtained by the following formula (2), and the first encrypted data D1 can be obtained by the following formula (5).

[0125] P1=GEMPSW(SM3(SALT0+P0)) Formula (2)

[0126] D1=SM4ENCRYPT(S1,P1) formula (5);

[0127] Wherein, D1 represents the first encrypted data, SM4ENCRYPT represents the SM4 encryption algorithm, S1 represents the first user password factor, and P1 represents the system password corresponding to the first user password.

[0128] In the scheme of implementation mode B1, the first user password factor is not encrypted by the first user password, but is encrypted by the system password generated by the first user password. This achieves multi-layer encryption and is more secure. Compared with implementation mode B, implementation mode A has higher security and implementation mode A is simpler to implement.

[0129] Next, a process of generating a first password by the first device 304 based at least on the first user password factor is described. The process may include but is not limited to the following implementation A2 or implementation B2.

[0130] Implementation A2: generating a first password based on a first user password factor;

[0131] Implementation method B2: Generate a first password based on a first user password factor and an object password factor for a target object.

[0132] Implementation A2 may include: the first device uses a first password generation algorithm to generate a first password according to a first user password factor.

[0133] Exemplarily, the first password generation algorithm may include a hash algorithm and a random password generation algorithm. Correspondingly, implementation A2 may be implemented as follows: the first device obtains a hash value by performing a hash algorithm on the first user password factor, and then uses a random password generation algorithm to truncate the first 128 bits of the hash value as the first password.

[0134] For example, the first password P3 can be obtained by formula (6).

[0135] P3=GENPSW(SM3(S1)) formula (6);

[0136] Among them, P3 represents the first password, GENPSW represents the random password generation algorithm, SM3 represents the hash algorithm, S1 represents the first user password factor, and SM3(S1) represents obtaining a hash value by applying the hash algorithm to the first user password factor.

[0137] For implementation mode B2, the data processing method provided in the present application may also include the following: Figure 4 S306 shown.

[0138] S306: The first device obtains an object cryptographic factor for the target object.

[0139] The object cryptographic factor is a cryptographic factor for an object, or in other words, a cryptographic factor at the object level.

[0140] For the convenience of description, the object cryptographic factor for the target object will be referred to as the object cryptographic factor below.

[0141] Correspondingly, implementation B2 may include: the first device uses a first password generation algorithm to generate a first password according to a first user password factor and an object password factor.

[0142] Exemplarily, the first password generation algorithm may include a salted hash algorithm and a random password generation algorithm.

[0143] For example, the first device may combine the first user password factor and the object password factor, obtain a hash value through a salted hash algorithm, and then use a random password generation algorithm to truncate the first 128 bits of the hash value as the first password.

[0144] For example, the first password P3 can also be obtained by formula (7).

[0145] P3=GENPSW(SM3(S1+S2+SALT0)) formula (7);

[0146] Among them, P3 represents the first password, GENPSW represents the random password generation algorithm, SM3 represents the salted hash algorithm, S1 represents the first user password factor, S2 represents the object password factor, SALT0 represents the salt value, and SM3(S1+S2+SALT0) represents the hash value obtained by combining the first user password factor and the object password factor and then performing the salted hash algorithm.

[0147] The following describes in detail the implementation of the first device obtaining the object cryptographic factor for the target object in S306. This process may include but is not limited to the following implementation A3 or implementation B3.

[0148] Implementation A3: For the encryption process, the first device creates an object cryptographic factor for the target object.

[0149] Implementation method B3: With respect to the decryption process, the first device decrypts the second encrypted data to obtain the object cryptographic factor.

[0150] Implementation A3 may include: the first device creates an object cryptographic factor for the target object as the object cryptographic factor for the target object.

[0151] The embodiment of the present application does not impose a unique limitation on the algorithm for creating the object password factor. For example, the algorithm for creating the object password factor may include a random algorithm, a hash algorithm, and the like.

[0152] The algorithm for creating the object password factor may be the same as the algorithm for creating the first user password factor, or may be different from the algorithm for creating the first user password factor.

[0153] Optionally, after creating the object cryptographic factor, the first device may encrypt and store the object cryptographic factor.

[0154] The first device generates a second password for the target object, encrypts the object password factor based on the second password, obtains second encrypted data, and saves the second encrypted data.

[0155] The first device encrypts the object cryptographic factor based on the second password, which may include: the first device calls a fourth encryption algorithm to encrypt the object cryptographic factor using the second password; or the first device generates a third password based on the second password and encrypts the object cryptographic factor using the third password.

[0156] Implementation B3 may include: the first device decrypts the second encrypted data based on the second password to obtain the object password factor.

[0157] In a possible implementation, when the encryption password for encrypting the object cryptographic factor is the second password, the first device calls a fourth decryption algorithm to decrypt the second encrypted data using the second password to obtain the object cryptographic factor.

[0158] In another possible implementation, when the encryption password for encrypting the object cryptographic factor is a third password generated based on the second password, the first device calls a fourth decryption algorithm to decrypt the second encrypted data using the third password to obtain the object cryptographic factor.

[0159] Next, the process of generating the first password based on the first user password factor and the object password factor for the target object in implementation mode B2 is described, which may include but is not limited to: Figure 5 S3031 to S3033 shown.

[0160] S3031. The first device assembles the sum of the first user factor and the object password factor into a password string.

[0161] S3032. The first device performs salted hash calculation on the password character string to obtain a password hash value.

[0162] Among them, the specific salt value in the salted hash algorithm can be determined according to actual needs, and the embodiments of the present application do not specifically limit this.

[0163] S3033. The first device truncates the first W bits of the password hash value to generate the first password.

[0164] The embodiment of the present application does not limit the specific value of W, and can be configured according to actual needs. In one example, W can be 128.

[0165] The first device truncates the first W bits of the password hash value using the GEMPSW algorithm to generate a first password.

[0166] The data processing method provided in the embodiment of the present application can also modify the user password of the first user. Now, taking the modification of the first user password to the second user password as an example, the process of modifying the user password is explained.

[0167] This process may include but is not limited to Figure 6 S307 to S309 shown.

[0168] S307: Upon receiving the second user password, the first device obtains a second user password factor.

[0169] The first user password factor and the second user password factor have the same content.

[0170] S308. The first device encrypts the second user password factor based on the received second user password to obtain third encrypted data.

[0171] The implementation of S308 may refer to the specific description of obtaining the first encrypted data during the registration process, which will not be described in detail here.

[0172] S309: The first device updates the first encrypted data based on the third encrypted data.

[0173] The first device updates the first encrypted data to the third encrypted data.

[0174] In this way, after the user password is changed from the first user password to the second user password, it is only necessary to generate the third encrypted data based on the first user password, and then update the first encrypted data to the third encrypted data, so as to complete the file modification process after the password is changed; compared with the prior art, since the prior art needs to decrypt the source encrypted file after the user password is changed, and then encrypt it with the modified user password to complete the file update; therefore, the solution of the present application is simple and convenient to implement, especially for scenarios with large amounts of storage, it is more convenient to implement.

[0175] Furthermore, before executing S307, a one-time password (OTP) verification may be performed first.

[0176] For example, during the registration process, the first device also receives and stores the first mobile phone number for the first user.

[0177] The first device performs OTP verification based on the first mobile phone number. If the verification is successful, S307 is executed; if the verification fails, the process ends.

[0178] The following is a detailed description of the situation in which the first device obtains the second user password factor in S307, which may include but is not limited to: Figure 7 S3071 to S3076 shown.

[0179] S3071. The first device sends the fourth encrypted data to the second device or the third device.

[0180] In a possible implementation, S3071 may be implemented as: the first device sends fourth encrypted data to the second device.

[0181] In another possible implementation, S3071 may be implemented as: the first device sends the fourth encrypted data to the third device.

[0182] It should be noted that, before executing S3071, the data processing method provided in the embodiment of the present application also includes a process of generating fourth encrypted data.

[0183] The process of the first device generating the fourth encrypted data may include but is not limited to S3070 and S3070A.

[0184] S3070. The first device receives a first public key for the second device.

[0185] The second device generates a set of public-private key pairs (a first public key and a first private key), the second device sends the first public key to the first device, and the first device receives the first public key for the second device.

[0186] Optionally, the first device may also generate a set of public-private key pairs (a second public key and a second private key), the first device sends the second public key to the second device, and the second device receives the second public key.

[0187] S3070A. The first device uses the first public key to encrypt the first user password factor to obtain fourth encrypted data.

[0188] S3072A. The second device receives the fourth encrypted data, and uses the first private key to decrypt the fourth encrypted data to obtain the second user password factor.

[0189] S3072B. The third device receives the fourth encrypted data, and uses the first private key to decrypt the fourth encrypted data in a trusted execution environment (TEE) to obtain a second user password factor.

[0190] It should be noted that before executing S3072B, the second device sends the first private key to the third device, and the first device sends the second public key to the third device.

[0191] S3073A. The second device encrypts the second user password factor using the second public key to obtain fifth encrypted data.

[0192] S3073B. The third device encrypts the second user password factor using the second public key under TEE to obtain fifth encrypted data.

[0193] S3074A. The second device sends the fifth encrypted data to the first device.

[0194] S3074B. The third device sends the fifth encrypted data to the first device.

[0195] S3075. The first device receives the fifth encrypted data.

[0196] In a possible implementation, the first device receives fifth encrypted data sent by the second device.

[0197] In another possible implementation, the first device receives fifth encrypted data sent by the third device.

[0198] S3076. The first device decrypts the fifth encrypted data using the second private key corresponding to the second public key to obtain the second user password factor.

[0199] It should be noted that the embodiments of the present application do not specifically limit the public key encryption algorithm for encrypting data with a public key and the private key decryption algorithm for decrypting data with a private key, and can be configured according to actual needs. For example, the public key encryption algorithm may include but is not limited to: SM2 public key encryption algorithm, Ronald Rivest, Adi Shamir, Leonard Adleman (RSA) public key encryption algorithm; the private key decryption algorithm may include but is not limited to: SM2 private key decryption algorithm, RSA private key decryption algorithm.

[0200] In this way, the first device stores the encrypted first user password factor, but the first device itself does not have the decryption capability, and the communication data between the first device and the second device are all encrypted, so this method of obtaining the second user password factor is more secure.

[0201] Below, the data processing method provided in the embodiment of the present application is explained through specific application scenarios.

[0202] To facilitate understanding, some technical aspects are explained first.

[0203] SM2 algorithm: refers to the elliptic curve public key cryptography algorithm, which is an asymmetric encryption algorithm.

[0204] SM3 algorithm: refers to the cryptographic hash function standard, which is a hash algorithm.

[0205] SM4 algorithm: refers to the block cipher standard, which is a domestic symmetric encryption algorithm.

[0206] The encrypted storage process includes encryption and decryption processes. For the encryption and decryption process, the first solution is to encrypt or decrypt the file through the device's built-in random password; the second solution is to directly encrypt or decrypt the file through the user password.

[0207] The first solution mentioned above does not allow the user password to participate in the encryption process. In theory, the organization that provides encryption or decryption has the ability to decrypt the text, so the security is lower.

[0208] The second solution mentioned above can make the user password directly involved in the file encryption process. If the implementation requires the storage of the user's independent password, its security also depends on the password storage solution. If this method does not need to store the user's password and directly sends the encrypted file after the client encrypts it, it can be relatively safe to a certain extent, and the file storage organization cannot "steal from the inside." However, it affects its usability. If the user password is lost, the encrypted content cannot be restored, and it cannot provide similar independent password modification functions.

[0209] Relying on the mobile trusted execution environment solution, it can achieve "key only held by the user" to a certain extent; but when the user's device is replaced, data decryption will become a problem, and it does not support users to display and set passwords.

[0210] This application makes the following improvements:

[0211] 1. Support user-defined passwords to "indirectly" participate in the encryption process. By using the user password to encrypt the system's built-in password, the user password is involved in the file encryption process. While ensuring user privacy and security, it supports the modification and reset of user passwords. And the modification of the password has no effect on the existing data, and there is no need to decrypt the existing data before encrypting it, taking into account both usability and performance.

[0212] 2. Different from the traditional TEE solution, a third-party trusted certificate authority (without commercial conflicts of interest) is introduced as a TEE certificate service provider. In the scenario of mobile use, the TEE feature is used to support device replacement, and it is compatible with the scenario of mobile terminal (equivalent to the third device, also called terminal device) and non-mobile terminal (equivalent to the second device, also called authentication device) sharing keys.

[0213] For easier understanding, some algorithms (functions) are briefly explained.

[0214] SM3(X), calculate the hash value of X using SM3;

[0215] GENPSW(X), cut off the first 128 bits of X as the password used by SM4;

[0216] SM4ENCRYPT(S, P), SM4 algorithm uses P to encrypt S;

[0217] SM4DECRYPT(D, P), SM4 algorithm P decrypts D;

[0218] SM2ENCRYPT(S, PUK), the SM2 algorithm uses the public key (PUK) to encrypt S;

[0219] SM2DECRYPT(D, PRK), the SM2 algorithm uses the private key (PRK) to decrypt D.

[0220] The data processing method provided in the embodiment of the present application may include but is not limited to a registration process, a password verification process, an encryption process, a decryption process, a password modification process, and a mobile device replacement process.

[0221] The following is an explanation of the registration process:

[0222] When a user registers to use the file hosting service system (hereinafter referred to as this system) on the first device, he needs to set a user-independent password P0 (equivalent to the first user password) and the user's mobile phone number for OTP authentication. When this system creates a user ID, it will also create a user-level random password factor S1 (equivalent to the first user password factor). This system will use the user-independent password P0 to generate the system password P1 by using a salted hash algorithm (SM3 algorithm) and truncating the first 128 bits. The SM4 algorithm is used to encrypt S1 through P1 to obtain the ciphertext D1 (equivalent to the first encrypted data).

[0223] For example, P1 can be obtained by the above formula (2), and D1 can be obtained by the above formula (5).

[0224] P1=GEMPSW(SM3(SALT0+P0)) formula (2);

[0225] D1=SM4ENCRYPT(S1,P1) Formula (5).

[0226] After user registration is completed, the system will generate a public and private key pair<PUK0,PRK0> (PUK0 is the public key of this system, PRK0 is the private key of this system) (equivalent to the second public key and the second private key), the user information (including mobile phone number and PUK0) is transmitted to the third-party certificate authority for registration (equivalent to the second device or authentication device). The third-party certificate authority is responsible for registering and generating user-level public-private key pairs.<PUK1,PRK1> (PUK1 is the public key of the third-party certificate authority, PRK1 is the private key of the third-party certificate authority) (equivalent to the first public key and the first private key)). The third-party certificate authority sends PUK1 to the system, and the system uses the SM2 algorithm to encrypt S1 with PUK1 to obtain ciphertext D2 (equivalent to the fourth encrypted data).

[0227] Optionally, for TEE scenarios of mobile devices (equivalent to third devices), the third-party certificate authority injects PRK1 and PUK0 into the user's TEE; for non-TEE scenarios, no injection is required. D2 is equivalent to the backup of user factor S1 in this system, but the password used for decryption is stored in the third-party certificate authority and the TEE environment, thereby ensuring that this system cannot directly decrypt D2 to restore the password factor S1. The user's independent password P0 is not recorded throughout the process and is destroyed after use. Finally, SM4 is used to encrypt the user ID through P1 to obtain the ciphertext D3 (equivalent to user identification data), and D1, D2, D3, PRK0, and PUK1 are stored.

[0228] For example, D2 can be obtained by formula (8), and D3 can be obtained by formula (9).

[0229] D2=SM2ENCRYPT(S1,PUK1) formula (8);

[0230] Wherein, D2 represents the obtained ciphertext, SM2ENCRYPT represents the SM2 encryption algorithm, S1 represents the user-level random password factor, and PUK1 represents the public key of the third-party certificate authority.

[0231] D3=SM4ENCRYPT(ID,P1) formula (9);

[0232] Wherein, D3 represents the obtained ciphertext, SM4ENCRYPT represents the SM4 encryption algorithm, ID represents the user ID, and P1 represents the system password.

[0233] The password verification process may include:

[0234] All subsequent encryption or decryption related methods require the user to input an independent password P0 (this operation can be completed by other front-end systems, and the user only needs to enter it once and cache it to the server). This system obtains P1 through P0, decrypts (SM4) D3 according to P1 to obtain the plaintext string S, and verifies whether S is equal to the user ID. If they are equal, the verification is considered successful, otherwise, the verification fails.

[0235] For example, P1 can be obtained by formula (2), and ID' can be obtained by formula (10).

[0236] P1=GENPSW(SM3(SALT0+P0)) formula (2);

[0237] ID'=SM4DECRYPT(D3,P1) formula (10);

[0238] Among them, ID' represents the predicted user ID, SM4DECRYPT represents the SM4 decryption algorithm, D3 represents the ciphertext, SALT0 represents the salt value, and P1 represents the system password.

[0239] The encryption process can include:

[0240] The user uploads the file to be encrypted F0 (equivalent to the target object) and the user's independent password P0. Under the premise that the user password is correct, the system creates the corresponding file ID and generates the file-level password factor S2 (equivalent to the object password factor) and the corresponding file password P2 (equivalent to the second password). The system restores P1 from P0, uses P1 to decrypt D1 to restore the user factor S1, assembles a new string S3 through S1+S2, cuts off the first 128 bits of S3 through the salted hash algorithm (SM3 algorithm) to obtain the password P3 (equivalent to the first password), and uses the SM4 algorithm to encrypt F0 (equivalent to the first target object) through P3 to obtain the encrypted file F1; the password P2 is cut off from the first 128 bits through the SM3 algorithm to calculate the password P4, and the SM4 encryption is used to encrypt S2 through P4 to obtain the ciphertext D4 (equivalent to the second encrypted data). The system records F1, P2 and D4.

[0241] For example, P1 can be obtained by formula (2), S1 can be obtained by formula (3), S3 can be obtained by formula (11), P3 can be obtained by formula (12), F1 can be obtained by formula (13), P4 can be obtained by formula (14), and D4 can be obtained by formula (15).

[0242] P1=GEMPSW(SM3(SALT0+P0)) formula (2);

[0243] S1=SM4DECRYPT(D1,P1) formula (3);

[0244] S3=SALT1+S1+S2 formula 11;

[0245] Among them, S3 represents a new string, SALT1 represents a salt value, S1 represents a user-level random password factor, and S2 represents a file-level password factor.

[0246] P3=GENPSW(SM3(S3)) formula (12);

[0247] Among them, P3 represents the obtained password, GENPSW represents the random password generation algorithm, SM3 represents the salted hash algorithm, and S3 represents the new string.

[0248] F1=SM4ENCRYPT(F0,P3) formula (13);

[0249] Among them, F1 indicates that the encrypted file is obtained, SM4ENCRYPT indicates the SM4 encryption algorithm, F0 indicates the file to be encrypted, and P3 indicates the encryption password.

[0250] P4=GENPSW(SM3(SALT2+P2) formula (14);

[0251] Among them, P4 represents the obtained password, GENPSW represents the random password generation algorithm, SM3 represents the salted hash algorithm, SALT2 represents the salt value, and P2 represents the file password.

[0252] D4 = SM4ENCRYPT (S2, P4) Formula (15);

[0253] Among them, D4 represents the obtained file, SM4ENCRYPT represents the SM4 encryption algorithm, S2 represents the password factor at the file level, and P4 represents the encryption password.

[0254] The decryption process may include:

[0255] The user specifies the file ID and independent password P0 to be obtained. Under the premise that the user password is verified correctly, this system restores P1 from P0 and uses P1 to decrypt D1 to restore the user factor S1. This system restores password P4 from password P2 and decrypts D2 from P4 to obtain factor S2.

[0256] The system assembles the password P3 through S1 and S2 in the same way as the encryption process. P3 is used to decrypt the encrypted file F1 (equivalent to the second target object) to restore the original file F0 for the user to use.

[0257] For example, P1 can be obtained by formula (2), S1 can be obtained by formula (3), P4 can be obtained by formula (14), S2 can be obtained by formula (16), S3 can be obtained by formula (11), P3 can be obtained by formula (12), and F0 can be obtained by formula (17).

[0258] P1=GENPSW(SM3(SALT0+P0) formula (2);

[0259] S1=SM4DECRYPT(D1,P1) formula (3);

[0260] P4=GENPSW(SM3(SALT2+P2) formula (14);

[0261] S2 = SM4DECRYPT (D4, P4) Formula (16);

[0262] Among them, S2 represents the file-level password factor, SM4DECRYPT represents the SM4 decryption algorithm, D4 represents the ciphertext of encrypted S2, and P4 represents the encryption password.

[0263] S3=SALT1+S1+S2 formula (11);

[0264] P3=GENPSW(SM3(S3)) formula (12);

[0265] F0=SM4DECRYPT(F1,P3) formula (17);

[0266] Among them, F0 represents the original file after decryption, SM4DECRYPT represents the SM4 decryption algorithm, F1 represents the ciphertext of encrypted F0, and P3 represents the decryption password.

[0267] The password change process may include:

[0268] Scenarios initiated by non-mobile terminals (non-TEE environments, or authentication devices or second devices): OTP SMS verification is required. After verification is passed and the verification is confirmed to be successful, the new password P0' entered by the user is obtained, and D2 is sent to a third-party trusted certificate authority. The third-party trusted certificate authority uses PRK1 to decrypt D2 to obtain S1, and the third-party trusted certificate authority uses PUK0 to encrypt S1 and transmit it back to this system (to ensure the security of the transmission process).

[0269] Scenario initiated by mobile TEE: No OTP verification is required. Use PRK1 in TEE to decrypt D2 to get S1, and use PUK0 to encrypt S1 and send it back to this system.

[0270] This system receives the returned file and uses PRK0 to decrypt it to get S1, generates P1' in the same way as the registration process, and uses P1' to encrypt S1 to get the new ciphertext D1', and replaces D1 with D1'. In this way, the new password P0' (equivalent to the second user password) can be used for encryption and decryption later, and the user password is indirectly involved in the encryption process, which supports password change while taking into account availability. Password change does not require re-encryption or decryption of the stored file (F1), which greatly saves performance overhead compared to traditional solutions.

[0271] For example, for TEE or a third-party trusted certificate authority, S1 can be obtained by formula (18), S1_ENCRYPTED can be obtained by formula (19), S1 can be obtained by formula (20), and P1' can be obtained by formula (21).

[0272] S1=SM2DECRYPT(D2,PRK1) formula (18);

[0273] Among them, S1 represents the user-level random password factor, SM2DECRYPT represents the SM2 decryption algorithm, D2 represents the ciphertext of encrypted S1, and PRK1 represents the private key of the third-party trusted certificate authority.

[0274] S1_ENCRYPTED=SM2ENCRYPT(S1,PUK0) Formula (19);

[0275] Among them, S1_ENCRYPTED represents the obtained ciphertext, SM2DECRYPT represents the SM2 encryption algorithm, S1 represents the user-level random password factor, and PUK0 represents the public key of this system.

[0276] For example, for this system, S1 can be obtained by formula (20), P1' can be obtained by formula (21), and D1' can be obtained by formula (22).

[0277] S1=SM2DECRYPT(S1_ENCRYPTED, PRK0) formula (20);

[0278] Among them, S1 represents the user-level random password factor, SM2DECRYPT represents the SM2 decryption algorithm, S1_ENCRYPTED represents the encrypted ciphertext of S1, and PRK0 represents the private key of this system.

[0279] P1'=GENPSW(SM3(SALT0+P0')) formula (21);

[0280] Among them, P1' represents the updated system password, GENPSW represents the random password generation algorithm, SM3 represents the salted hash algorithm, SALT0 represents the salt value, and P0' represents the modified user password.

[0281] D1'=SM4ENCRYPT(S1,P1') formula (22);

[0282] Wherein, D1' represents the obtained ciphertext, SM4ENCRYPT represents the SM4 encryption algorithm, S1 represents the user-level random password factor, and P1' represents the updated system password.

[0283] The mobile device replacement process may include:

[0284] On the premise of successfully verifying the user password P0, notify the third-party trusted certificate authority to re-inject PRK1 and PUK0 into the TEE of the trusted mobile device.

[0285] It should be noted that this system provides an open (Open) API method through the use of third-party applications allocated by this system and the dynamic password refresh mechanism for authentication. The mobile terminal usage scenario also relies on an intermediate service to access this system using the same mechanism.

[0286] If you need to change the device, you need to invalidate the original device, and then go through the registration process again to regenerate a new public and private key pair.<PUK1’,PRK1’> , and update D2 in this system to D2', and inject the new PRK1' and PUK0 into the new device.

[0287] The salt value of the salted hash is maintained in this system and cannot be directly restored externally. The salt value in different processes can be the same or different.

[0288] To implement the above data processing method, a data processing device according to an embodiment of the present application is provided as follows: Figure 8 The structure of the data processing device is described below.

[0289] like Figure 8 As shown, the data processing device 80 includes: a prediction unit 801, an acquisition unit 802 (for the sake of distinction, it can also be called a first acquisition unit 802), a decryption unit 803, a generation unit 804 and a processing unit 805. Among them:

[0290] Prediction unit 801, used for decrypting user identification data based on the received first user password to obtain a predicted user identification;

[0291] An obtaining unit 802 is used to obtain an actual user identifier associated with the first user password;

[0292] a decryption unit 803, configured to determine that the first user password verification is successful if the predicted user identifier is the same as the actual user identifier, decrypt the first encrypted data based on the first user password to obtain a first user password factor, wherein the first encrypted data includes the encrypted first user password factor;

[0293] A generating unit 804, configured to generate a first password based at least on the first user password factor;

[0294] The processing unit 805 is configured to encrypt or decrypt the target object using the first password.

[0295] In some embodiments, the decryption unit 803 is further configured to:

[0296] A system password corresponding to the first user password is generated based on the first user password; the system password is a password for the system corresponding to the first user password; the first encrypted data is decrypted by the system password to obtain the first user password factor.

[0297] In some embodiments, the data processing device 80 further includes a second obtaining unit.

[0298] An obtaining unit, configured to obtain an object cryptographic factor for the target object;

[0299] Correspondingly, the generating unit 804 is configured to generate the first password based on the first user password factor and the object password factor.

[0300] In some embodiments, the obtaining unit is further used to: decrypt second encrypted data based on a second password to obtain the object cryptographic factor, wherein the second encrypted data includes the encrypted object cryptographic factor.

[0301] In some embodiments, the generating unit 804 is further configured to:

[0302] Assembling the sum of the first user factor and the object password factor into a password string;

[0303] Perform salted hash calculation on the password string to obtain a password hash value;

[0304] The first W bits of the password hash value are truncated to generate the first password.

[0305] In some embodiments, the data processing device 80 further includes a password modification unit.

[0306] a password modification unit, configured to obtain a second user password factor when receiving a second user password, wherein the first user password factor and the second user password factor have the same content;

[0307] The second user password factor is encrypted based on the received second user password to obtain third encrypted data; and the first encrypted data is updated based on the third encrypted data.

[0308] The data processing device 80 further includes a communication unit.

[0309] A communication unit, configured to receive a first public key for an authentication device; and encrypt the first user password factor using the first public key to obtain fourth encrypted data;

[0310] The password modification unit is also used to send the fourth encrypted data to the authentication device or terminal device; receive the fifth encrypted data, the fifth encrypted data including the second user password factor encrypted by the second public key, the second public key is the public key for the first device; decrypt the fifth encrypted data by the second private key corresponding to the second public key to obtain the second user password factor.

[0311] It should be noted that the data processing device provided in the embodiment of the present application includes the various units included, which can be implemented by a processor in an electronic device; of course, it can also be implemented by a specific logic circuit; in the implementation process, the processor can be a central processing unit (CPU, Central Processing Unit), a microprocessor (MPU, Micro Processor Unit), a digital signal processor (DSP, Digital Signal Processor) or a field programmable gate array (FPGA, Field-Programmable Gate Array), etc.

[0312] The description of the above device embodiment is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the device embodiment of the present application, please refer to the description of the method embodiment of the present application for understanding.

[0313] It should be noted that in the embodiment of the present application, if the above-mentioned data processing method is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the relevant technology can be embodied in the form of a software product, which is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a U disk, a mobile hard disk, a read-only memory (ROM), a disk or an optical disk. In this way, the embodiment of the present application is not limited to any specific combination of hardware and software.

[0314] To implement the above-mentioned data processing method, an embodiment of the present application provides an electronic device, including a memory and a processor, wherein the memory stores a computer program that can be run on the processor, and when the processor executes the program, the steps in the data processing method provided in the above-mentioned embodiment are implemented.

[0315] Combine the following Fig. 9 The electronic device 90 shown is a block diagram of the electronic device.

[0316] In one example, the electronic device 90 may be the first device mentioned above. Fig. 9As shown, the electronic device 90 includes: a processor 901, at least one communication bus 902, a user interface 903, at least one external communication interface 904 and a memory 905. The communication bus 902 is configured to achieve connection and communication between these components. The user interface 903 may include a display screen, and the external communication interface 904 may include a standard wired interface and a wireless interface.

[0317] The memory 905 is configured to store instructions and applications executable by the processor 901, and can also cache data to be processed or processed by the processor 901 and various modules in the electronic device (for example, image data, audio data, voice communication data, and video communication data), which can be implemented through flash memory (FLASH) or random access memory (Random Access Memory, RAM).

[0318] In a fourth aspect, an embodiment of the present application provides a storage medium, that is, a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps in the data processing method provided in the above embodiment are implemented.

[0319] It should be noted here that the description of the above storage medium and device embodiments is similar to the description of the above method embodiments, and has similar beneficial effects as the method embodiments. For technical details not disclosed in the storage medium and device embodiments of this application, please refer to the description of the method embodiments of this application for understanding.

[0320] It should be understood that "one embodiment" or "an embodiment" mentioned throughout the specification means that specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, "in one embodiment" or "in some embodiments" appearing throughout the specification may not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. It should be understood that in various embodiments of the present application, the size of the sequence number of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application. The above-mentioned sequence numbers of the embodiments of the present application are for description only and do not represent the advantages and disadvantages of the embodiments.

[0321] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0322] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0323] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units; they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0324] In addition, all functional units in the embodiments of the present application may be integrated into one processing unit, or each unit may be a separate unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0325] A person skilled in the art can understand that all or part of the steps of implementing the above method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiment; and the aforementioned storage medium includes: mobile storage devices, read-only memories (ROM), magnetic disks or optical disks, etc., various media that can store program codes.

[0326] Alternatively, if the above-mentioned integrated unit of the present application is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application can be essentially or partly embodied in the form of a software product that contributes to the relevant technology. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROMs, magnetic disks, or optical disks.

[0327] The above is only an implementation method of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A data processing method, characterized in that: The method is applied to a first device, and the method includes: decrypting the user identification data based on the received first user password to obtain a predicted user identification; Obtaining an actual user identification associated with the first user password; If the predicted user identifier is the same as the actual user identifier, it is determined that the first user password verification is successful, and the first encrypted data is decrypted based on the first user password to obtain a first user password factor, where the first encrypted data includes the encrypted first user password factor; generating a first password based at least on the first user password factor; The target object is encrypted or decrypted using the first password.

2. The method according to claim 1, characterized in that The decrypting the first encrypted data based on the first user password to obtain the first user password factor includes: Generate a system password corresponding to the first user password based on the first user password; the system password is a password for the system corresponding to the first user password; The first encrypted data is decrypted using the system password to obtain the first user password factor.

3. The method according to claim 1, characterized in that The method further comprises: Obtaining an object cryptographic factor for the target object; The generating a first password based at least on the first user password factor includes: The first password is generated based on the first user password factor and the object password factor.

4. The method according to claim 3, characterized in that The obtaining of the object cryptographic factor for the target object includes: The second encrypted data is decrypted based on the second password to obtain the object cryptographic factor, wherein the second encrypted data includes the encrypted object cryptographic factor.

5. The method according to claim 3, characterized in that: The generating the first password based on the first user password factor and the object password factor includes: Assembling the sum of the first user password factor and the object password factor into a password string; Perform salted hash calculation on the password string to obtain a password hash value; The first W bits of the password hash value are truncated to generate the first password.

6. The method according to claim 1, characterized in that The method further comprises: When receiving the second user password, obtaining a second user password factor, wherein the first user password factor and the second user password factor have the same content; encrypting the second user password factor based on the received second user password to obtain third encrypted data; The first encrypted data is updated based on the third encrypted data.

7. The method according to claim 6, characterized in that The method further comprises: receiving a first public key for a second device; Encrypting the first user password factor using the first public key to obtain fourth encrypted data; The obtaining of the second user password factor includes: sending the fourth encrypted data to the second device or the third device; receiving fifth encrypted data, the fifth encrypted data comprising a second user password factor encrypted by a second public key, the second public key being a public key for the first device; The second user password factor is obtained by decrypting the fifth encrypted data using the second private key corresponding to the second public key.

8. A data processing device, characterized in that: The device is deployed on a first device; the device includes: A prediction unit, configured to decrypt the user identification data based on the received first user password to obtain a predicted user identification; An obtaining unit, configured to obtain an actual user identifier associated with the first user password; a decryption unit, configured to determine that the verification of the first user password is successful if the predicted user identifier is the same as the actual user identifier, and decrypt the first encrypted data based on the first user password to obtain a first user password factor, wherein the first encrypted data includes the encrypted first user password factor; a generating unit, configured to generate a first password based at least on the first user password factor; A processing unit is used to encrypt or decrypt the target object using the first password.

9. An electronic device comprising a memory and a processor, wherein the memory stores a computer program that can be run on the processor, and when the processor executes the program, the data processing method according to any one of claims 1 to 7 is implemented.

10. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the data processing method according to any one of claims 1 to 7 is implemented.

Images