A network information security protection method and system

Abstract

The present application provides a kind of network information security protection method, comprising the following steps: first terminal sends registration information to the registration server, and receives the first key from the registration server, first terminal is encrypted by encryptor and first key to the protection information is encrypted, obtains first encrypted information, the first encrypted information is stored to storage server, and the registration information includes account name information;Second terminal sends account name information to the registration server, and receives the first key and random parameter from the registration server, the second terminal obtains first encrypted information based on the random parameter, and requests the storage server, and the second terminal is decrypted based on the first key and encryptor to the first encrypted information.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to a method and system for the security protection of network information. Background Technology

[0002] Currently, most of the personal data on users' mobile phones involves personal privacy, requiring higher protection standards to prevent the theft of user data and resulting losses. However, existing technologies pose risks of data leakage during the process of users transferring personal data from their devices to the cloud, and during the storage of personal data on cloud servers. While enjoying the convenience brought by cloud backup technology, ensuring the security of users' personal data is a pressing issue that needs to be addressed. Summary of the Invention

[0003] The purpose of this invention is to provide a method and system for the security protection of network information, so as to solve the problems mentioned in the background art.

[0004] This invention is achieved through the following technical solution: The first aspect of this invention provides a method for protecting network information security, comprising the following steps:

[0005] The first terminal sends registration information to the registration server and receives a first key from the registration server. The first terminal encrypts the protection information using an encryptor and the first key to obtain first encrypted information. The first encrypted information is stored in the storage server. The registration information includes account name information.

[0006] The second terminal sends account name information to the registration server and receives a first key and random parameters from the registration server. Based on the random parameters, the second terminal requests the storage server to obtain first encrypted information. Based on the first key and the encryptor, the second terminal decrypts the first encrypted information.

[0007] Optionally, the registration information may also include first terminal device identification information and password information corresponding to the account name information.

[0008] Optionally, when the first terminal sends registration information to the registration server and receives the first key from the registration server, it includes:

[0009] After receiving the registration information, the registration server records the registration information and generates random parameters.

[0010] The first terminal device identification information, account name information, and random parameters are input into the first function to obtain the first key, and a correspondence is established between the proof information, the first key, and the random parameters;

[0011] The registration server sends the first key and random parameters to the first terminal.

[0012] Optionally, when the first terminal encrypts the protected information using an encryptor and a first key, the method further includes:

[0013] The encryptor is equipped with a first encryption algorithm library, which contains several first encryption algorithms. Each first encryption algorithm has a corresponding algorithm identifier. A first encryption algorithm is randomly selected, and a correspondence between a first key and the algorithm identifier is established. The protected information is encrypted using the selected first encryption algorithm to obtain the first encrypted information.

[0014] Optionally, when the first encrypted information is stored in the storage server, the method further includes: the first terminal also stores the correspondence between the random parameters, the first key and the algorithm identifier in the storage server, and establishes the correspondence between the random parameters, the first key, the algorithm identifier and the first encrypted information in the storage server.

[0015] Optionally, the username information sent by the second terminal to the registration server is the same as the username information sent by the first terminal to the registration server.

[0016] Optionally, the registration server obtains the corresponding first key and random parameters based on the account name information, and sends the first key and random parameters to the second terminal.

[0017] Optionally, when the second terminal requests the first encrypted information from the storage server based on the random parameters, the method further includes:

[0018] The second terminal sends the random parameters as an access password to the storage server. The storage server, based on the pre-established relationship between the random parameters and the first key, algorithm identifier, and first encryption information, sends the first encryption information, the first key, and the algorithm identifier to the second terminal.

[0019] Optionally, the second terminal decrypts the first encrypted information based on the first key and the encryptor, further including:

[0020] The second terminal compares the first key from the registration server with the first key from the storage server to determine if they are the same. If they are the same, it selects the corresponding first encryption algorithm in the encryptor based on the obtained algorithm identifier, and decrypts the first protection message using the first encryption algorithm and the first key to obtain the protection information.

[0021] A second aspect of the present invention provides a network information security protection system, including a terminal device, a registration server, a storage server, and an encryptor. The terminal device includes a first terminal and a second terminal. When one or more processors in the first terminal execute the one or more programs, the first terminal enables the first terminal to implement the method as described in any one of claims 1 to 5.

[0022] When one or more processors of the second terminal execute the one or more programs, the second terminal causes the second terminal to implement the method as described in any one of claims 6 to 9.

[0023] Compared with the prior art, the beneficial effects achieved by the present invention are as follows:

[0024] This invention provides a method and system for protecting network information. A registration server obtains a first key based on registration information sent by a first terminal. Simultaneously, the first terminal encrypts the protection information using the first key and a first encryption algorithm built into the encryptor, and sends the encrypted information to a storage server. During this process, the first key used for decrypting the protection information is encrypted during transmission. Therefore, the protection information is also under multiple encryption conditions. Even if the protection information is intercepted by a hacker during transmission between the first terminal and the storage server, because the protection information is encrypted and the hacker cannot obtain the corresponding first key, they cannot access the data content, thus greatly improving the security of data transmission. Attached Figure Description

[0025] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only preferred embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1 A flowchart illustrating the overall process of a network information security protection method provided by this invention;

[0027] Figure 2 A flowchart of an encryption process provided in one embodiment of the present invention;

[0028] Figure 3 A flowchart of an encryption process provided for another embodiment of the present invention;

[0029] Figure 4 A flowchart of the decryption process provided in an embodiment of the present invention;

[0030] Figure 5This is a schematic diagram of a network information security protection system provided in an embodiment of the present invention. Detailed Implementation

[0031] To make the objectives, technical solutions, and advantages of the present invention more apparent, exemplary embodiments according to the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are merely a part of the embodiments of the present invention, and not all of the embodiments of the present invention. It should be understood that the present invention is not limited to the exemplary embodiments described herein. Based on the embodiments of the present invention described herein, all other embodiments obtained by those skilled in the art without inventive effort should fall within the protection scope of the present invention.

[0032] In the following description, numerous specific details are set forth in order to provide a more thorough understanding of the invention. However, it will be apparent to those skilled in the art that the invention can be practiced without one or more of these details. In other instances, certain technical features well-known in the art have not been described in order to avoid obscuring the invention.

[0033] It should be understood that the invention can be embodied in various forms and should not be construed as being limited to the embodiments set forth herein. Rather, providing these embodiments will make the disclosure thorough and complete, and will fully convey the scope of the invention to those skilled in the art.

[0034] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the invention. When used herein, the singular forms “a,” “an,” and “the” are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the terms “comprising” and / or “including,” when used in this specification, identify the presence of the stated features, integers, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups. When used herein, the term “and / or” includes any and all combinations of the associated listed items.

[0035] To fully understand this invention, a detailed structure will be presented in the following description to illustrate the technical solution proposed by this invention. Optional embodiments of the invention are described in detail below; however, in addition to these detailed descriptions, the invention may have other embodiments.

[0036] See Figure 1 The first aspect of this invention provides a method for protecting network information security, including but not limited to the following steps:

[0037] Step S1: The first terminal 1 sends registration information to the registration server 2 and receives the first key from the registration server 2. The first terminal 1 encrypts the protection information using the encryptor 5 and the first key to obtain the first encrypted information. The first encrypted information is stored in the storage server 3. The registration information includes account name information.

[0038] Step S2: The second terminal 4 sends account name information to the registration server 2 and receives the first key and random parameters from the registration server 2. Based on the random parameters, the second terminal 4 requests the storage server 3 to obtain the first encrypted information. Based on the first key and the encryptor 5, the second terminal 4 decrypts the first encrypted information.

[0039] The first terminal 1 and the second terminal 4 can be, but are not limited to, other portable devices such as mobile phones, wearable devices, laptops, or tablets. The encryptor 5 can be, but is not limited to, hardware encryption devices that can connect to the first terminal 1 and the second terminal 4. The first terminal 1 is responsible for encrypting the protected information according to the first key obtained through negotiation with the registration server 2 and the first encryption algorithm in the encryptor 5, and storing it in the storage server 3. The second terminal 4 obtains the first key based on the account name information, and the encryptor 5 decrypts the protected information based on the first key.

[0040] Optionally, one or more liveness detection modules are provided on the first terminal 1 and the second terminal 4. The liveness detection module refers to a module that executes a liveness detection method (a method for determining the true physiological characteristics of an object in some identity verification scenarios). For example, the liveness detection module can be a facial recognition module, a voice recognition module, an iris recognition module, a fingerprint recognition module, etc. By setting liveness detection modules on the first terminal 1 and the second terminal 4, malicious use of the first terminal 1 and the second terminal 4 by others can be prevented.

[0041] Step S1 mainly implements the encryption and storage of protected data, and it also includes the following registration sub-process and encryption sub-process, wherein the registration sub-process further includes the following steps:

[0042] 101. After receiving the registration information, the registration server 2 records the registration information and generates a random parameter RAND. The registration information includes not only the account name information, but also the device identification information of the first terminal 1 and the password information corresponding to the account name information. The account name information and password information are character information set by the user, and the device identification information of the first terminal 1 is the device information carried by the first terminal 1 itself.

[0043] 102. The registration server 2 inputs the received device identification information, account name information, and random parameters of the first terminal 1 into the first function to obtain the first key, and establishes a correspondence between the account name information, the first key, and the random parameters;

[0044] The first function is an irreversible function, which can be represented as f1(x). For example, it can be a hash function, represented as hash_1. The device identification information, account name information, and random parameters of the first terminal 1 are input into hash_1 to obtain the first key Key_1. At the same time, a first correspondence relationship is established between the account name information, the first key, and the random parameters in the registration server 2. For example, this first correspondence relationship can be represented as: User ID <—> {Key_1, RAND}.

[0045] The account name information, the first key, and the random parameters are stored in the registration server 2 in the form of a first correspondence. When the registration server 2 receives information using the account name information or the random parameters as the access password, it can search in the registration server 2 according to the above correspondence. For example, when searching by account name, the first key and random parameters corresponding to the account name can be obtained.

[0046] See Figure 2 Furthermore, in embodiments of this application, the encryption sub-process includes:

[0047] 301. The registration server 2 sends a first key and random parameters to the first terminal 1, and the first terminal 1 receives the first key and random parameters accordingly.

[0048] 302. Connect the first terminal 1 to the encryptor 5 to establish a data connection relationship between the first terminal 1 and the encryptor 5. The encryptor 5 includes several first encryption algorithms, and each first encryption algorithm has a preset algorithm identifier.

[0049] 303. The first terminal 1 randomly selects a first encryption algorithm in the encryptor 5 and establishes a second correspondence between the algorithm identifier of the first encryption algorithm and the first key. For example, the correspondence can be represented as: Key_1<—>{b_1}, where b_1 represents the algorithm identifier;

[0050] 304. Based on the first key, the first terminal 1 encrypts the protected information using the selected first encryption algorithm to obtain the first encrypted information.

[0051] Optionally, in one embodiment of this application, the registration server 2 and the first terminal 1 are provided with a second function, which can be represented as f2(x). The second function is an invertible function. When the first key Key_1 and random parameters are input into the second function, the second key Key_2 can be obtained. Similarly, when the second key Key_2 is input into the second function, the first key Key_1 and random parameters can be obtained.

[0052] See Figure 3 Therefore, the encryption sub-process may further include the following steps:

[0053] 301. The registration server 2 sends the second key information and random parameters to the first terminal 1, and correspondingly, the first terminal 1 receives the second key information and random parameters from the registration server 2;

[0054] 302. Perform the inverse operation on the second key through the second function in the first terminal 1 to generate the first key and random parameters. Compare the random parameters generated by the second function with the random parameters sent by the registration server 2 to determine whether they are consistent. If they are consistent, it means that the inverse operation of the second function has no error. If they are inconsistent, then the inverse operation of the second function is performed again.

[0055] 303. Connect the first terminal 1 to the encryptor 5 and establish a data connection relationship between the first terminal 1 and the encryptor 5. The encryptor 5 includes several first encryption algorithms, and each first encryption algorithm has a preset algorithm identifier. The first terminal 1 randomly selects a first encryption algorithm in the encryptor 5 and establishes a second correspondence between the algorithm identifier of the first encryption algorithm and the first key.

[0056] 304. Based on the first key, the first terminal 1 encrypts the protected information using the selected first encryption algorithm to obtain the first encrypted information.

[0057] After the encryption sub-process, the first terminal 1 sends the obtained first encryption information, random parameters, and second correspondence to the storage server 3 for storage. A third correspondence is established in the storage server 3. The third correspondence includes the first encryption information, random parameters, first key, and algorithm identifier, which can be represented as: RAND<—>{Key_1,Key_message,[Key_1<—>{b_1}]}.

[0058] As can be seen, under the action of the first function, the registration server 2 obtains the first key based on the registration information sent by the first terminal 1. The first key is converted into the second key under the action of the second function. After the second key is returned to the first terminal 1, the first terminal 1 performs the reverse conversion of the second key through the built-in second function to decrypt and obtain the first key. At the same time, the first terminal 1 encrypts the protection information in the first terminal 1 using the first key and the first encryption algorithm built into the encryptor 5, and sends the encrypted first encrypted information to the storage server 3. In this process, the first key used for decrypting the protection information is encrypted during transmission. Therefore, the protection information is also under multiple encryption conditions. Even if the protection information is intercepted by a hacker during the transmission between the first terminal 1 and the storage server 3, since the protection information is encrypted and the hacker cannot obtain the corresponding first key, the content of the data information cannot be obtained.

[0059] Step S2 mainly obtains the first key through the registration server 2, and then uses the first key and the encryptor 5 to decrypt the first encrypted information. The decryption process can be found in [link to relevant documentation]. Figure 4 ,include:

[0060] 201. The account name information sent by the second terminal 4 to the registration server 2 is consistent with the account name information sent by the first terminal 1 to the registration server 2.

[0061] 202. After receiving the account name information sent by the second terminal 4, the registration server 2 obtains the first key Key_1 and random parameter RAND corresponding to the account name information based on the pre-established relationship user ID<—>{Key_1, RAND}, and returns the first key Key_1 and random parameter RAND to the second terminal 4.

[0062] 203. The second terminal 4 sends an access request to the storage server 3 using the random parameter RAND as the access password. The storage server 3 obtains the first encryption information, the first key, and the algorithm identifier corresponding to the first key based on the pre-established RAND<—>{Key_1, Key_message, [Key_1<—>{b_1}]}, and returns the above content to the second terminal 4.

[0063] 204. The second terminal 4 compares the first key Key_1 from the registration server 2 with the first key Key_1 from the storage server 3 to determine whether they are the same. If they are the same, the second terminal 4 selects the corresponding first encryption algorithm in the encryptor 5 according to the algorithm identifier corresponding to the first key, and decrypts the first encrypted information based on the first encryption algorithm and the first key, thereby realizing the acquisition of protected information.

[0064] As can be seen, during the data transmission between storage server 3 and second terminal 4, the data (the first encrypted information) is in an encrypted state.

[0065] See Figure 5 The second aspect of the present invention provides a network information security protection system, including terminal devices, a registration server 2, a storage server 3, and an encryptor 5. The terminal devices include a first terminal 1 and a second terminal 4. The terminal device that encrypts the protection information and uploads it to the storage server 3 is referred to as the first terminal 1, and the terminal device that downloads the first encrypted information from the storage server 3 and decrypts it is referred to as the second terminal 4.

[0066] The registration server 2 is used to generate a first key based on the registration information sent by the first terminal 1;

[0067] The storage server 3 is used to store the first encrypted information, and at the same time, it establishes a correspondence between the first encrypted information, random parameters, first key, and algorithm identifier within the storage server 3.

[0068] Both the first terminal 1 and the second terminal 4 include at least one processor and a memory. It is understood that when one or more processors in the first terminal 1 execute the one or more programs, the first terminal 1 performs an encryption process for protecting data. Furthermore, the memory in the first terminal 1 can store computer instructions, such as a second function or other encryption functions.

[0069] When one or more processors of the second terminal 4 execute the one or more programs, the second terminal 4 performs the decryption process described above.

[0070] The memory in this application embodiment can be volatile memory or non-volatile memory, or it can include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM). It should be noted that the memory used in the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0071] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for protecting network information security, characterized in that, Includes the following steps: The first terminal sends registration information to the registration server and receives a first key from the registration server. The first terminal encrypts the protection information using an encryptor and the first key to obtain first encrypted information. The first encrypted information is stored in the storage server. The registration information includes account name information. The second terminal sends account name information to the registration server and receives a first key and random parameters from the registration server. Based on the random parameters, the second terminal requests the storage server to obtain first encrypted information. Based on the first key and the encryptor, the second terminal decrypts the first encrypted information. The registration information also includes first terminal device identification information and password information corresponding to the account name information; When the first terminal sends registration information to the registration server and receives the first key from the registration server, it includes: After receiving the registration information, the registration server records the registration information and generates random parameters. The first terminal device identification information, account name information, and random parameters are input into the first function to obtain the first key, and a correspondence is established between the first terminal device identification information and account name information and the first key and random parameters; the first function is an irreversible function, and the first function is represented as f1(x); The registration server sends a first key and random parameters to the first terminal; When the first terminal encrypts the protected information using an encryptor and a first key, it also includes: The encryptor is equipped with a first encryption algorithm library, which contains several first encryption algorithms. Each first encryption algorithm has a corresponding algorithm identifier. A first encryption algorithm is randomly selected, and a correspondence between a first key and the algorithm identifier is established. The protected information is encrypted using the selected first encryption algorithm to obtain the first encrypted information.

2. The method for protecting network information security according to claim 1, characterized in that, When the first encrypted information is stored in the storage server, the method further includes: the first terminal also stores the correspondence between the random parameters, the first key and the algorithm identifier in the storage server, and establishes the correspondence between the random parameters, the first key, the algorithm identifier and the first encrypted information in the storage server.

3. A method for protecting network information security according to claim 1 or 2, characterized in that, The username information sent by the second terminal to the registration server is the same as the username information sent by the first terminal to the registration server.

4. The method for protecting network information security according to claim 3, characterized in that, The registration server obtains the corresponding first key and random parameters based on the account name information, and sends the first key and random parameters to the second terminal.

5. A method for protecting network information security according to claim 4, characterized in that, When the second terminal requests the first encrypted information from the storage server based on the random parameters, the method further includes: The second terminal sends the random parameters as an access password to the storage server. The storage server, based on the pre-established relationship between the random parameters and the first key, algorithm identifier, and first encryption information, sends the first encryption information, the first key, and the algorithm identifier to the second terminal.

6. A method for protecting network information security according to claim 5, characterized in that, The second terminal, based on the first key and the encryptor, decrypts the first encrypted information, and further includes: The second terminal compares the first key from the registration server with the first key from the storage server to determine if they are the same. If they are the same, it selects the corresponding first encryption algorithm in the encryptor based on the obtained algorithm identifier, and decrypts the first encrypted information using the first encryption algorithm and the first key to obtain the protected information.

7. A network information security protection system, characterized in that, The system includes a terminal device, a registration server, a storage server, and an encryptor. The terminal device includes a first terminal and a second terminal. When one or more processors in the first terminal execute the one or more programs, the first terminal enables the method as described in claim 1 or 2. When one or more processors of the second terminal execute the one or more programs, the second terminal causes the second terminal to implement the method as described in any one of claims 3 to 6.

Images