Structured information encryption system, method, device, medium and equipment

Abstract

The present application provides a structured information encryption system, method, device, computer-readable storage medium and electronic device, which relates to the field of data encryption technology, including: a data processing subsystem encrypts specific information according to the right holder's public key to obtain reference information; generates target information according to the reference information and user information containing the right holder's information; calculates summary information according to the target information, and sends the user information, specific information and summary information to the right holder's control subsystem. Then, the right holder's control subsystem verifies the summary information according to the user information and specific information; if the verification is successful, the summary information is encrypted according to the right holder's private key corresponding to the right holder's public key, and a first digital signature is obtained and the first digital signature is sent to the data processing subsystem. The data processing subsystem generates a private data block according to the first digital signature, user information and reference information. It can be seen that the implementation of the above method can improve the security and privacy of data and prevent user data leakage.

Description

Technical Field

[0001] The present application relates to the technical field of data encryption, and in particular, to a structured information encryption system, a structured information encryption method, a structured information encryption device, a computer-readable storage medium, and an electronic device. Background Art

[0002] When storing data within a system or transmitting data across systems, the user data involved in data transmission is prone to the risk of being leaked or tampered with. How to improve the security of data transmission has become an urgent problem to be solved.

[0003] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present application, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0004] The purpose of this application is to provide a structured information encryption system, a structured information encryption method, a structured information encryption device, a computer-readable storage medium and an electronic device, which can improve the security and privacy of data and prevent user data from being leaked or tampered with, thereby facilitating the improvement of the security and privacy of data transmission.

[0005] Other features and advantages of the present application will become apparent from the following detailed description, or may be learned in part by the practice of the present application.

[0006] According to one aspect of the present application, a structured information encryption system is provided, comprising: a data processing subsystem and a rights holder control subsystem, wherein:

[0007] A data processing subsystem, used to encrypt specific information according to the public key of the right holder to obtain reference information;

[0008] The data processing subsystem is further used to generate target information based on the reference information and the user information including at least the right holder information;

[0009] The data processing subsystem is further used to calculate summary information based on the target information, and send the user information, specific information and summary information to the right holder control subsystem;

[0010] The right holder control subsystem is used to verify the summary information according to the user information and the specific information; if the verification is successful, the summary information is encrypted according to the right holder's private key corresponding to the right holder's public key to obtain a first digital signature and send the first digital signature to the data processing subsystem;

[0011] The data processing subsystem is also used to generate a privacy data block according to the first digital signature, user information and reference information.

[0012] In an exemplary embodiment of the present application, the data processing subsystem generates a privacy data block according to the first digital signature, user information and reference information, including:

[0013] When the data processing subsystem detects that the data verification mode is a single-person verification mode, it generates a privacy data block according to the first digital signature, user information and reference information.

[0014] In an exemplary embodiment of the present application, the user information also includes the prover information, wherein: the data processing subsystem is also used to verify the privacy data block according to the right holder's public key in the right holder information; or, to verify the privacy data block according to the right holder's public key and the prover public key in the prover information.

[0015] In an exemplary embodiment of the present application, the structured information encryption system further includes a prover control subsystem, and the user information further includes prover information, wherein:

[0016] The data processing subsystem is further used to send the user information, the specific information and the summary information to the certifier control subsystem when it is detected that the data verification method is a two-person verification method;

[0017] The prover control subsystem is used to verify the summary information according to the user information and the specific information; if the verification is successful, the summary information is encrypted according to the prover private key to obtain a second digital signature and the second digital signature is sent to the data processing subsystem;

[0018] And, the data processing subsystem generates a privacy data block according to the first digital signature, the user information and the reference information, including:

[0019] The data processing subsystem generates a privacy data block according to the first digital signature, the second digital signature, the user information and the reference information.

[0020] In an exemplary embodiment of the present application, wherein:

[0021] The data processing subsystem is also used to determine at least one target field and collect field information corresponding to at least one target field before encrypting specific information according to the public key of the right holder to obtain reference information; and generate specific information based on at least one target field and the field information corresponding to at least one target field.

[0022] In an exemplary embodiment of the present application, the right holder control subsystem is further used to decrypt the privacy data block according to the right holder's private key to obtain a plain text;

[0023] The data processing subsystem is further used to display the plain text with functional limitations, wherein the functional limitations are at least used to indicate that the copy function is disabled.

[0024] In an exemplary embodiment of the present application, the right holder public key includes a first right holder public key and a second right holder public key, and the data processing subsystem encrypts specific information according to the right holder public key to obtain reference information, including:

[0025] The data processing subsystem encrypts specific information according to the public key of the first right holder to obtain intermediate information;

[0026] The data processing subsystem encrypts the intermediate information according to the public key of the second right holder to obtain the reference information.

[0027] In an exemplary embodiment of the present application, if there are multiple right holder control subsystems, the data processing subsystem receives the first digital signature sent by the right holder control subsystem, including:

[0028] The data processing subsystem receives the first digital signatures sent by the plurality of right holder control subsystems, and obtains a plurality of first digital signatures;

[0029] And, the data processing subsystem generates a privacy data block according to the first digital signature, the user information and the reference information, including:

[0030] The data processing subsystem generates a privacy data block according to a plurality of first digital signatures, user information and reference information.

[0031] According to one aspect of the present application, a structured information encryption method is provided, which may include:

[0032] Encrypt specific information according to the public key of the right holder to obtain reference information;

[0033] generating target information according to reference information and user information including at least right holder information;

[0034] Calculate summary information according to target information, and send user information, specific information and summary information to the right holder control subsystem; wherein the right holder control subsystem is used to verify the summary information according to the user information and specific information, and if the verification is successful, encrypt the summary information according to the right holder private key to obtain a first digital signature;

[0035] Receive the first digital signature sent by the right holder control subsystem, and generate a privacy data block according to the first digital signature, user information and reference information.

[0036] According to one aspect of the present application, a structured information encryption device is provided, comprising: an information encryption unit, an information generation unit and an information sending unit, wherein:

[0037] An information encryption unit, used to encrypt specific information according to the public key of the right holder to obtain reference information;

[0038] An information generating unit, configured to generate target information according to reference information and user information including at least right holder information;

[0039] An information sending unit, used to calculate summary information according to target information, and send the user information, specific information and summary information to the right holder control subsystem; wherein the right holder control subsystem is used to verify the summary information according to the user information and specific information, and if the verification is successful, encrypt the summary information according to the right holder private key to obtain a first digital signature;

[0040] The information generation unit is also used to receive the first digital signature sent by the right holder control subsystem, and generate a privacy data block according to the first digital signature, user information and reference information.

[0041] According to one aspect of the present application, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute the steps performed by any of the above-mentioned systems by executing the executable instructions.

[0042] According to one aspect of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps executed by any of the above-mentioned systems are implemented.

[0043] According to one aspect of the present application, a computer program product or a computer program is provided, the computer program product or the computer program comprising computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the steps performed by the system provided in the various optional implementations described above.

[0044] The exemplary embodiments of the present application may have some or all of the following beneficial effects:

[0045] In a structured information encryption system provided by an example implementation of the present application, the data processing subsystem encrypts specific information according to the public key of the right holder to obtain reference information; generates target information according to the reference information and user information containing at least the right holder information; calculates summary information according to the target information, and sends the user information, specific information and summary information to the right holder control subsystem. Furthermore, the right holder control subsystem verifies the summary information according to the user information and specific information; if the verification is successful, the summary information is encrypted according to the right holder's private key corresponding to the right holder's public key, and the first digital signature is obtained and sent to the data processing subsystem. The data processing subsystem generates a private data block according to the first digital signature, user information and reference information. According to the above scheme description, on the one hand, the present application can improve the security and privacy of data, prevent user data from being leaked or tampered with, thereby helping to improve the security and privacy of data transmission. On the other hand, the present application can improve the participation of the right holder in the data encryption process by encrypting the original data multiple times, that is, improve the interactivity, and further improve the authenticity of the data to prevent the data from being stolen or tampered with.

[0046] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] The drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present application, and together with the specification are used to explain the principles of the present application. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0048] Figure 1 A schematic diagram showing the structure of a computer system suitable for implementing an electronic device of an embodiment of the present application is shown;

[0049] Figure 2 The structure diagram of a structured information encryption system according to an embodiment of the present application is schematically shown;

[0050] Figure 3 The structure block diagram of the data processing subsystem according to one embodiment of the present application is schematically shown;

[0051] Figure 4 The structural block diagram of the right holder control subsystem according to an embodiment of the present application is schematically shown;

[0052] Figure 5 The following schematically shows a schematic diagram of an information encryption process according to an embodiment of the present application;

[0053] Figure 6 A schematic diagram of an information encryption process according to another embodiment of the present application is schematically shown;

[0054] Figure 7 A sequence diagram schematically shows the interaction between a data processing subsystem and a right holder control subsystem according to an embodiment of the present application;

[0055] Figure 8 The structure block diagram of a structured information encryption system according to an embodiment of the present application is schematically shown;

[0056] Fig. 9 The following schematically shows a schematic diagram of an information encryption process according to an embodiment of the present application;

[0057] Fig.10 A sequence diagram schematically illustrates the interaction between a data processing subsystem, a rights holder control subsystem, and a certifier control subsystem according to an embodiment of the present application;

[0058] Fig.11 The flowchart of the structured information encryption method according to one embodiment of the present application is schematically shown;

[0059] Fig.12 The structural block diagram of a structured information encryption device according to an embodiment of the present application is schematically shown. DETAILED DESCRIPTION

[0060] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as being limited to the examples set forth herein; on the contrary, these embodiments are provided so that the present application will be more comprehensive and complete, and the concept of the example embodiments will be fully conveyed to those skilled in the art. The described features, structures, or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present application. However, those skilled in the art will appreciate that the technical solutions of the present application may be practiced while omitting one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known technical solutions are not shown or described in detail to avoid obscuring various aspects of the present application.

[0061] In addition, the accompanying drawings are only schematic illustrations of the present application and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and thus their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0062] See also Figure 1 , Figure 1 The schematic diagram of the structure of the computer system of the electronic device suitable for implementing the embodiment of the present application is shown. It should be noted that the computer system 100 of the electronic device is only an example and should not bring any limitation to the function and scope of use of the embodiment of the present application.

[0063] like Figure 1 As shown, the computer system 100 includes a central processing unit (CPU) 101, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 102 or a program loaded from a storage part 108 to a random access memory (RAM) 103. In the RAM 103, various programs and data required for system operation are also stored. The CPU 101, the ROM 102, and the RAM 103 are connected to each other through a bus 104. An input / output (I / O) interface 105 is also connected to the bus 104.

[0064] The following components are connected to the I / O interface 105: an input section 106 including a keyboard, a mouse, etc.; an output section 107 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 108 including a hard disk, etc.; and a communication section 109 including a network interface card such as a LAN card, a modem, etc. The communication section 109 performs communication processing via a network such as the Internet. A drive 110 is also connected to the I / O interface 105 as needed. A removable medium 111, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 110 as needed, so that a computer program read therefrom is installed into the storage section 108 as needed.

[0065] In particular, according to an embodiment of the present application, the process described below with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication section 109, and / or installed from a removable medium 111. When the computer program is executed by a central processing unit (CPU) 101, various functions defined in the method and apparatus of the present application are executed.

[0066] See also Figure 2 , Figure 2 The structure diagram of the structured information encryption system according to an embodiment of the present application is schematically shown. Figure 2 As shown, the structured information encryption system 200 may include: a data processing subsystem 210 and a rights holder control subsystem 220, wherein:

[0067] The data processing subsystem 210 is used to encrypt specific information according to the public key of the right holder to obtain reference information;

[0068] The data processing subsystem 210 is further used to generate target information based on the reference information and the user information including at least the right holder information;

[0069] The data processing subsystem 210 is further used to calculate summary information based on the target information, and send the user information, specific information and summary information to the right holder control subsystem 220;

[0070] The right holder control subsystem 220 is used to verify the summary information according to the user information and the specific information; if the verification is successful, the summary information is encrypted according to the right holder's private key corresponding to the right holder's public key to obtain a first digital signature and send the first digital signature to the data processing subsystem 210;

[0071] The data processing subsystem 210 is further configured to generate a private data block according to the first digital signature, user information and reference information.

[0072] Implementation Figure 2 The system shown can improve the security and privacy of data, prevent user data from being leaked or tampered with, and thus help improve the security and privacy of data transmission. In addition, the participation of the right holder in the data encryption process can be improved by encrypting the original data multiple times, that is, the interactivity is improved, which can further improve the authenticity of the data and prevent the data from being stolen or tampered with.

[0073] Next, the above steps of this exemplary embodiment are described in more detail.

[0074] As an optional implementation, before the data processing subsystem 210 encrypts the specific information according to the public key of the right holder to obtain the reference information, the data processing subsystem 210 is further used to determine at least one target field and collect field information corresponding to the at least one target field; generate specific information according to the at least one target field and the field information corresponding to the at least one target field. In this way, the specific field information corresponding to the target field can be obtained to improve the availability of the specific information.

[0075] Specifically, the data processing subsystem 210 may determine at least one target field and collect field information corresponding to at least one target field in the following manner: the data processing subsystem 210 determines at least one target field D and field information d' corresponding to at least one target field; wherein at least one target field D may be understood as metadata, and field information d' corresponding to at least one target field may be understood as plain text information corresponding to the right holder. For example, at least one target field D may include D1 (name), D2 (gender), and D3 (certificate number), wherein D1 may include field information d1' (Zhang San) corresponding to the name, D2 may include field information d2' (male) corresponding to the gender, and D3 may include field information d3' (6xxxxxxxxxxx4) corresponding to the certificate number.

[0076] Based on this, the data processing subsystem 210 can generate specific information according to at least one target field and the field information corresponding to at least one target field in the following manner: the data processing subsystem 210 generates specific information OIB that meets the preset format according to the target field D and the field information d' (e.g., OIB = {"certificate number": d0}, or OIB = {"certificate number": d0, D1: d1', Dn: dn'}). The preset format is used to limit the arrangement form of the field information d' of the target field D. The preset format can be any of the multiple formats pre-set by the user or a format applicable to the right holder, which is not limited in the embodiment of the present application; the specific information OIB can include text, charts, character strings, etc., and the specific information OIB can be expressed as a data block, a table or other forms, which is not limited in the embodiment of the present application.

[0077] Furthermore, when the number of rights holders participating in data encryption is 1, the data processing subsystem 210 can encrypt specific information according to the rights holder's public key to obtain reference information. The specific implementation is: the data processing subsystem obtains the rights holder's public key from the key library according to the rights holder's identification (such as the rights holder's ID), and encrypts the specific information OIB according to the rights holder's public key to obtain the reference information DD; wherein the rights holder's public key belongs to any key in the rights holder's key. For example, the rights holder's key may include the rights holder's public key and the rights holder's private key, and the rights holder's public key and the rights holder's private key are a pair of corresponding keys, expressed as <right holder's public key, right holder's private key>; the reference information DD can be expressed as a data block, a table or other forms, which is not limited in the embodiments of the present application. In addition, the reference information DD can be understood as privacy data block information, and the specific information OIB can be understood as plaintext information.

[0078] It should be noted that the right holder's public key and the right holder's private key can be expressed as hash values ​​to characterize the right holder's digital identity; in addition, <right holder's public key, right holder's private key> can be a key pair set by the user himself, or it can be a key pair obtained from the CA agency server, which is not limited in the embodiments of the present application.

[0079] Optionally, when the number of right holders participating in data encryption is 2, the right holder public key may include the first right holder public key and the second right holder public key, and the data processing subsystem 210 encrypts specific information according to the right holder public key to obtain reference information, including: the data processing subsystem 210 encrypts specific information according to the first right holder public key to obtain intermediate information; and encrypts the intermediate information according to the second right holder public key to obtain reference information. In this way, multiple information encryptions can be performed in the process of multiple right holders participating in data encryption, so that the reference information can express commonality and ensure the security of data.

[0080] Among them, the first right holder public key may correspond to the first right holder, and the second right holder public key may correspond to the second right holder. Optionally, the right holder public key may also include the third right holder public key, the fourth right holder public key, the fifth right holder public key, etc. The present application does not limit the number of right holders involved in data encryption, nor does it limit the number of right holder public keys. It should be noted that each right holder may correspond to a different public key, and the above-mentioned first right holder public key and second right holder public key are only used to distinguish the public keys corresponding to different right holders, and the first and second do not limit the level or priority of the public key and other parameters. In addition, the intermediate information can be expressed as a data block, a table or other forms, which is not limited in the embodiments of the present application.

[0081] Further optionally, the data processing subsystem 210 can also determine the user information, which is specifically implemented as follows: if only the right holder information including the right holder identity address and the right holder public key is obtained, then data P1 is generated according to at least one of the right holder identity address and the right holder public key, and user information DP is generated according to data P1 (e.g., DP = {"right holder": K + A}), and then the data verification scenario is determined to be a self-certification scenario; if the right holder information including the right holder identity address and the right holder public key and the prover information including the prover identity address and the prover public key are obtained, then data P1 is generated according to the right holder identity address and the right holder public key, and data P2 is generated according to the prover identity address and the prover public key, and then user information DP is generated according to data P1 and data P2 (e.g., DP = {"right holder": K1 + A1, "prove": K2 + A2}), and the data verification scenario is determined to be a he-certification scenario. Among them, the user information DP can be expressed as a data block, a table or other forms, which is not limited in the embodiments of the present application. In addition, it should be noted that the right holder's identity address is calculated by the right holder system based on the right holder's public key, and the prover's identity address is calculated by the prover system based on the prover's public key.

[0082] Furthermore, the data processing subsystem 210 can also generate target information based on reference information and user information that at least includes the information of the right holder. The specific implementation is: the data processing subsystem 210 generates target information m (e.g., m={DP:{"right holder":K+A}, or m={DP:{"right holder":K1+A1,"certifier":K2+A2},DD:{"document number":d}}) based on reference information DD (e.g., DD={"certificate number":d}, or DD={"certificate number":d1,D2:d2,Dn:dn}) and user information DP that at least includes the information of the right holder.

[0083] Based on this, the data processing subsystem 210 can also calculate summary information according to the target information, and send the user information, specific information and summary information to the right holder control subsystem 220, which is specifically implemented as follows: the data processing subsystem 210 calculates summary information di according to the target information m, and sends the user information DP, specific information OIB and summary information di to the right holder control subsystem 220. The method of calculating summary information according to the target information m can be to calculate summary information di corresponding to the target information m according to the data structure of the target information m.

[0084] As an optional implementation, the right holder control subsystem 220 verifies the summary information based on the user information and specific information, including: the right holder control subsystem 220 encrypts the specific information based on the right holder public key to obtain reference information; generates target information based on the reference information and user information containing at least the right holder information; calculates the first reference summary information di' based on the target information, if the first reference summary information di' is consistent with the summary information di sent by the data processing subsystem 210, then the verification is determined to be successful, and then the summary information di is encrypted according to the right holder private key corresponding to the right holder public key to obtain the first digital signature s1 and send the first digital signature s1 to the data processing subsystem 220; if the first reference summary information di' is inconsistent with the summary information di sent by the data processing subsystem 210, then the verification is determined to have failed.

[0085] Furthermore, the data processing subsystem 210 can also generate a privacy data block based on the first digital signature, user information and reference information. Specifically, the data processing subsystem 210 constructs a data block DS according to the first digital signature s1 (e.g., DS = {"right holder": s}, or DS = {"right holder": s1,"witness": s2}); generates a privacy data block OPIB according to the data block DS, user information DP and reference information DD.

[0086] As an optional implementation, the data processing subsystem 210 generates a private data block according to the first digital signature, user information and reference information, including: when the data processing subsystem 210 detects that the data verification method is a single-person verification method, the private data block is generated according to the first digital signature, user information and reference information. This can provide a single-person verification method, and data encryption and verification can be achieved without the participation of a prover.

[0087] In addition, as an optional implementation, if the structured information encryption system further includes a prover control subsystem, the user information also includes prover information, wherein:

[0088] The data processing subsystem 210 is further configured to send the user information, the specific information and the summary information to the prover control subsystem when it is detected that the data verification mode is a two-person verification mode; the prover control subsystem is configured to verify the summary information according to the user information and the specific information; if the verification is successful, the summary information is encrypted according to the prover private key to obtain a second digital signature and the second digital signature is sent to the data processing subsystem;

[0089] In addition, the data processing subsystem 210 generates a privacy data block based on the first digital signature, user information and reference information, including: the data processing subsystem 210 constructs a data block DS based on the first digital signature s1 and the second digital signature s2; generates a privacy data block OPIB based on the data block DS, user information DP and reference information DD (e.g., OPIB = {DP:{"right holder":K1+A1,"certifier":K2+A2}, DD:{"document number":d}, DS:{"right holder":s1,"certifier":s2}}, or OPIB = {DP:{"right holder":K+A}, DD:{"document number":d1,D2:d2,Dn:dn}, DS:{"right holder":s}}).

[0090] Among them, the method in which the prover control subsystem is used to verify the summary information based on the user information and specific information can be: the prover control subsystem encrypts the specific information according to the right holder's public key to obtain reference information; generates target information according to the reference information and user information containing at least the right holder's information; calculates the second reference summary information di" according to the target information. If the second reference summary information di" is consistent with the summary information di sent by the data processing subsystem 210, the verification is determined to be successful, and then the summary information di is encrypted according to the prover private key corresponding to the prover public key to obtain the second digital signature s2 and send the second digital signature s2 to the data processing subsystem 220; if the second reference summary information di" is inconsistent with the summary information di sent by the data processing subsystem 210, the verification is determined to have failed.

[0091] As an optional implementation, if there are multiple right holder control subsystems 220, the data processing subsystem 210 receives the first digital signature sent by the right holder control subsystem 220, including: the data processing subsystem 210 receives the first digital signatures sent by multiple right holder control subsystems 220, and obtains multiple first digital signatures; and the data processing subsystem 210 generates a privacy data block according to the first digital signature, user information and reference information, including: the data processing subsystem 210 generates a privacy data block according to the multiple first digital signatures, user information and reference information. This can provide a scenario that supports encryption of multiple right holder information and improve the versatility of the application.

[0092] Specifically, the data processing subsystem 210 generates a privacy data block based on multiple first digital signatures, user information and reference information. The data processing subsystem 210 sorts the multiple first digital signatures according to the priorities of multiple right holder control subsystems to obtain a sorting result; and generates a privacy data block based on the sorting result, user information and reference information.

[0093] As an optional implementation, the right holder control subsystem 220 is also used to decrypt the privacy data block according to the right holder's private key to obtain the plain text; the data processing subsystem 210 is also used to display the plain text with functional limitations; wherein the functional limitation is at least used to indicate that the copy function is disabled. This can ensure the security of the right holder's information to a certain extent. Among them, the functional limitation can also be used to indicate the disablement of functions such as screenshots, which is not limited in this application. In addition, the copy function is used to indicate the function of copying the plain text.

[0094] As an optional implementation, the user information also includes the prover information, wherein: the data processing subsystem 220 is also used to verify the private data block according to the right holder's public key in the right holder information; or, to verify the private data block according to the right holder's public key and the prover public key in the prover information.

[0095] The first aspect is optional. The data processing subsystem 220 verifies the privacy data block according to the right holder's public key in the right holder information as follows: the data processing subsystem 220 calculates the summary information di according to the user information DP and the reference information DD, and decodes the first digital signature s1 by the right holder's public key in the user information DP; if the decoding is successful, the summary information di1 corresponding to the first digital signature s1 is determined; if the decoding is unsuccessful, the right holder's public key is determined to be invalid; the summary information di1 is compared with the summary information di; if the summary information di1 is consistent with the summary information di, the right holder's public key and the first digital signature s1 are determined to be valid, and then the privacy data block OPIB is determined to be valid; if the summary information di1 is inconsistent with the summary information di, the right holder's public key is determined to be valid and the first digital signature s1 is valid, and then the privacy data block OPIB is determined to be invalid.

[0096] The second aspect is optional. The data processing subsystem 220 verifies the privacy data block according to the right holder's public key and the prover's public key in the prover information in a manner as follows: the data processing subsystem 220 calculates the summary information di according to the user information DP and the reference information DD, and decodes the first digital signature s1 through the right holder's public key in the user information DP; if the decoding is successful, the summary information di1 corresponding to the first digital signature s1 is determined; if the decoding is unsuccessful, the right holder's public key is determined to be invalid; the summary information di1 is compared with the summary information di; if the summary information di1 is inconsistent with the summary information di, the right holder's public key is determined to be valid and the first digital signature s1 is valid, and then the privacy data block OPIB is determined to be invalid; if the summary information di1 is inconsistent with the summary information di, If the summary information di is consistent, it is determined that the user information DP and the reference information DD have not been tampered with and the reference information DD is authentic and valid, and the second digital signature s2 is decoded by the prover public key in the user information DP; if the decoding is successful, the summary information di2 corresponding to the second digital signature s2 is determined; if the decoding is unsuccessful, it is determined that the prover public key is invalid; the summary information di2 is compared with the summary information di; if the summary information di2 is inconsistent with the summary information di, it is determined that the prover public key is valid and the second digital signature s2 is valid, and then the privacy data block OPIB is invalid; if the summary information di2 is consistent with the summary information di, it is determined that the prover public key and the second digital signature s2 are valid, and then the privacy data block OPIB is valid.

[0097] For details on the above disclosure of the data processing subsystem 210, please refer to Figure 3 , Figure 3 The structure block diagram of the data processing subsystem according to an embodiment of the present application is schematically shown. Figure 3 As shown, the data processing subsystem 300 may include: a data construction module 310, a data verification module 320, and an information restoration module 330; wherein the data construction module 310 may include a participant module 311, an information collection and editing module 312, and a signature management module 313.

[0098] Among them, the participant module 311 is used to obtain the right holder information and / or the prover information; determine the participants (i.e., at least one right holder and / or at least one prover); determine the order of the participants; and verify the matching between the participant's identity address and the public key (for example, verify the matching between the prover's identity address and the prover's public key, or verify the matching between the right holder's identity address and the right holder's public key).

[0099] Among them, the information collection and editing module 312 is used to determine at least one target field D and at least one field information d' corresponding to the target field; generate specific information OIB that meets the preset format according to the target field D and the field information d'; encrypt the specific information OIB according to the right holder's public key to obtain reference information DD; generate data P1 according to at least one of the right holder's identity address and the right holder's public key, and generate user information DP according to the data P1; or, generate data P1 according to the right holder's identity address and the right holder's public key, and generate data P2 according to the prover's identity address and the prover's public key, and then generate user information DP according to the data P1 and the data P2.

[0100] Furthermore, the information collection and editing module 312 is also used to generate target information m based on the reference information DD and the user information DP containing at least the right holder information; calculate the summary information di based on the target information m, and send the user information DP, the specific information OIB and the summary information di to the right holder control subsystem; if the structured information encryption system also includes a certifier control subsystem, then the user information DP, the specific information OIB and the summary information di are sent to the certifier control subsystem.

[0101] Among them, the right holder control subsystem is used to encrypt specific information according to the right holder's public key to obtain reference information; generate target information according to the reference information and user information containing at least the right holder's information; calculate the first reference summary information di' according to the target information, if the first reference summary information di' is consistent with the summary information di sent by the data processing subsystem 210, then the verification is determined to be successful, and then the summary information di is encrypted according to the right holder's private key corresponding to the right holder's public key to obtain the first digital signature s1 and send the first digital signature s1 to the data processing subsystem; if the first reference summary information di' is inconsistent with the summary information di sent by the data processing subsystem, then the verification is determined to have failed.

[0102] Among them, the prover control subsystem is used to encrypt specific information according to the right holder's public key to obtain reference information; generate target information according to the reference information and user information containing at least the right holder's information; calculate the second reference summary information di" according to the target information. If the second reference summary information di" is consistent with the summary information di sent by the data processing subsystem 210, the verification is determined to be successful, and then the summary information di is encrypted according to the prover's private key corresponding to the prover's public key to obtain the second digital signature s2 and send the second digital signature s2 to the data processing subsystem; if the second reference summary information di" is inconsistent with the summary information di sent by the data processing subsystem, the verification is determined to have failed.

[0103] Furthermore, when only the right holder exists, the data construction module 310 is also used to receive the first digital signature s1 sent by the right holder control subsystem; construct the data block DS according to the first digital signature s1; and generate the privacy data block OPIB according to the data block DS, the user information DP and the reference information DD. When the right holder and the prover exist, the data construction module 310 is also used to receive the first digital signature s1 sent by the right holder control subsystem and the second digital signature s2 sent by the prover control subsystem; construct the data block DS according to the first digital signature s1 and the second digital signature s2; and generate the privacy data block OPIB according to the data block DS, the user information DP and the reference information DD.

[0104] Among them, the signature management module 313 is used to send user information DP, specific information OIB and summary information di to the participant's system (i.e., at least one rights holder system and / or at least one certifier system); and receive the digital signature returned by the participant's system (e.g., the first digital signature s1 and / or the second digital signature s2).

[0105] When only the right holder exists, the signature management module 313 is also used to calculate the summary information di based on the user information DP and the reference information DD, and decode the first digital signature s1 through the right holder's public key in the user information DP; if the decoding is successful, the summary information di1 corresponding to the first digital signature s1 is determined; if the decoding is unsuccessful, the right holder's public key is determined to be invalid; the summary information di1 is compared with the summary information di; if the summary information di1 is consistent with the summary information di, the right holder's public key and the first digital signature s1 are determined to be valid, and then the privacy data block OPIB is determined to be valid; if the summary information di1 is inconsistent with the summary information di, the right holder's public key is determined to be valid and the first digital signature s1 is valid, and then the privacy data block OPIB is determined to be invalid.

[0106] When there are rights holders and certifiers, the signature management module 313 is further used to calculate summary information di based on user information DP and reference information DD, and decode the first digital signature s1 through the rights holder's public key in the user information DP; if the decoding is successful, the summary information di1 corresponding to the first digital signature s1 is determined; if the decoding is unsuccessful, the rights holder's public key is determined to be invalid; the summary information di1 is compared with the summary information di; if the summary information di1 is inconsistent with the summary information di, the rights holder's public key is determined to be valid and the first digital signature s1 is valid, and then the privacy data block OPIB is determined to be invalid; if the summary information di1 is consistent with the summary information di, the user information DP and The reference information DD has not been tampered with and is authentic and valid, and the prover digital signature s2 is decoded by the prover public key in the user information DP; if the decoding is successful, the summary information di2 corresponding to the second digital signature s2 is determined; if the decoding is unsuccessful, the prover public key is determined to be invalid; the summary information di2 is compared with the summary information di; if the summary information di2 is inconsistent with the summary information di, the prover public key is determined to be valid and the second digital signature s2 is valid, and then the privacy data block OPIB is determined to be invalid; if the summary information di2 is consistent with the summary information di, the prover public key and the second digital signature s2 are determined to be valid, and then the privacy data block OPIB is determined to be valid.

[0107] Among them, the data verification module 320 is used to query data, parse data, display data, etc., which is not limited in the embodiment of the present application; verify the validity of the signature, the validity of the public key, and the consistency of the signature.

[0108] Among them, the information restoration module 330 is used to receive user query restoration requests, send the rights holder list to the rights holder to request private key decryption; when all rights holder systems return instructions to indicate consent to display, the plain text of specific information is displayed.

[0109] Implementation Figure 3 The system shown can improve the security and privacy of data, prevent user data from being leaked or tampered with, and thus help improve the security and privacy of data transmission. In addition, the participation of the right holder in the data encryption process can be improved by encrypting the original data multiple times, that is, the interactivity is improved, which can further improve the authenticity of the data and prevent the data from being stolen or tampered with.

[0110] See also Figure 4 , Figure 4 The structure block diagram of the right holder control subsystem according to an embodiment of the present application is schematically shown. Figure 4 As shown, the rights holder control subsystem 400 may include: a key management module 410 , a privacy data management module 420 , a privacy signature management module 430 , and a privacy restoration module 440 .

[0111] The key management module 410 is at least used to store the public key and the private key of the right holder.

[0112] The privacy data management module 420 is used to receive user information, specific information and summary information sent by the data processing subsystem.

[0113] The privacy signature management module 430 is used to encrypt the summary information according to the right holder's private key corresponding to the right holder's public key to obtain a first digital signature when the verification is successful.

[0114] The privacy restoration module 440 is used to receive a query restoration request. On the one hand, it can decrypt the privacy data block by the right holder's private key to obtain the plain text and return the plain text to the requesting party; on the other hand, it can return a message indicating the refusal of decryption.

[0115] Implementation Figure 4 The system shown can improve the security and privacy of data, prevent user data from being leaked or tampered with, and replace plaintext information with private data blocks, so that the right holder can retain the ultimate control of private information, thereby improving the security and privacy of data transmission. In addition, the right holder's participation in the data encryption process can be improved by encrypting the original data multiple times, that is, the interactivity is improved, which can further improve the authenticity of the data and prevent the data from being stolen or tampered with.

[0116] In addition, on the one hand, the structured information encryption system can encrypt unique information, see Figure 5 , Figure 5 The following is a schematic diagram showing the input and output of a structured information encryption system according to an embodiment of the present application. Figure 5 As shown, the input of the structured information encryption system 520 can be specific information ("name": "Zhang San") 510, and the privacy data block 530 can be obtained through encryption of the structured information encryption system 520; wherein, the privacy data block 530 can include user information (such as the public key of the right holder, the identity address of the right holder, etc., which is not limited in the embodiment of the present application), metadata name and name privacy data block, and digital signature.

[0117] The specific implementation is as follows: the data processing subsystem determines the target field D "name" and the field information d' "Zhang San" corresponding to the target field; generates specific information OIB910 that meets the preset format based on the target field D and the field information d'; encrypts the field information d' "Zhang San" in the specific information OIB based on the public key of the right holder, and obtains the reference information DD containing the target field D "certificate" and the certificate seal corresponding to the target field; generates user information DP, the user information DP contains the right holder information including the right holder's identity address and the right holder's public key, and the prover information including the prover's identity address and the prover's public key; generates target information m based on the reference information DD and the user information DP; calculates the summary information di based on the target information m, and sends the user information DP, the specific information OIB and the summary information di to the right holder control subsystem and the prover control subsystem.

[0118] The right holder control subsystem encrypts specific information according to the right holder public key to obtain reference information; generates target information according to the reference information and user information containing at least the right holder information; calculates first reference summary information di' according to the target information. If the first reference summary information di' is consistent with the summary information di sent by the data processing subsystem 210, the verification is determined to be successful, and then the summary information di is encrypted according to the right holder private key corresponding to the right holder public key to obtain a first digital signature s1 and send the first digital signature s1 to the data processing subsystem.

[0119] The prover control subsystem encrypts specific information according to the prover public key to obtain reference information; generates target information according to the reference information and user information containing at least the prover information; calculates second reference summary information di" according to the target information, and if the first reference summary information di" is consistent with the summary information di sent by the data processing subsystem 210, the verification is determined to be successful, and then the summary information di is encrypted according to the prover private key corresponding to the prover public key to obtain the second digital signature s2 and send the first digital signature s2 to the data processing subsystem.

[0120] The data processing subsystem can then construct a data block DS according to the first digital signature s1; and generate a privacy data block OPIB according to the data block DS, the user information DP and the reference information DD.

[0121] On the other hand, structured information encryption systems can also encrypt multiple messages, see Figure 6 , Figure 6 The following is a schematic diagram showing the input and output of a structured information encryption system according to an embodiment of the present application. Figure 6As shown, the input of the structured information encryption system 620 can be specific information ("name": "Zhang San", "birthday": "YYYY - MMMM - DD", "sex": "male", "mobile": "189XXXX1234", "address": {"country": "aa", "province": "bb", "city": "cc"

[0122] "district": "dd District", "street": "ee Road") 610. Through the encryption of the structured information encryption system 620, the privacy data block 630 can be obtained. Among them, the privacy data block 630 can include user information (such as the public key of the right holder, the identity address of the right holder, etc., which are not limited in the embodiments of the present application), metadata name and name privacy data block, metadata birthday and birthday privacy data block, metadata gender and gender privacy data block, metadata phone and phone privacy data block, metadata address and address privacy data block, digital signature. In addition, the encryption method of the structured information encryption system can refer to Figures 2 to 4 the steps executed by the system shown. Details are not described herein again. It should be noted that the address can include country, province, city, district, etc. The address privacy data block can be partial encryption of the address plaintext (for example, only encrypt the province) or full encryption, which is not limited in the embodiments of the present application.

[0123] Please refer to Figure 7 , Figure 7 which schematically shows a sequence diagram of the interaction between the data processing subsystem and the right holder control subsystem according to an embodiment of the present application. As Figure 7 shown, this sequence diagram can include: step S700 to step S760.

[0124] Step S700: The data processing subsystem determines the privacy data block to be decrypted corresponding to the target right holder.

[0125] Step S710: The data processing subsystem sends the privacy data block to be decrypted to the right holder control subsystem.

[0126] Step S720: The right holder control subsystem receives the privacy data block.

[0127] Step S730: The right holder control subsystem detects the user instruction for the privacy data block.

[0128] Step S740: If the user instruction is used to indicate decrypting the privacy data block, the right holder control subsystem decrypts the privacy data block according to the private key of the right holder to obtain the plaintext.

[0129] Step S750: The right holder control subsystem sends the plaintext to the data processing subsystem.

[0130] Step S760: The data processing subsystem receives the plain text and displays the plain text.

[0131] Step S770: If the user indicates not to decrypt the private data block, the rights holder control subsystem returns a message indicating refusal to restore.

[0132] Implementation Figure 7 The method shown can improve the security and privacy of data, prevent user data from being leaked or tampered with, and thus help improve the security and privacy of data transmission. In addition, the participation of the right holder in the data encryption process can be improved by encrypting the original data multiple times, that is, the interactivity is improved, and the authenticity of the data can be further improved to prevent the data from being stolen or tampered with. In addition, the security of the data can be improved by further data verification by the prover system. In addition, holding a private key for signing and information restoration can increase the participation of the right holder in the digitization process and improve interactivity. In addition, compared with the traditional irreversible desensitization method, the desensitized data of the present invention can restore the real information, making the data and information conversion reversible.

[0133] See also Figure 8 , Figure 8 The structure block diagram of the structured information encryption system according to an embodiment of the present application is schematically shown. Figure 8 As shown, the structured information encryption system 800 may include: a data processing subsystem 820, a rights holder control subsystem 830, and a certifier control subsystem 810, and the user information also includes certifier information.

[0134] exist Figure 2 On the basis of the structured information encryption system shown, the data processing subsystem 820 is also used to send the user information, the specific information and the summary information to the prover control subsystem 810 when it is detected that the data verification method is a two-person verification method;

[0135] The prover control subsystem 810 is used to verify the summary information according to the user information and the specific information; if the verification is successful, the summary information is encrypted according to the prover private key to obtain a second digital signature and the second digital signature is sent to the data processing subsystem 820;

[0136] And, the data processing subsystem 820 generates a private data block according to the first digital signature, the user information and the reference information, including:

[0137] The data processing subsystem 820 generates a private data block according to the first digital signature, the second digital signature, the user information and the reference information.

[0138] Implementation Figure 8The system shown can improve the security and privacy of data, prevent user data from being leaked or tampered with, and thus help improve the security and privacy of data transmission. In addition, the participation of the right holder in the data encryption process can be improved by encrypting the original data multiple times, that is, the interactivity is improved, which can further improve the authenticity of the data and prevent the data from being stolen or tampered with. In addition, the security of the data can be improved through further data verification by the prover system.

[0139] As an optional implementation, the prover control subsystem 810 verifies the summary information according to the user information and the specific information, including: the prover control subsystem 810 parses the target information to obtain the user information and the reference information, and calculates the second reference summary according to the user information and the reference information; the prover control subsystem 810 decodes the second digital signature according to the prover public key to obtain the summary information; if the decoding is unsuccessful, the second digital signature is determined to be invalid and the verification fails; if the decoding is successful but the second reference summary and the decoded summary information are inconsistent, the specific information is determined to be invalid and the verification fails; if the decoding is successful and the second reference summary and the summary information are consistent, the specific information is determined to be valid and the verification is successful. This can support a third party to notarize the information, prevent the right holder from providing false information to deliberately deceive, and effectively support the real-name authentication scenario in reality.

[0140] As an optional implementation, the prover control subsystem 810 is also used to decrypt the private data block according to the prover's private key to obtain the plaintext in the reference information; the right holder control subsystem 830 is also used to decrypt the private data block according to the right holder's private key to obtain the plaintext in the reference information; the data processing subsystem 820 is also used to display the plaintext with functional limitations; wherein the functional limitation is at least used to indicate that the copy function is disabled. This can protect the security of the plaintext to a certain extent and prevent the plaintext from being maliciously spread.

[0141] See also Fig. 9 , Fig. 9 The following schematically shows a schematic diagram of an information encryption process according to an embodiment of the present application. Fig. 9 As shown, the application Figure 8 The system shown can encrypt plaintext information to obtain corresponding private data blocks.

[0142] The specific implementation is as follows: the data processing subsystem determines the target field D "certificate" and the field information d' "certificate number" corresponding to the target field; generates specific information OIB910 that meets the preset format based on the target field D and the field information d'; encrypts the field information d' "certificate number" in the specific information OIB based on the public key of the right holder, and obtains the reference information DD containing the target field D "certificate" and the certificate seal corresponding to the target field; generates user information DP, the user information DP contains the right holder's identity address and the right holder's public key, and the prover information contains the prover's identity address and the prover's public key; generates target information m based on the reference information DD and the user information DP; calculates the summary information di based on the target information m, and sends the user information DP, the specific information OIB and the summary information di to the right holder control subsystem and the prover control subsystem.

[0143] The right holder control subsystem encrypts specific information according to the right holder public key to obtain reference information; generates target information according to the reference information and user information containing at least the right holder information; calculates first reference summary information di' according to the target information. If the first reference summary information di' is consistent with the summary information di sent by the data processing subsystem 210, the verification is determined to be successful, and then the summary information di is encrypted according to the right holder private key corresponding to the right holder public key to obtain a first digital signature s1 and send the first digital signature s1 to the data processing subsystem.

[0144] The prover control subsystem encrypts specific information according to the prover public key to obtain reference information; generates target information according to the reference information and user information containing at least the prover information; calculates second reference summary information di" according to the target information, and if the first reference summary information di" is consistent with the summary information di sent by the data processing subsystem 210, the verification is determined to be successful, and then the summary information di is encrypted according to the prover private key corresponding to the prover public key to obtain the second digital signature s2 and send the first digital signature s2 to the data processing subsystem.

[0145] The data processing subsystem can then construct a data block DS according to the first digital signature s1; and generate a privacy data block OPIB according to the data block DS, the user information DP and the reference information DD.

[0146] See also Fig.10 , Fig.10 The following schematically shows a sequence diagram of the interaction between the data processing subsystem, the rights holder control subsystem, and the certifier control subsystem according to an embodiment of the present application. Fig.10 As shown, the sequence diagram may include: step S1000 to step S1022.

[0147] Step S1000: The data processing subsystem determines at least one target field and collects field information corresponding to the at least one target field, and generates specific information according to the at least one target field and the field information corresponding to the at least one target field.

[0148] Step S1002: The data processing subsystem encrypts specific information according to the public key of the right holder to obtain reference information.

[0149] Step S1004: The data processing subsystem generates target information based on reference information and user information; wherein the user information includes right holder information and certifier information.

[0150] Step S1006: The data processing subsystem calculates summary information according to the target information.

[0151] Step S1008: When it is detected that the data verification mode is a single-person verification mode, the data processing subsystem sends the user information, specific information and summary information to the right holder control subsystem.

[0152] Step S1010: the right holder control subsystem verifies the summary information according to the user information and the specific information; if the verification is successful, the summary information is encrypted according to the right holder's private key corresponding to the right holder's public key to obtain a first digital signature.

[0153] Step S1012: The right holder control subsystem sends a first digital signature to the data processing subsystem.

[0154] Step S1014: the data processing subsystem generates a private data block according to the first digital signature, user information and reference information.

[0155] Step S1016: When it is detected that the data verification method is a two-person verification method, the data processing subsystem sends user information, specific information and summary information to the certifier control subsystem.

[0156] Step S1018: The prover control subsystem verifies the summary information based on the user information and the specific information; if the verification is successful, the summary information is encrypted according to the prover private key to obtain a second digital signature.

[0157] Step S1020: The prover system sends a second digital signature to the data processing subsystem.

[0158] Step S1022: The data processing subsystem generates a private data block according to the first digital signature, the second digital signature, the user information and the reference information.

[0159] It should be noted that the specific implementation of steps S1000 to S1022 has been disclosed in the aforementioned embodiments and will not be repeated here.

[0160] Implementation Fig.10 The method shown can improve the security and privacy of data, prevent user data from being leaked or tampered with, and thus help improve the security and privacy of data transmission. In addition, the participation of the right holder in the data encryption process can be improved by encrypting the original data multiple times, that is, the interactivity is improved, which can further improve the authenticity of the data and prevent the data from being stolen or tampered with. In addition, the security of the data can be improved through further data verification by the prover system.

[0161] See also Fig.11 , Fig.11 The flowchart of the structured information encryption method according to an embodiment of the present application is schematically shown. Fig.11 As shown, the structured information encryption method may include: steps S1110 to S1140.

[0162] Step S1110: Encrypt specific information according to the public key of the right holder to obtain reference information.

[0163] Step S1120: Generate target information based on the reference information and the user information including at least the right holder information.

[0164] Step S1130: Calculate summary information based on target information, and send user information, specific information and summary information to the rights holder control subsystem; wherein the rights holder control subsystem is used to verify the summary information based on the user information and specific information. If the verification is successful, encrypt the summary information based on the rights holder's private key to obtain a first digital signature.

[0165] Step S1140: Receive the first digital signature sent by the right holder control subsystem, and generate a privacy data block according to the first digital signature, user information and reference information.

[0166] It should be noted that the specific implementation of steps S1110 to S1140 has been disclosed in the aforementioned embodiments and will not be repeated here.

[0167] Implementation Fig.11 The method shown can improve the security and privacy of data, prevent user data from being leaked or tampered with, and thus help improve the security and privacy of data transmission. In addition, the participation of the right holder in the data encryption process can be improved by encrypting the original data multiple times, that is, the interactivity is improved, which can further improve the authenticity of the data and prevent the data from being stolen or tampered with.

[0168] See also Fig.12 , Fig.12 The following schematically shows a structural block diagram of a structured information encryption device according to an embodiment of the present application. Fig.12As shown, the structured information encryption device 1200 may include: an information encryption unit 1210, an information generation unit 1220 and an information sending unit 1230, wherein:

[0169] The information encryption unit 1210 is used to encrypt specific information according to the public key of the right holder to obtain reference information;

[0170] An information generating unit 1220, configured to generate target information according to the reference information and the user information including at least the right holder information;

[0171] The information sending unit 1230 is used to calculate summary information according to the target information, and send the user information, the specific information and the summary information to the right holder control subsystem; wherein the right holder control subsystem is used to verify the summary information according to the user information and the specific information, and if the verification is successful, encrypt the summary information according to the right holder private key to obtain a first digital signature;

[0172] The information generation unit 1230 is further used to receive the first digital signature sent by the right holder control subsystem, and generate a privacy data block according to the first digital signature, user information and reference information.

[0173] Implementation Fig.12 The device shown can improve the security and privacy of data, prevent user data from being leaked or tampered with, and thus help improve the security and privacy of data transmission. In addition, the participation of the right holder in the data encryption process can be improved by encrypting the original data multiple times, that is, the interactivity is improved, which can further improve the authenticity of the data and prevent the data from being stolen or tampered with.

[0174] It should be noted that, although several modules or units of the equipment for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.

[0175] Since the various functional modules of the structured information encryption device of the example embodiment of the present application correspond to the steps of the example embodiment of the structured information encryption system described above, for details not disclosed in the embodiment of the device of the present application, please refer to the embodiment of the structured information encryption system described above in the present application.

[0176] As another aspect, the present application also provides a computer-readable medium, which may be included in the electronic device described in the above embodiment; or may exist independently without being assembled into the electronic device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by an electronic device, the electronic device implements the method described in the above embodiment.

[0177] It should be noted that the computer-readable medium shown in the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0178] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the above-mentioned module, program segment or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0179] The units involved in the embodiments described in this application may be implemented by software or hardware, and the units described may also be set in a processor. The names of these units do not, in some cases, constitute limitations on the units themselves.

[0180] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary technical means in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0181] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A structured information encryption system, characterized in that: The structured information encryption system at least includes a rights holder control subsystem and a data processing subsystem, wherein: The data processing subsystem is used to determine at least one target field and collect field information corresponding to the at least one target field, and generate specific information according to the at least one target field and the field information corresponding to the at least one target field; The data processing subsystem is further used to encrypt the specific information according to the public key of the right holder to obtain reference information; The data processing subsystem is further used to generate target information based on the reference information and user information including at least right holder information; The data processing subsystem is further used to calculate summary information according to the target information, and send the user information, the specific information and the summary information to the right holder control subsystem; The right holder control subsystem is used to verify the summary information according to the user information and the specific information; if the verification is successful, the summary information is encrypted according to the right holder's private key corresponding to the right holder's public key to obtain a first digital signature and send the first digital signature to the data processing subsystem; The data processing subsystem is further used to generate a privacy data block according to the first digital signature, the user information and the reference information.

2. The system according to claim 1, characterized in that The data processing subsystem generates a privacy data block according to the first digital signature, the user information and the reference information, including: When the data processing subsystem detects that the data verification method is a single-person verification method, the data processing subsystem generates a privacy data block according to the first digital signature, the user information and the reference information.

3. The system according to claim 1, characterized in that The user information also includes the witness information, including: The data processing subsystem is further used to verify the private data block according to the right holder public key in the right holder information; or, to verify the private data block according to the right holder public key and the prover public key in the prover information.

4. The system according to claim 1, characterized in that The structured information encryption system further includes a prover control subsystem, and the user information further includes prover information, wherein: The data processing subsystem is further configured to send the user information, the specific information and the summary information to the certifier control subsystem when detecting that the data verification mode is a two-person verification mode; The prover control subsystem is used to verify the summary information according to the user information and the specific information; if the verification is successful, the summary information is encrypted according to the prover private key to obtain a second digital signature and the second digital signature is sent to the data processing subsystem; And, the data processing subsystem generates a privacy data block according to the first digital signature, the user information and the reference information, including: The data processing subsystem generates a private data block according to the first digital signature, the second digital signature, the user information and the reference information.

5. The system according to claim 1, characterized in that in: The right holder control subsystem is further used to decrypt the privacy data block according to the right holder's private key to obtain plain text; The data processing subsystem is further used to display the plain text with functional limitations; wherein the functional limitations are at least used to indicate that the copy function is disabled.

6. The system according to claim 1, characterized in that The right holder public key includes a first right holder public key and a second right holder public key. The data processing subsystem encrypts specific information according to the right holder public key to obtain reference information, including: The data processing subsystem encrypts the specific information according to the public key of the first right holder to obtain intermediate information; The data processing subsystem encrypts the intermediate information according to the public key of the second right holder to obtain the reference information.

7. The system according to claim 1, characterized in that If there are multiple right holder control subsystems, the data processing subsystem receives the first digital signature sent by the right holder control subsystem, including: The data processing subsystem receives the first digital signatures sent by the plurality of right holder control subsystems to obtain a plurality of first digital signatures; And, the data processing subsystem generates a privacy data block according to the first digital signature, the user information and the reference information, including: The data processing subsystem generates a private data block according to the multiple first digital signatures, the user information and the reference information.

8. A structured information encryption method, characterized in that: include: Determine at least one target field and collect field information corresponding to the at least one target field, and generate specific information according to the at least one target field and the field information corresponding to the at least one target field; Encrypt the specific information according to the public key of the right holder to obtain reference information; generating target information according to the reference information and user information including at least right holder information; Calculate summary information according to the target information, and send the user information, the specific information and the summary information to the right holder control subsystem; wherein the right holder control subsystem is used to verify the summary information according to the user information and the specific information, and if the verification is successful, encrypt the summary information according to the right holder private key to obtain a first digital signature; Receive the first digital signature sent by the right holder control subsystem, and generate a privacy data block according to the first digital signature, the user information and the reference information.

9. A structured information encryption device, characterized in that: include: An information encryption unit, used to determine at least one target field and collect field information corresponding to the at least one target field, and generate specific information according to the at least one target field and the field information corresponding to the at least one target field; the information encryption unit is also used to encrypt the specific information according to the public key of the right holder to obtain reference information; An information generating unit, configured to generate target information according to the reference information and user information including at least information of the right holder; an information sending unit, configured to calculate summary information according to the target information, and send the user information, the specific information and the summary information to the right holder control subsystem; wherein the right holder control subsystem is configured to verify the summary information according to the user information and the specific information, and if the verification is successful, encrypt the summary information according to the right holder private key to obtain a first digital signature; The information generation unit is further used to receive the first digital signature sent by the right holder control subsystem, and generate a privacy data block according to the first digital signature, the user information and the reference information.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps performed by the system according to any one of claims 1 to 7 are implemented.

11. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; The processor is configured to execute the steps performed by the system of any one of claims 1 to 7 by executing the executable instructions.

Images