A remote data backup encryption method, system, device and storage medium

Abstract

The present invention discloses a remote data backup encryption method, system, device and storage medium. The remote data backup encryption method comprises: obtaining identity information; decomposing a first key into three shares by a first polynomial and destroying the first key; encrypting the identity information by a second key to generate first data; converting the first data into a decimal system to obtain second data; calculating the second data by a second polynomial to obtain third data. The present invention avoids the first key from being attacked and then leaked during the remote data transmission process by decomposing the first key for encrypting the backup data into three shares corresponding to the identity information and destroying the first key; by encrypting and processing the identity information, the identity information needs to be obtained before the decryption of the backup data, and then the first key is calculated by the identity information and the shares, thereby improving the security of the backup data during remote transmission. The present invention can be widely used in the field of computer technology.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a remote data backup encryption method, system, device and storage medium. Background Art

[0002] Remote data backup technology facilitates the data storage of users, but during the data transmission process of remote data backup, sensitive data is easily intercepted and attacked, resulting in data leakage. In order to solve this problem, sensitive data needs to be encrypted before being uploaded to remote storage. Therefore, it is very important to protect the encryption key of sensitive data. However, traditional data backup solutions have obvious security weaknesses and cannot resist offline password guessing attacks, server impersonation attacks, user impersonation attacks, and attackers updating passwords / biometric attacks. Traditional data backup solutions use symmetric encryption to encrypt backup data. The advantage of symmetric encryption is that the encryption speed is fast, but if the key exchange is not secure, the security of the key will be lost. Especially in the e-commerce environment, when the customer is an unknown and untrusted entity, how to enable the customer to safely obtain the encryption key of the backup data has become a major problem. Summary of the invention

[0003] The purpose of the present invention is to solve one of the technical problems existing in the prior art to at least a certain extent.

[0004] To this end, an object of an embodiment of the present invention is to provide a remote data backup encryption method, which effectively avoids offline key guessing attacks by dividing the key for encrypting backup data into three shares and performing double encryption.

[0005] Another object of an embodiment of the present invention is to provide a remote data backup encryption system.

[0006] In order to achieve the above technical objectives, the technical solutions adopted by the embodiments of the present invention include:

[0007] In a first aspect, an embodiment of the present invention provides a remote data backup encryption method, comprising the following steps:

[0008] Acquire identity information, wherein the identity information includes parameter information of the smart card, parameter information of the user terminal, and parameter information of the server;

[0009] Decomposing a first key into three shares corresponding to the identity information by using a first polynomial, and destroying the first key, where the first key is a key for encrypting backup data;

[0010] Encrypting the identity information by using a second key to generate first data;

[0011] Convert the first data into decimal to obtain second data;

[0012] The second data is calculated by using a second polynomial to obtain third data, wherein the second polynomial includes the second key.

[0013] A remote data backup encryption method according to an embodiment of the present invention effectively prevents the first key from being attacked and leaked during remote data transmission by decomposing the first key of the encrypted backup data into three shares corresponding to three identity information and destroying the first key; by encrypting and processing the identity information, the identity information needs to be obtained before decrypting the backup data, and then the first key is calculated based on the identity information and the shares, thereby realizing double encryption of the backup data and improving the security of the backup data during remote transmission.

[0014] In addition, the remote data backup encryption method according to the above embodiment of the present invention may also have the following additional technical features:

[0015] Furthermore, in a remote data backup encryption method according to an embodiment of the present invention, decomposing the first key into three shares corresponding to the identity information by using a first polynomial and destroying the first key includes:

[0016] Generate a first random number, where the first random number is the slope of the first polynomial;

[0017] According to the first polynomial and the identity information, the first key is decomposed into three shares corresponding to the smart card, the user terminal and the server respectively, and the first key is destroyed.

[0018] Furthermore, in one embodiment of the present invention, encrypting the identity information by using the second key to generate the first data further includes:

[0019] Obtain the second key and the third key, where the second key is a public key and the third key is a private key corresponding to the second key;

[0020] The third key is stored on an offline device.

[0021] Further, in one embodiment of the present invention, calculating the second data by using a second polynomial to obtain third data includes:

[0022] Generate a second random number, where the second random number is the slope of the second polynomial;

[0023] The second data is calculated by using the second polynomial according to the second random number and the second key to obtain the third data.

[0024] Furthermore, a remote data backup encryption method in an embodiment of the present invention further includes the following steps:

[0025] Obtain the user's password and biometrics;

[0026] Authentication information is generated according to the third data, the password and the biometric feature, and the authentication information is used for identity authentication between the smart card, the user terminal and the server before decryption.

[0027] Furthermore, a remote data backup encryption method in an embodiment of the present invention further includes the following steps:

[0028] Determine whether the backup data is attacked, and if so, remind the user to update the password and the biometric feature.

[0029] Furthermore, in one embodiment of the present invention, the determining whether the backup data is attacked includes:

[0030] Obtaining a value of a counter, wherein the initial value of the counter is zero, and the counter is used to increase by one when decryption of the backup data fails;

[0031] determining whether the value of the counter is greater than six, and if so, determining that the backup data is under attack;

[0032] If not, it is determined whether the second key is used to decrypt the backup data. If so, it is determined that the backup data is attacked.

[0033] In a second aspect, an embodiment of the present invention provides a remote data backup encryption system, including:

[0034] An identity information acquisition module, used to acquire identity information;

[0035] a first key processing module, configured to decompose the first key into three shares corresponding to the identity information by using a first polynomial, and destroy the first key;

[0036] A first data generating module, used to encrypt the identity information by using a second key to generate first data;

[0037] A second data conversion module, used for converting the first data into a decimal system to obtain second data;

[0038] The third data calculation module is used to calculate the second data by using a second polynomial to obtain third data.

[0039] In a third aspect, an embodiment of the present invention provides a remote data backup encryption device, comprising:

[0040] at least one processor;

[0041] at least one memory for storing at least one program;

[0042] When the at least one program is executed by the at least one processor, the at least one processor implements the remote data backup encryption method.

[0043] In a fourth aspect, an embodiment of the present invention provides a storage medium, in which a program executable by a processor is stored. When the program executable by the processor is executed, it is used to implement the remote data backup encryption method.

[0044] The advantages and benefits of the present invention will be partially given in the following description, and partially become apparent from the following description, or be understood through the practice of the present application:

[0045] The embodiment of the present invention effectively prevents the first key from being attacked and leaked during remote data transmission by decomposing the first key for encrypting backup data into three shares corresponding to three identity information and destroying the first key; by encrypting and processing the identity information, the identity information needs to be obtained before decrypting the backup data, and then the first key is calculated based on the identity information and the shares, thereby realizing double encryption of the backup data and improving the security of the backup data during remote transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following introduction is made to the drawings of the embodiments of the present application or the related technical solutions in the prior art. It should be understood that the drawings introduced below are only for the convenience of clearly describing some embodiments of the technical solutions of the present application. For technical personnel in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0047] Figure 1 A flowchart of a specific embodiment of a remote data backup encryption method of the present invention;

[0048] Figure 2 A schematic diagram of a remote data backup encryption system according to a specific embodiment of the present invention;

[0049] Figure 3 It is a structural schematic diagram of a specific embodiment of a remote data backup encryption device of the present invention. DETAILED DESCRIPTION

[0050] Embodiments of the present invention are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and are not to be construed as limitations on the present application. For the step numbers in the following embodiments, they are only provided for the convenience of explanation, and the order between the steps is not limited in any way, and the execution order of each step in the embodiment can be adaptively adjusted according to the understanding of those skilled in the art.

[0051] The terms "first", "second", "third" and "fourth" etc. in the specification and claims of the present invention and the drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or devices.

[0052] Reference to "embodiments" in the present invention means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present invention. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0053] Remote data backup technology facilitates the data storage of users, but during the data transmission process of remote data backup, sensitive data is easily intercepted and attacked, resulting in data leakage. In order to solve this problem, sensitive data needs to be encrypted before being uploaded to remote storage. Therefore, it is very important to protect the encryption key of sensitive data. However, traditional data backup solutions have obvious security weaknesses and cannot resist offline password guessing attacks, server impersonation attacks, user impersonation attacks, and attackers updating passwords / biometric attacks. Traditional data backup solutions use symmetric encryption to encrypt backup data. The advantage of symmetric encryption is that the encryption speed is fast, but if the key exchange is not secure, the security of the key will be lost. Especially in the e-commerce environment, when the customer is an unknown and untrusted entity, how to enable the customer to safely obtain the encryption key of the backup data has become a major problem.

[0054] To this end, the present invention proposes a remote data backup encryption method and system, which effectively prevents the first key from being attacked and leaked during the remote data transmission process by decomposing the first key of the encrypted backup data into three shares corresponding to three identity information and destroying the first key; by encrypting and processing the identity information, the identity information needs to be obtained before decrypting the backup data, and then the first key is calculated based on the identity information and the shares, thereby realizing double encryption of the backup data and improving the security of the backup data during remote transmission.

[0055] A remote data backup encryption method and system according to an embodiment of the present invention will be described in detail below with reference to the accompanying drawings. First, a remote data backup encryption method according to an embodiment of the present invention will be described with reference to the accompanying drawings.

[0056] Reference Figure 1 In an embodiment of the present invention, a remote data backup encryption method is provided. A remote data backup encryption method in an embodiment of the present invention can be applied to a terminal, a server, or software running in a terminal or a server. The terminal can be a tablet computer, a laptop computer, a desktop computer, etc., but is not limited to this. The server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content distribution networks (CDNs), and big data and artificial intelligence platforms. A remote data backup encryption method in an embodiment of the present invention mainly includes the following steps:

[0057] S101, obtaining identity information;

[0058] The identity information includes the parameter information ID of the smart card. sc , the user's parameter information ID usr and the server parameter information ID ser ;

[0059] Specifically, the acquisition of the identity information facilitates the subsequent decomposition of the first key into three shares corresponding to the smart card, the user terminal and the server respectively, and the three shares are stored in the smart card, the user terminal and the server accordingly.

[0060] S102, decomposing the first key into three shares corresponding to the identity information using a first polynomial, and destroying the first key;

[0061] The first key is a key for encrypting backup data.

[0062] Specifically, the backup data is first encrypted with AES symmetric encryption using the first key K2, and then the parameter information ID of the smart card is encrypted according to the first polynomial f(x)=ax+K2 and the identity information. sc , the user's parameter information ID usr and the server parameter information ID se r is substituted into the first polynomial for calculation, and the first key is decomposed into three shares corresponding to the smart card, the user end and the server respectively by combining Shamir secret sharing. Among them, a is the first random number. The three shares are:

[0063] g sc =f(ID sc )=aID sc +K2

[0064] g usr =f(ID usr )=aID usr +K2

[0065] g ser =f(ID ser )=aID ser +K2

[0066] S102 can be further divided into the following steps S1021-S1022:

[0067] Step S1021, generating a first random number;

[0068] The first random number a is the slope of the first polynomial.

[0069] Specifically, the first random number a is generated by the server, which ensures the security of restoring the first key K2 through the first polynomial when decrypting the backup data.

[0070] Step S1022: Decompose the first key into three shares corresponding to the smart card, the user terminal and the server respectively according to the first polynomial and the identity information, and destroy the first key.

[0071] S103, encrypting the identity information by using a second key to generate first data;

[0072] Specifically, the parameter information ID of the smart card is encrypted by the second key K0. sc , the user's parameter information ID usr and the server parameter information ID ser Perform RSA asymmetric encryption to obtain C sc , C usr and C ser Three ciphertexts (first data), where the second key K0 is a public key.

[0073] In an embodiment of the present invention, step S103 further includes:

[0074] (1) Obtain the second key and the third key of RSA asymmetric encryption;

[0075] The second key K0 is a public key used to encrypt data, and the third key K1 is a private key corresponding to the second key K0 and is used to decrypt data encrypted by the second key K0.

[0076] (2) The third key is stored in an offline device.

[0077] Specifically, the third key K1 is stored in the offline device for acquisition and use during decryption.

[0078] S104, converting the first data into decimal to obtain second data;

[0079] Specifically, the C generated by RSA asymmetric encryption in step S103 sc , C usr and C ser The three ciphertexts (first data) are character data. By converting the first data into decimal data, we can get S sc , S usr and S ser (Second data) is used to facilitate the subsequent calculation of encrypted identity authentication information through a hash function.

[0080] S105. Calculate the second data using a second polynomial to obtain third data.

[0081] The second polynomial includes the second key.

[0082] Specifically, the second polynomial h(x)=bx+K0 is used, combined with the second key K0 to calculate S sc , S usr and S ser (Second data) is encrypted by RSA asymmetric encryption to obtain third data. The third data is:

[0083] A sc =h(S sc )=bS sc +K0

[0084] A usr =h(S usr )=bS usr +K0

[0085] A ser =h(S ser )=bS ser +K0

[0086] Wherein, b is the second random number.

[0087] The second data S is encrypted by RSA asymmetric encryption sc , S usr , S ser Encryption generates the third data A sc , A usr , A ser On the one hand, further encryption facilitates the calculation of authentication information between the smart card, the user terminal and the server; on the other hand, it is used to confuse attackers who want to intercept the backup data. If the attacker tries to use the second key K0 to restore the backup data, the server directly determines that the object performing the operation is the attacker.

[0088] S105 can be further divided into the following steps S1051-S1052:

[0089] Step S1051, generating a second random number;

[0090] The second random number b is the slope of the second polynomial.

[0091] Specifically, the second random number b is generated by the server, ensuring that step S1052 is performed by the second polynomial, the second key K0 and the third data A sc , A usr , A ser Calculate the second data S sc , S usr , S ser safety at the time.

[0092] Step S1052: Calculate the second data using the second polynomial according to the second random number and the second key to obtain the third data.

[0093] A remote data backup encryption method according to an embodiment of the present invention further includes the following steps:

[0094] (1) Obtain the user's password PW and biometric Bio;

[0095] Specifically, the password PW is a personal password set by the user, and the biometric feature Bio is determined by a biometric feature device that can be entered by the user terminal device.

[0096] (2) According to the third data A sc , A usr , A ser , the password PW and the biometric feature Bio generate identity authentication information, and the identity authentication information is used for identity authentication between the smart card, the user terminal and the server before decryption.

[0097] Specifically, the user's authentication information is calculated as follows:

[0098] V=h(A sc ||PW||A usr )

[0099] C=h(A sc ||PW||Bio||A usr )

[0100] m1=h( gusr , A usr , C)

[0101] The client sends m1 to the server for authentication before decryption.

[0102] Server Storage A usr and g ser , and calculate:

[0103] Y=h(A ser ||N||PW||A usr )

[0104]

[0105] m2=Z

[0106] N is the private parameter of the server. The server sends m2 to the client for identity authentication before decryption. The client stores g usr and Z.

[0107] The user terminal will (A sc , g sc , V, Z) is sent to the smart card for the user and server to authenticate the smart card before decryption.

[0108] The user will (g usr , Z) and (A sc , g sc , V, Z) are stored on another offline device to handle the device loss situation.

[0109] A remote data backup encryption method according to an embodiment of the present invention further includes the following steps:

[0110] Determine whether the backup data is attacked, and if so, remind the user to update the password and the biometric feature.

[0111] Specifically, whether the backup data is attacked is determined as follows:

[0112] (1) Get the value of the counter;

[0113] The initial value of the counter is zero, and the counter is used to increase by one when the decryption of the backup data fails.

[0114] Specifically, when a malicious attacker decrypts the backup data using a wrong key, the value of the counter increases by one bit.

[0115] (2) determining whether the value of the counter is greater than six, and if so, determining that the backup data is under attack;

[0116] Specifically, if the value of the counter is greater than six, it means that the attacker attempts to crack the first key K2 and obtain the backup data through a guessing attack, and reminds the user to update the password PW and the biometric feature Bio.

[0117] (3) If not, determine whether the second key is used to decrypt the backup data; if so, determine that the backup data is under attack.

[0118] Specifically, in combination with step S105, it can be known that the second key K0 is not a key for encrypting the backup data. The second key K0 is used to perform RSA asymmetric encryption on the identity information and perform AES symmetric encryption on the second data again to generate the third data A sc , A usr , A ser , confusing attackers who want to intercept the backup data. If the attacker attempts to use the second key K0 to restore the backup data, the server directly determines that the object performing the operation is the attacker, and reminds the user to update the password PW and biometric Bio.

[0119] When the first key K2 needs to be restored and the backup data is obtained by decrypting the data with the first key K2, the following operations are performed:

[0120] Through the third data A sc , A usr , A ser The second data S is calculated by using the second polynomial h(x)=bx+K0. sc , S usr , S ser , and the S in the second data sc , S ser C that is restored to character data sc and C ser ; Get the third key K1 from the offline device to C sc and C ser Decrypt and get the parameter information ID of the smart card sc and the server parameter information ID ser ; According to the parameter information ID of the smart card sc and the server parameter information ID ser The first key K2 is calculated by using the first polynomial f(x)=ax+K2 as follows:

[0121] K 2=(g sc ID ser ) / (ID ser -ID sc )-(g ser ID sc ) / (ID ser- ID sc )

[0122] Secondly, a remote data backup encryption system proposed according to an embodiment of the present application is described with reference to the accompanying drawings.

[0123] Figure 2 It is a schematic diagram of the structure of a remote data backup encryption system according to an embodiment of the present application.

[0124] The system specifically comprises:

[0125] An identity information acquisition module 201 is used to acquire identity information;

[0126] A first key processing module 202, configured to decompose the first key into three shares corresponding to the identity information using a first polynomial, and destroy the first key;

[0127] A first data generating module 203, configured to encrypt the identity information using a second key to generate first data;

[0128] A second data conversion module 204, configured to convert the first data into a decimal system to obtain second data;

[0129] The third data calculation module 205 is used to calculate the second data by using a second polynomial to obtain third data.

[0130] It can be seen that the contents of the above method embodiments are all applicable to the present system embodiments, the functions specifically implemented by the present system embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0131] Reference Figure 3 , the embodiment of the present application provides a remote data backup encryption device, comprising:

[0132] at least one processor 301;

[0133] At least one memory 302, used to store at least one program;

[0134] When the at least one program is executed by the at least one processor 301, the at least one processor 301 implements the remote data backup encryption method.

[0135] Similarly, the contents of the above method embodiments are all applicable to the present device embodiments. The functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0136] In some optional embodiments, the function / operation mentioned in the block diagram may not occur in the order mentioned in the operation diagram. For example, depending on the function / operation involved, the two boxes shown in succession can actually be executed substantially simultaneously or the boxes can sometimes be executed in reverse order. In addition, the embodiment presented and described in the flow chart of the application is provided by way of example, for the purpose of providing a more comprehensive understanding of technology. The disclosed method is not limited to the operation and logic flow presented herein. Optional embodiments are expected, wherein the order of various operations is changed and the sub-operation described as a part of a larger operation is performed independently.

[0137] In addition, although the present application is described in the context of functional modules, it should be understood that, unless otherwise specified, one or more of the functions and / or features can be integrated into a single physical device and / or software module, or one or more functions and / or features can be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the present application. More specifically, in view of the properties, functions, and internal relationships of the various functional modules in the device disclosed herein, the actual implementation of the module will be understood within the conventional techniques of the engineer. Therefore, those skilled in the art can implement the present application set forth in the claims without excessive experimentation using ordinary techniques. It is also understood that the specific concepts disclosed are merely illustrative and are not intended to limit the scope of the present application, which is determined by the full scope of the attached claims and their equivalents.

[0138] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several programs to enable a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0139] The logic and / or steps represented in the flowchart or otherwise described herein, for example, may be considered as an ordered list of executable programs for implementing the logical functions, and may be embodied in any computer-readable medium for use by a program execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch and execute a program from a program execution system, device or apparatus), or in conjunction with such program execution systems, devices or apparatuses. For purposes of this specification, a "computer-readable medium" may be any device that can contain, store, communicate, propagate or transmit a program for use by a program execution system, device or apparatus, or in conjunction with such program execution systems, devices or apparatuses.

[0140] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0141] It should be understood that the various parts of the present application can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable program execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0142] In the above description of this specification, the description with reference to the terms "one embodiment / example", "another embodiment / example" or "certain embodiments / examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0143] Although the embodiments of the present application have been shown and described, those skilled in the art will appreciate that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present application, and that the scope of the present application is defined by the claims and their equivalents.

[0144] The above is a specific description of the preferred implementation of the present application, but the present application is not limited to the described embodiments. Technical personnel familiar with the field may make various equivalent modifications or substitutions without violating the spirit of the present application. These equivalent modifications or substitutions are all included in the scope defined by the claims of the present application.

Claims

1. A remote data backup encryption method, characterized in that: The following steps are involved: Acquire identity information, wherein the identity information includes parameter information of the smart card, parameter information of the user terminal, and parameter information of the server; Decomposing a first key into three shares corresponding to the identity information by using a first polynomial, and destroying the first key, where the first key is a key for encrypting backup data; Encrypting the identity information by using a second key to generate first data; Convert the first data into decimal to obtain second data; Calculate the second data by using a second polynomial to obtain third data, wherein the second polynomial includes the second key; Obtain the user's password and biometrics; Determine whether the backup data is attacked, and if so, remind the user to update the password and the biometric feature; The determining whether the backup data is attacked includes: Obtaining a value of a counter, wherein the initial value of the counter is zero, and the counter is used to increase by one when decryption of the backup data fails; determining whether the value of the counter is greater than six, and if so, determining that the backup data is under attack; If not, determining whether the second key is used to decrypt the backup data, and if so, determining that the backup data is under attack; When the first key K2 needs to be restored and the backup data is obtained by decrypting the data with the first key K2, the following operations are performed: Through the third data A sc , A usr , A ser and the second polynomial Calculate the second data S sc , S usr , S ser , and the S in the second data sc , S ser C that is restored to character data sc and C ser ; Get the third key K1 from the offline device to C sc and C ser Decrypt and get the parameter information ID of the smart card sc and the server parameter information ID ser ; According to the parameter information ID of the smart card sc and the server parameter information ID ser and the first polynomial Calculate the first key K2 as follows: 。 2. A remote data backup encryption method according to claim 1, characterized in that: The step of decomposing the first key into three shares corresponding to the identity information by using a first polynomial and destroying the first key includes: Generate a first random number, where the first random number is the slope of the first polynomial; According to the first polynomial and the identity information, the first key is decomposed into three shares corresponding to the smart card, the user terminal and the server respectively, and the first key is destroyed.

3. A remote data backup encryption method according to claim 1, characterized in that: The step of encrypting the identity information by using the second key to generate the first data further includes: Obtain the second key and the third key, where the second key is a public key and the third key is a private key corresponding to the second key; The third key is stored on an offline device.

4. A remote data backup encryption method according to claim 1, characterized in that: The step of calculating the second data by using a second polynomial to obtain third data includes: Generate a second random number, where the second random number is the slope of the second polynomial; The second data is calculated by using the second polynomial according to the second random number and the second key to obtain the third data.

5. A remote data backup encryption method according to claim 1, characterized in that: The following steps are also included: Authentication information is generated according to the third data, the password and the biometric feature, and the authentication information is used for identity authentication between the smart card, the user terminal and the server before decryption.

6. A remote data backup encryption system, characterized in that: include: An identity information acquisition module, used to acquire identity information; a first key processing module, configured to decompose the first key into three shares corresponding to the identity information by using a first polynomial, and destroy the first key; A first data generating module, used to encrypt the identity information by using a second key to generate first data; A second data conversion module, used for converting the first data into a decimal system to obtain second data; A third data calculation module, used for calculating the second data by using a second polynomial to obtain third data; Obtain the user's password and biometrics; Determine whether the backup data is attacked, and if so, remind the user to update the password and the biometric feature; The determining whether the backup data is attacked includes: Obtaining a value of a counter, wherein the initial value of the counter is zero, and the counter is used to increase by one when decryption of the backup data fails; determining whether the value of the counter is greater than six, and if so, determining that the backup data is under attack; If not, determining whether the second key is used to decrypt the backup data, and if so, determining that the backup data is under attack; When the first key K2 needs to be restored and the backup data is obtained by decrypting the data with the first key K2, the following operations are performed: Through the third data A sc , A usr , A ser and the second polynomial Calculate the second data S sc , S usr , S ser , and the S in the second data sc , S ser C that is restored to character data sc and C ser ; Get the third key K1 from the offline device to C sc and C ser Decrypt and get the parameter information ID of the smart card sc and the server parameter information ID ser ; According to the parameter information ID of the smart card sc and the server parameter information ID ser and the first polynomial Calculate the first key K2 as follows: 。 7. A remote data backup encryption device, characterized in that: include: at least one processor; at least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor implements a remote data backup encryption method as described in any one of claims 1-5.

8. A storage medium storing a program executable by a processor, characterized in that: The processor-executable program is used to implement a remote data backup encryption method as described in any one of claims 1-5 when executed by the processor.

Images