Information processing method, device, server, terminal and data platform

Abstract

The present invention provides an information processing method, device, server, terminal and data platform, wherein the information processing method comprises: receiving an access request sent by a terminal, wherein the access request carries a target access identifier and a target access permission level corresponding to the terminal; when the verification of the target access identifier is passed, determining the target ciphertext data according to the target access identifier, the target access permission level and pre-stored information; performing a desensitization operation on the target ciphertext data; and sending the desensitized target ciphertext data to the terminal; wherein the pre-stored information comprises: an access identifier, an access permission level, a data access level and ciphertext data that correspond to each other in sequence. This solution well solves the problem that the information processing solution for desensitizing ciphertext in the prior art cannot guarantee the confidentiality of the stored data and has a high overhead.

Description

Technical Field

[0001] The present invention relates to the field of communication technologies, and in particular to an information processing method, device, server, terminal and data platform. Background Art

[0002] Data sharing is a necessary means to realize the value of data in the era of big data, but the leakage of user personal information and the access pressure brought by open sharing have become bottlenecks for data open sharing. How to carry out data sharing while ensuring data security has become an urgent problem to be solved.

[0003] At present, there are different technical solutions such as data desensitization, differential privacy, data encryption, and data labeling to provide different degrees of protection for shared data, ensuring that sensitive information is not visible to partners during data sharing. Among them, data desensitization is currently a more commonly used protection method. Most algorithms for data desensitization are faster than encryption and can quickly perform de-identification processing. It is suitable for enterprises to open some private data to users with certain permissions. At present, data desensitization is processed based on plain text.

[0004] At present, enterprise data sharing is generally for multiple users, and the frequent access of users brings high access pressure to the enterprise platform. In order to reduce the problem of users cracking the data desensitization algorithm and collusion attacks between different users, the "one access one processing" method will be adopted to ensure that the results obtained by each user access are different, which further increases the processing pressure of the data platform. In order to reduce the computing overhead brought by data sharing, enterprises seek to use cloud computing methods to put shared data on cloud servers, and the accessing users directly read them on the cloud platform, and the cloud server completes the "one access one processing" data desensitization process. However, putting data on the cloud will make the shared data face problems such as unreliability in the cloud. To protect the security of cloud data, encrypted storage can be used, but it is difficult for cloud servers to perform data desensitization based on ciphertext. This makes the data sharing work of enterprises face the difficult choice between data security protection and enterprise platform protection.

[0005] That is to say, the above prior art has the following disadvantages:

[0006] 1. The desensitization method of treating different users differently brings great overhead to the data sharing platform. Currently, the desensitization algorithms are all based on plain text processing, which makes it difficult to transfer the pressure of desensitization processing.

[0007] 2. Since the data to be shared often contains a large amount of sensitive information, encryption becomes an important solution for sharing data on the cloud. However, encryption hinders the implementation of desensitization solutions: (1) If desensitization is performed first and then encrypted and stored in the cloud, it is difficult to achieve different processing results for each access; (2) If encryption is performed first and stored in the cloud, desensitization is difficult to perform, and the data accessed by the shared user is either completely ciphertext or completely plaintext.

[0008] From the above, we can see that the existing information processing solutions for ciphertext desensitization have problems such as being unable to guarantee the confidentiality of stored data and having high overhead. Summary of the invention

[0009] The purpose of the present invention is to provide an information processing method, device, server, terminal and data platform to solve the problems in the prior art of information processing solutions for ciphertext desensitization that the confidentiality of stored data cannot be guaranteed and the overhead is high.

[0010] In order to solve the above technical problems, an embodiment of the present invention provides an information processing method, which is applied to a server, comprising:

[0011] Receiving an access request sent by a terminal, the access request carrying a target access identifier and a target access permission level corresponding to the terminal;

[0012] In the case where the verification of the target access identifier is passed, determining the target ciphertext data according to the target access identifier, the target access authority level and the pre-stored information;

[0013] Performing a desensitization operation on the target ciphertext data;

[0014] Sending the desensitized target ciphertext data to the terminal;

[0015] The pre-stored information includes: an access identifier, an access permission level, a data access level and ciphertext data which correspond to each other in sequence.

[0016] Optionally, determining the target ciphertext data according to the target access identifier, the target access authority level and the pre-stored information includes:

[0017] Matching the target access identifier with the access identifier in the pre-stored information, and matching the target access permission level with the access permission level in the pre-stored information, to obtain the data access level allowed for the terminal;

[0018] According to the permitted data access level, corresponding ciphertext data is acquired from the pre-stored information as target ciphertext data.

[0019] Optionally, the desensitizing operation on the target ciphertext data includes:

[0020] Formula 1 is used to perform a desensitization operation on the target ciphertext data;

[0021] Wherein, the formula 1 is:

[0022] C r =C×r;

[0023] C r Represents the target ciphertext data after desensitization;

[0024] C represents the target ciphertext data;

[0025] r represents the desensitization parameter;

[0026] When the data access level corresponding to the target ciphertext data is greater than 1, r=0; otherwise, r is a random number.

[0027] Optionally, before determining the target ciphertext data according to the target access identifier, the target access authority level and the pre-stored information, the method further includes:

[0028] Receive the corresponding access permission level, data access level and ciphertext data sent by the data platform, as well as the corresponding target access identifier and target access permission level;

[0029] The pre-stored information is obtained according to the access permission level, the data access level, the ciphertext data, the target access identifier and the target access permission level.

[0030] The embodiment of the present invention further provides an information processing method, which is applied to a terminal and includes:

[0031] Send a registration request to the data platform;

[0032] Receiving a target access identifier, a target access permission level, and an access key sent by the data platform according to the registration request;

[0033] Sending an access request to a server according to the target access identifier and the target access permission level;

[0034] Receiving the desensitized target ciphertext data sent by the server according to the access request;

[0035] The target ciphertext data is decrypted according to the access key to obtain the target plaintext data.

[0036] Optionally, decrypting the target ciphertext data according to the access key to obtain target plaintext data includes:

[0037] Formula 2 is used to decrypt the target ciphertext data according to the access key to obtain the target plaintext data;

[0038] Wherein, the formula 2 is:

[0039]

[0040] mt represents the target plaintext data, C rrepresents the desensitized target ciphertext data, SK represents the access key, C represents the target ciphertext data, and r represents the desensitization parameter;

[0041] SK=e(g,g) ab ; e(g,g) represents a bilinear pair whose generator is g, and a and b represent fixed parameter values.

[0042] The embodiment of the present invention further provides an information processing method, which is applied to a data platform and includes:

[0043] Receiving a registration request sent by a terminal;

[0044] Generating a target access identifier, a target access rights level and an access key for the terminal according to the registration request;

[0045] The target access identifier, the target access permission level and the access key are sent to the terminal.

[0046] Optionally, generating an access key for the terminal according to the registration request includes:

[0047] Using formula 3, an access key is generated for the terminal;

[0048] Wherein, the formula three is:

[0049] SK=e(g,g) ab ;

[0050] SK represents the access key;

[0051] a, b represent fixed parameter values;

[0052] e(g,g) represents a bilinear pair whose generator is g.

[0053] Optionally, before receiving the registration request sent by the terminal, the following is further included:

[0054] Divide the data table to be shared according to the fields, and match the corresponding access permission level to each divided part;

[0055] forming a data access level corresponding to the access authority level for each of the parts;

[0056] According to the access authority level and the data access level, the corresponding part of the ciphertext data is generated.

[0057] Optionally, generating the corresponding portion of ciphertext data according to the access authority level and the data access level includes:

[0058] Determine the partial data tables corresponding to the access permission levels and data access levels, and the random numbers corresponding to the partial data tables;

[0059] Select bilinear pairings from cyclic groups;

[0060] According to the fixed parameter value, the random number, the bilinear pairing and the partial data table, the ciphertext data corresponding to the partial data table is generated.

[0061] Optionally, generating ciphertext data corresponding to the partial data table according to the fixed parameter value, the random number, the bilinear pairing, and the partial data table includes:

[0062] Formula 4 is used to generate ciphertext data corresponding to the partial data table according to the fixed parameter value, the random number, the bilinear pairing and the partial data table;

[0063] Wherein, the formula 4 is:

[0064] C=m k ×c k ×e(g a ,g b ),k∈[1,n];

[0065] C represents the ciphertext data corresponding to the partial data table;

[0066] m k Indicates the plaintext data corresponding to the partial data table;

[0067] c k represents the random number;

[0068] a and b represent the fixed parameter values ​​respectively;

[0069] e(g,g) represents the bilinear pairing.

[0070] Optionally, after generating the corresponding part of the ciphertext data according to the access permission level and the data access level, the method further includes:

[0071] The corresponding access permission level, data access level and ciphertext data are sent to the server for storage.

[0072] Optionally, after generating a target access identifier, a target access rights level and an access key for the terminal according to the registration request, the method further includes:

[0073] The corresponding target access identifier and target access permission level are sent to the server for storage.

[0074] The embodiment of the present invention further provides an information processing device, applied to a server, comprising:

[0075] A first receiving module, configured to receive an access request sent by a terminal, wherein the access request carries a target access identifier and a target access permission level corresponding to the terminal;

[0076] A first determination module, configured to determine target ciphertext data according to the target access identifier, the target access permission level and pre-stored information when the verification of the target access identifier is passed;

[0077] A first processing module, used for performing a desensitization operation on the target ciphertext data;

[0078] A first sending module, used to send the desensitized target ciphertext data to the terminal;

[0079] The pre-stored information includes: an access identifier, an access permission level, a data access level and ciphertext data which correspond to each other in sequence.

[0080] Optionally, the first determining module includes:

[0081] A first processing submodule, configured to match the target access identifier with the access identifier in the pre-stored information, and to match the target access permission level with the access permission level in the pre-stored information, to obtain the data access level permitted to the terminal;

[0082] The first acquisition submodule is used to acquire corresponding ciphertext data as target ciphertext data from the pre-stored information according to the allowed data access level.

[0083] Optionally, the first processing module includes:

[0084] A second processing submodule, configured to perform a desensitization operation on the target ciphertext data using formula 1;

[0085] Wherein, the formula 1 is:

[0086] C r =C×r;

[0087] C r Represents the target ciphertext data after desensitization;

[0088] C represents the target ciphertext data;

[0089] r represents the desensitization parameter;

[0090] When the data access level corresponding to the target ciphertext data is greater than 1, r=0; otherwise, r is a random number.

[0091] Optionally, also include:

[0092] A second receiving module is used to receive the corresponding access permission level, data access level and ciphertext data, as well as the corresponding target access permission level and target access permission level sent by the data platform before determining the target ciphertext data according to the target access permission identification, the target access permission level and the pre-stored information;

[0093] The second processing module is used to obtain the pre-stored information according to the access permission level, the data access level, the ciphertext data, the target access identifier and the target access permission level.

[0094] The embodiment of the present invention further provides an information processing device, applied to a terminal, comprising:

[0095] The second sending module is used to send a registration request to the data platform;

[0096] A third receiving module is used to receive the target access identifier, target access permission level and access key sent by the data platform according to the registration request;

[0097] A third sending module, used to send an access request to the server according to the target access identifier and the target access permission level;

[0098] A fourth receiving module, used to receive the desensitized target ciphertext data sent by the server according to the access request;

[0099] The third processing module is used to decrypt the target ciphertext data according to the access key to obtain target plaintext data.

[0100] Optionally, the third processing module includes:

[0101] A third processing submodule is used to decrypt the target ciphertext data according to the access key using Formula 2 to obtain target plaintext data;

[0102] Wherein, the formula 2 is:

[0103]

[0104] mt represents the target plaintext data, C r represents the desensitized target ciphertext data, SK represents the access key, C represents the target ciphertext data, and r represents the desensitization parameter;

[0105] SK=e(g,g) ab ; e(g,g) represents a bilinear pair whose generator is g, and a and b represent fixed parameter values.

[0106] The embodiment of the present invention further provides an information processing device, which is applied to a data platform and includes:

[0107] A fifth receiving module, used to receive a registration request sent by a terminal;

[0108] A first generating module, configured to generate a target access identifier, a target access permission level and an access key for the terminal according to the registration request;

[0109] The fourth sending module is used to send the target access identifier, the target access authority level and the access key to the terminal.

[0110] Optionally, the first generating module includes:

[0111] A first generating submodule, configured to generate an access key for the terminal using Formula 3;

[0112] Wherein, the formula three is:

[0113] SK=e(g,g) ab ;

[0114] SK represents the access key;

[0115] a, b represent fixed parameter values;

[0116] e(g,g) represents a bilinear pair whose generator is g.

[0117] Optionally, also include:

[0118] A fourth processing module is used for dividing the data table to be shared according to fields before receiving the registration request sent by the terminal, and matching the corresponding access permission level to each divided part;

[0119] A fifth processing module, configured to form a data access level corresponding to the access authority level for each of the parts;

[0120] The second generating module is used to generate the corresponding part of the ciphertext data according to the access permission level and the data access level.

[0121] Optionally, the second generating module includes:

[0122] A first determination submodule, used to determine the partial data tables corresponding to the access permission levels and data access levels, and the random numbers corresponding to the partial data tables;

[0123] A first selection submodule is used to select a bilinear pairing from a cyclic group;

[0124] The second generating submodule is used to generate the ciphertext data corresponding to the partial data table according to the fixed parameter value, the random number, the bilinear pairing and the partial data table.

[0125] Optionally, generating ciphertext data corresponding to the partial data table according to the fixed parameter value, the random number, the bilinear pairing, and the partial data table includes:

[0126] Formula 4 is used to generate ciphertext data corresponding to the partial data table according to the fixed parameter value, the random number, the bilinear pairing and the partial data table;

[0127] Wherein, the formula 4 is:

[0128] C=m k ×c k ×e(g a ,g b ),k∈[1,n];

[0129] C represents the ciphertext data corresponding to the partial data table;

[0130] m k Indicates the plaintext data corresponding to the partial data table;

[0131] c k represents the random number;

[0132] a and b represent the fixed parameter values ​​respectively;

[0133] e(g,g) represents the bilinear pairing.

[0134] Optionally, also include:

[0135] The fifth sending module is used to send the corresponding access permission level, data access level and ciphertext data to the server for storage after generating the corresponding part of the ciphertext data according to the access permission level and data access level.

[0136] Optionally, also include:

[0137] The sixth sending module is used to generate a target access identifier, a target access permission level and an access key for the terminal according to the registration request, and then send the corresponding target access identifier and target access permission level to the server for storage.

[0138] An embodiment of the present invention further provides a server, comprising: a processor and a transceiver;

[0139] The processor is configured to receive, through the transceiver, an access request sent by a terminal, wherein the access request carries a target access identifier and a target access permission level corresponding to the terminal;

[0140] In the case where the verification of the target access identifier is passed, determining the target ciphertext data according to the target access identifier, the target access authority level and the pre-stored information;

[0141] Performing a desensitization operation on the target ciphertext data;

[0142] Sending the desensitized target ciphertext data to the terminal through the transceiver;

[0143] The pre-stored information includes: an access identifier, an access permission level, a data access level and ciphertext data which correspond to each other in sequence.

[0144] Optionally, the processor is specifically configured to:

[0145] Matching the target access identifier with the access identifier in the pre-stored information, and matching the target access permission level with the access permission level in the pre-stored information, to obtain the data access level allowed for the terminal;

[0146] According to the permitted data access level, corresponding ciphertext data is acquired from the pre-stored information as target ciphertext data.

[0147] Optionally, the processor is specifically configured to:

[0148] Formula 1 is used to perform a desensitization operation on the target ciphertext data;

[0149] Wherein, the formula 1 is:

[0150] C r =C×r;

[0151] C r Represents the target ciphertext data after desensitization;

[0152] C represents the target ciphertext data;

[0153] r represents the desensitization parameter;

[0154] When the data access level corresponding to the target ciphertext data is greater than 1, r=0; otherwise, r is a random number.

[0155] Optionally, the processor is further configured to:

[0156] Before determining the target ciphertext data according to the target access identifier, the target access permission level and the pre-stored information, receiving the corresponding access permission level, data access level and ciphertext data sent by the data platform, as well as the corresponding target access identifier and target access permission level through the transceiver;

[0157] The pre-stored information is obtained according to the access permission level, the data access level, the ciphertext data, the target access identifier and the target access permission level.

[0158] An embodiment of the present invention further provides a terminal, comprising: a processor and a transceiver;

[0159] The processor is used to send a registration request to the data platform through the transceiver;

[0160] Receiving, by the transceiver, a target access identifier, a target access permission level, and an access key sent by the data platform according to the registration request;

[0161] Sending an access request to a server through the transceiver according to the target access identifier and the target access authority level;

[0162] Receiving, by the transceiver, the desensitized target ciphertext data sent by the server according to the access request;

[0163] The target ciphertext data is decrypted according to the access key to obtain the target plaintext data.

[0164] Optionally, the processor is specifically configured to:

[0165] Formula 2 is used to decrypt the target ciphertext data according to the access key to obtain the target plaintext data;

[0166] Wherein, the formula 2 is:

[0167]

[0168] mt represents the target plaintext data, C r represents the desensitized target ciphertext data, SK represents the access key, C represents the target ciphertext data, and r represents the desensitization parameter;

[0169] SK=e(g,g) ab ; e(g,g) represents a bilinear pair whose generator is g, and a and b represent fixed parameter values.

[0170] The embodiment of the present invention further provides a data platform, including: a processor and a transceiver;

[0171] The processor is configured to receive, through the transceiver, a registration request sent by a terminal;

[0172] Generating a target access identifier, a target access rights level and an access key for the terminal according to the registration request;

[0173] The target access identifier, the target access permission level and the access key are sent to the terminal via the transceiver.

[0174] Optionally, the processor is specifically configured to:

[0175] Using formula 3, an access key is generated for the terminal;

[0176] Wherein, the formula three is:

[0177] SK=e(g,g) ab ;

[0178] SK represents the access key;

[0179] a, b represent fixed parameter values;

[0180] e(g,g) represents a bilinear pair whose generator is g.

[0181] Optionally, the processor is further configured to:

[0182] Before receiving the registration request sent by the terminal, the data table to be shared is divided according to the fields, and the corresponding access permission level is matched to each divided part;

[0183] forming a data access level corresponding to the access authority level for each of the parts;

[0184] According to the access authority level and the data access level, the corresponding part of the ciphertext data is generated.

[0185] Optionally, the processor is specifically configured to:

[0186] Determine the partial data tables corresponding to the access permission levels and data access levels, and the random numbers corresponding to the partial data tables;

[0187] Select bilinear pairings from cyclic groups;

[0188] According to the fixed parameter value, the random number, the bilinear pairing and the partial data table, the ciphertext data corresponding to the partial data table is generated.

[0189] Optionally, the processor is specifically configured to:

[0190] Formula 4 is used to generate ciphertext data corresponding to the partial data table according to the fixed parameter value, the random number, the bilinear pairing and the partial data table;

[0191] Wherein, the formula 4 is:

[0192] C=m k ×c k ×e(g a,g b ),k∈[1,n];

[0193] C represents the ciphertext data corresponding to the partial data table;

[0194] m k Indicates the plaintext data corresponding to the partial data table;

[0195] c k represents the random number;

[0196] a and b represent the fixed parameter values ​​respectively;

[0197] e(g,g) represents the bilinear pairing.

[0198] Optionally, the processor is further configured to:

[0199] After generating the corresponding part of the ciphertext data according to the access permission level and the data access level, the corresponding access permission level, data access level and ciphertext data are sent to the server through the transceiver for storage.

[0200] Optionally, the processor is further configured to:

[0201] After generating a target access identifier, a target access permission level and an access key for the terminal according to the registration request, the corresponding target access identifier and target access permission level are sent to the server through the transceiver for storage.

[0202] An embodiment of the present invention further provides a server, comprising a memory, a processor, and a program stored in the memory and executable on the processor; when the processor executes the program, the above-mentioned server-side information processing method is implemented.

[0203] An embodiment of the present invention further provides a terminal, comprising a memory, a processor, and a program stored in the memory and executable on the processor; when the processor executes the program, the above-mentioned information processing method on the terminal side is implemented.

[0204] An embodiment of the present invention also provides a data platform, including a memory, a processor, and a program stored in the memory and executable on the processor; when the processor executes the program, the information processing method on the data platform side is implemented.

[0205] The embodiment of the present invention further provides a readable storage medium on which a program is stored, and when the program is executed by a processor, the steps in the above-mentioned information processing method on the server side are implemented; or,

[0206] When the program is executed by the processor, the steps in the above-mentioned information processing method on the terminal side are implemented; or,

[0207] When the program is executed by the processor, the steps in the information processing method on the data platform side are implemented.

[0208] The beneficial effects of the above technical solution of the present invention are as follows:

[0209] In the above scheme, the information processing method receives an access request sent by a terminal, wherein the access request carries a target access identifier and a target access permission level corresponding to the terminal; when the verification of the target access identifier is passed, the target ciphertext data is determined according to the target access identifier, the target access permission level and the pre-stored information; the target ciphertext data is desensitized; and the desensitized target ciphertext data is sent to the terminal; wherein the pre-stored information includes: an access identifier, an access permission level, a data access level and ciphertext data that correspond to each other in sequence; the method can support the implementation of a fine-grained ciphertext desensitization scheme based on data classification, so that the server can desensitize the encrypted data and obtain different desensitized data each time the user accesses, which can not only ensure the confidentiality of the stored data, but also reduce the desensitization calculation overhead of the data opener; the method well solves the problem that the information processing scheme for ciphertext desensitization in the prior art cannot ensure the confidentiality of the stored data and has high overhead. BRIEF DESCRIPTION OF THE DRAWINGS

[0210] Figure 1 The information processing method of the embodiment of the present invention is shown in FIG. Figure 1 ;

[0211] Figure 2 The information processing method of the embodiment of the present invention is shown in FIG. Figure 2 ;

[0212] Figure 3 The information processing method of the embodiment of the present invention is shown in FIG. Figure 3 ;

[0213] Figure 4 This is a schematic diagram of a specific implementation framework of the information processing method according to an embodiment of the present invention;

[0214] Figure 5 The structure of the information processing device according to the embodiment of the present invention is shown in FIG. Figure 1 ;

[0215] Figure 6 The structure of the information processing device according to the embodiment of the present invention is shown in FIG. Figure 2 ;

[0216] Figure 7 The structure of the information processing device according to the embodiment of the present invention is shown in FIG. Figure 3;

[0217] Figure 8 A schematic diagram of the server structure of an embodiment of the present invention;

[0218] Fig. 9 A schematic diagram of the terminal structure of an embodiment of the present invention;

[0219] Fig.10 The data platform structure diagram of the embodiment of the present invention. DETAILED DESCRIPTION

[0220] In order to make the technical problems, technical solutions and advantages to be solved by the present invention more clear, a detailed description will be given below with reference to the accompanying drawings and specific embodiments.

[0221] The present invention aims at the problem that the information processing scheme for desensitizing ciphertext in the existing technology cannot guarantee the confidentiality of stored data and has high overhead, and provides an information processing method applied to a server, such as Figure 1 As shown, including:

[0222] Step 11: receiving an access request sent by a terminal, wherein the access request carries a target access identifier and a target access permission level corresponding to the terminal;

[0223] Step 12: When the verification of the target access identifier is passed, determine the target ciphertext data according to the target access identifier, the target access authority level and the pre-stored information;

[0224] Step 13: Desensitizing the target ciphertext data;

[0225] Step 14: Send the desensitized target ciphertext data to the terminal; wherein the pre-stored information includes: an access identifier, an access permission level, a data access level, and ciphertext data that correspond to each other in sequence.

[0226] The information processing method provided by the embodiment of the present invention receives an access request sent by a terminal, wherein the access request carries a target access identifier and a target access permission level corresponding to the terminal; when the verification of the target access identifier is passed, the target ciphertext data is determined according to the target access identifier, the target access permission level and the pre-stored information; the target ciphertext data is desensitized; and the desensitized target ciphertext data is sent to the terminal; wherein the pre-stored information includes: an access identifier, an access permission level, a data access level and ciphertext data that correspond to each other in sequence; the method can support the implementation of a fine-grained ciphertext desensitization scheme based on data classification, so that the server can desensitize the encrypted data and obtain different desensitized data each time the user accesses, which can not only ensure the confidentiality of the stored data, but also reduce the desensitization calculation overhead of the data opener; the method well solves the problem that the information processing scheme for ciphertext desensitization in the prior art cannot ensure the confidentiality of the stored data and has high overhead.

[0227] Among them, determining the target ciphertext data based on the target access identifier, the target access permission level and the pre-stored information includes: matching the target access identifier with the access identifier in the pre-stored information, and matching the target access permission level with the access permission level in the pre-stored information to obtain the data access level allowed for the terminal; and obtaining the corresponding ciphertext data from the pre-stored information as the target ciphertext data based on the allowed data access level.

[0228] Specifically, the desensitizing operation on the target ciphertext data includes: using Formula 1 to perform a desensitizing operation on the target ciphertext data; wherein the Formula 1 is:

[0229] C r =C×r; C r represents the target ciphertext data after desensitization; C represents the target ciphertext data; r represents the desensitization parameter; when the data access level corresponding to the target ciphertext data is greater than 1, r=0, otherwise, r is a random number.

[0230] Furthermore, before determining the target ciphertext data based on the target access identifier, the target access permission level and the pre-stored information, it also includes: receiving the corresponding access permission level, data access level and ciphertext data, and the corresponding target access identifier and target access permission level sent by the data platform; and obtaining the pre-stored information based on the access permission level, data access level, ciphertext data, target access identifier and target access permission level.

[0231] The embodiment of the present invention also provides an information processing method, which is applied to a terminal, such as Figure 2 As shown, including:

[0232] Step 21: Send a registration request to the data platform;

[0233] Step 22: Receive the target access identifier, target access permission level, and access key sent by the data platform according to the registration request;

[0234] Step 23: Sending an access request to the server according to the target access identifier and the target access authority level;

[0235] Step 24: receiving the desensitized target ciphertext data sent by the server according to the access request;

[0236] Step 25: Decrypt the target ciphertext data according to the access key to obtain target plaintext data.

[0237] The information processing method provided by the embodiment of the present invention sends a registration request to a data platform; receives a target access identifier, a target access permission level, and an access key sent by the data platform according to the registration request; sends an access request to a server according to the target access identifier and the target access permission level; receives desensitized target ciphertext data sent by the server according to the access request; decrypts the target ciphertext data according to the access key to obtain target plaintext data; can support the implementation of a fine-grained ciphertext desensitization scheme based on data classification, so that the server can desensitize the encrypted data, and obtain different desensitized data each time the user accesses, which can not only ensure the confidentiality of the stored data, but also reduce the desensitization calculation overhead of the data opener; it well solves the problem that the information processing scheme for ciphertext desensitization in the prior art cannot ensure the confidentiality of the stored data and has high overhead.

[0238] The decrypting the target ciphertext data according to the access key to obtain the target plaintext data includes: using Formula 2 to decrypt the target ciphertext data according to the access key to obtain the target plaintext data; wherein Formula 2 is:

[0239] mt represents the target plaintext data, C r represents the desensitized target ciphertext data, SK represents the access key, C represents the target ciphertext data, and r represents the desensitization parameter; SK=e(g,g) ab ; e(g,g) represents a bilinear pair whose generator is g, and a and b represent fixed parameter values.

[0240] The embodiment of the present invention also provides an information processing method, which is applied to a data platform, such as Figure 3 As shown, including:

[0241] Step 31: receiving a registration request sent by the terminal;

[0242] Step 32: Generate a target access identifier, a target access permission level and an access key for the terminal according to the registration request;

[0243] Step 33: Send the target access identifier, target access permission level and access key to the terminal.

[0244] The information processing method provided by the embodiment of the present invention receives a registration request sent by a terminal; generates a target access identifier, a target access permission level and an access key for the terminal according to the registration request; and sends the target access identifier, the target access permission level and the access key to the terminal; it can support the implementation of a fine-grained ciphertext desensitization scheme based on data classification, so that the server can desensitize the encrypted data and obtain different desensitized data each time the user accesses, which can not only ensure the confidentiality of the stored data, but also reduce the desensitization calculation overhead of the data opener; it well solves the problem that the information processing scheme for ciphertext desensitization in the prior art cannot ensure the confidentiality of the stored data and has high overhead.

[0245] According to the registration request, generating an access key for the terminal includes: using formula 3 to generate an access key for the terminal; wherein the formula 3 is:

[0246] SK=e(g,g) ab ; SK represents the access key; a, b represent fixed parameter values; e(g, g) represents a bilinear pairing whose generator is g.

[0247] Furthermore, before receiving the registration request sent by the terminal, it also includes: dividing the data table to be shared according to fields, and matching the corresponding access permission levels to the divided parts; forming data access levels corresponding to the access permission levels for the parts; and generating ciphertext data of the corresponding parts according to the access permission levels and the data access levels.

[0248] Among them, the generating of the corresponding part of the ciphertext data according to the access permission level and the data access level includes: determining the partial data table corresponding to the access permission level and the data access level, and the random number corresponding to the partial data table; selecting a bilinear pairing from a cyclic group; generating the ciphertext data corresponding to the partial data table according to a fixed parameter value, the random number, the bilinear pairing and the partial data table.

[0249] Specifically, generating the ciphertext data corresponding to the partial data table according to the fixed parameter value, the random number, the bilinear pairing, and the partial data table includes: using formula 4 to generate the ciphertext data corresponding to the partial data table according to the fixed parameter value, the random number, the bilinear pairing, and the partial data table; wherein the formula 4 is:

[0250] C=m k ×c k ×e(g a ,g b ), k∈[1,n]; C represents the ciphertext data corresponding to the partial data table; m k Indicates the plaintext data corresponding to the partial data table; c k represents the random number; a and b represent the fixed parameter values ​​respectively; e(g, g) represents the bilinear pairing (specifically, the bilinear pairing with the generator being g).

[0251] Furthermore, after generating the corresponding part of the ciphertext data according to the access permission level and the data access level, it also includes: sending the corresponding access permission level, data access level and ciphertext data to the server for storage.

[0252] Furthermore, after generating a target access identifier, a target access permission level and an access key for the terminal according to the registration request, the method further includes: sending the corresponding target access identifier and target access permission level to a server for storage.

[0253] The information processing method provided in the embodiment of the present invention is illustrated below in combination with multiple sides such as a server, a terminal and a data platform, with a cloud server being taken as an example.

[0254] In response to the above technical problems, an embodiment of the present invention provides an information processing method, which can be specifically implemented as a fine-grained ciphertext desensitization scheme based on data classification, so that the cloud server can desensitize the encrypted data and obtain different desensitized data each time the user accesses it, which can not only ensure the confidentiality of the stored data, but also reduce the desensitization calculation overhead of the data opener.

[0255] It can also be understood that the embodiment of the present invention provides a ciphertext desensitization solution for data sharing, and the implementation of this solution can be adopted as follows Figure 4 The architecture shown in the figure has the following main modules:

[0256] 1) Data encryption module:

[0257] The data encryption module is deployed on the data provider's platform (i.e. the above-mentioned data platform). Its main functions are to perform data encryption, key management and access user management. The specific functions are as follows:

[0258] a. Classify the shared data by field;

[0259] b. Calculate encryption keys for different files;

[0260] c. Encrypt the files to be shared and upload them to the cloud server;

[0261] d. Manage access users: maintain user names and their access IDs (identifications), grant user access rights by level, and calculate and distribute decryption keys for access users.

[0262] 2) Ciphertext desensitization module:

[0263] The ciphertext desensitization module is deployed on the cloud server and performs ciphertext desensitization calculations based on access requirements:

[0264] a. Manage the encrypted files uploaded by the data encryption module;

[0265] b. Receive user access requests and perform desensitization operations on ciphertext;

[0266] c. Transmit desensitized ciphertext.

[0267] 3) User access module:

[0268] The user access module is deployed on the access client (ie the above-mentioned terminal) to perform user registration, issue access requests and decrypt.

[0269] a. Send a user registration request to the data encryption module (i.e., send a registration request as described above), and obtain the access ID and decryption key after identity authentication;

[0270] b. Initiate an access request to the cloud server, obtain the ciphertext and decrypt it (the desensitized ciphertext data received).

[0271] The solution provided by the embodiment of the present invention, combined with the above architecture, mainly involves the following processes:

[0272] (1) Initialization phase: The data encryption module is responsible for managing the shared files, encrypting the files that need to be uploaded to the cloud server, and maintaining the data encryption information.

[0273] Data classification: Shared data tables are divided into sensitivity levels based on fields, for example: from low to high, they are divided into 1, 2, 3, and 4 levels.

[0274] Data encryption: Assume that the columns to be encrypted in the data table are m1, m2, ... n , select a random number for each column (c1, c2, c3, ... c n), that is, determine the random number corresponding to the part of the data table; and form a sensitivity level list t = (1, 2, 3, 4...) of the data table to be accessed. Select the bilinear pairing e (g, g), generate random numbers a, b, and calculate the ciphertext C = m k ×c k ×e(g a ,g b ),k∈[1,n].

[0275] Upload the ciphertext C and the sensitivity level list to the cloud server.

[0276] Specifically, regarding “forming a sensitivity level list t of a data table to be accessed”, it can be: assuming that the sensitivity level set by the data classification and grading rule is 1-4, matching the sensitivity level of the column to be encrypted and forming a sensitivity level list;

[0277] Regarding "selecting a bilinear pairing e(g, g)", it can be: first find a cyclic group G, which is a set of numbers, and randomly select one from it;

[0278] Regarding bilinear pairings, it can be:

[0279] Definition: Let q be a prime number, G1, G2, G3 are cyclic groups of order q. A mapping e:G1×G2→G3 is a bilinear pairing if e satisfies the following properties:

[0280] 1) Bilinearity: For any producer g1 of G1, any generator g2 of G2, choose any a, b∈Z p , there is e(g1 a , g2 b ) = e(g1, g2) ab .

[0281] 2) Non-degeneracy: There exist g1∈G1, g2∈G2 such that e(g1, g2)≠1, where 1 refers to the identity element in G3.

[0282] 3) Computability: There exists an effective algorithm to calculate the value of e(g1, g2) for any g1∈G1, g2∈G2.

[0283] Regarding "random numbers a, b": they are just randomly selected numbers, which can be implemented in the program through function calls, so I will not go into details here.

[0284] (2) The user initiates a registration request, and the data encryption module generates a unique access ID for the user, authorizes the user, and calculates the decryption key (i.e., the above-mentioned access key) for the user based on the user's access rights (obtained by the data encryption module based on the identity of the registrant) using the following formula, resulting in the following table:

[0285] SK=e(g,g)ab ;

[0286] username Access ID Access Rights Key user1 uID1 2 SK1 user2 uID2 3 SK2 user ikB 4 ……

[0287] User access rights are consistent with data classification, and are divided into levels 1-4 from low to high. Level 1 access rights mean that this user can access level 1 data, level 2 access rights mean that this user can access level 1 and 2 data, and so on. Level 4 is the highest access right.

[0288] The data encryption module synchronizes the user access ID and permissions to the cloud server for storage; that is, the corresponding target access identifier and target access permission level are sent to the server for storage.

[0289] (3) The data encryption module transmits the access ID, permissions, and access keys to the user in a secure manner, and the user registration is successful.

[0290] (4) The user access module uses the access ID to initiate an access request (for the target ciphertext data) to the cloud server.

[0291] a. After the cloud server verifies the access ID, it queries the user's access rights and compares them, then compares them with the sensitivity level table t and desensitizes the stored ciphertext (i.e. the target ciphertext data):

[0292] If the data access level corresponding to the target ciphertext data is > l, then r = 0 in the following. Otherwise, r is a random number selected by the cloud server. The following formula can be used for desensitization operation:

[0293] C r =C×r.

[0294] Among them, C r represents the target ciphertext data after desensitization; C represents the target ciphertext data; r represents the desensitization parameter.

[0295] If there are access requests for multiple target ciphertext data, repeat the above operation.

[0296] b. If there are multiple user access requests, repeat the above operation for each user. In the end, each accessing user will obtain a different ciphertext (due to the involvement of random numbers, even users of the same level will obtain different data).

[0297] (5) The cloud server will C r Sent to the user access module, the user access module uses the following formula to decrypt using the key:

[0298]

[0299] mt is the plaintext obtained after decryption (i.e. the target plaintext data mentioned above), Cr represents the desensitized target ciphertext data, SK represents the access key, C represents the target ciphertext data, and r represents the desensitization parameter;

[0300] SK=e(g,g) ab ; e(g,g) represents a bilinear pair whose generator is g, and a and b represent fixed parameter values.

[0301] The final user obtains the desensitized plaintext, and each user obtains a different plaintext. Decryption fails for columns that do not have access rights, and the columns cannot be accessed.

[0302] From the above, it can be seen that the solution provided by the embodiment of the present invention can realize desensitization calculation based on ciphertext by the cloud server, protecting the data from being visible to the cloud server; and realize desensitization control and encrypted storage based on the sensitivity level of the data, with granularity down to the column level.

[0303] Furthermore, compared with the existing solutions, in this solution: 1. Data desensitization operations in the cloud can reduce the computing pressure of data openers; 2. Ciphertext access control based on sensitive data classification can be implemented; 3. Ciphertext-based desensitization technology can be implemented, making cloud services available but invisible to data, thereby protecting the confidentiality of user data.

[0304] In summary, the solution provided by the embodiment of the present invention can realize the secure outsourcing of desensitizing calculations of data, which mainly involves combining data classification and user classification to realize group authority management, and securely outsourcing the desensitizing calculations to reduce the computing pressure of data providers, and realize fine-grained desensitization by the cloud server.

[0305] The embodiment of the present invention also provides an information processing device, which is applied to a server, such as Figure 5 As shown, including:

[0306] A first receiving module 51 is used to receive an access request sent by a terminal, wherein the access request carries a target access identifier and a target access permission level corresponding to the terminal;

[0307] A first determination module 52 is used to determine target ciphertext data according to the target access identifier, the target access permission level and pre-stored information when the verification of the target access identifier is passed;

[0308] A first processing module 53, used for performing a desensitization operation on the target ciphertext data;

[0309] A first sending module 54, used to send the desensitized target ciphertext data to the terminal;

[0310] The pre-stored information includes: an access identifier, an access permission level, a data access level and ciphertext data which correspond to each other in sequence.

[0311] The information processing device provided by the embodiment of the present invention receives an access request sent by a terminal, wherein the access request carries a target access identifier and a target access permission level corresponding to the terminal; when the verification of the target access identifier is passed, the target ciphertext data is determined according to the target access identifier, the target access permission level and the pre-stored information; the target ciphertext data is desensitized; and the desensitized target ciphertext data is sent to the terminal; wherein the pre-stored information includes: an access identifier, an access permission level, a data access level and ciphertext data that correspond to each other in sequence; the device can support the implementation of a fine-grained ciphertext desensitization scheme based on data classification, so that the server can desensitize the encrypted data and obtain different desensitized data each time the user accesses, which can not only ensure the confidentiality of the stored data, but also reduce the desensitization calculation overhead of the data opener; the device well solves the problem that the information processing scheme for ciphertext desensitization in the prior art cannot ensure the confidentiality of the stored data and has a high overhead.

[0312] Among them, the first determination module includes: a first processing sub-module, used to match the target access identifier with the access identifier in the pre-stored information, and match the target access permission level with the access permission level in the pre-stored information to obtain the data access level allowed for the terminal; a first acquisition sub-module, used to obtain corresponding ciphertext data from the pre-stored information as target ciphertext data according to the allowed data access level.

[0313] Specifically, the first processing module includes: a second processing submodule, which is used to perform a desensitization operation on the target ciphertext data using Formula 1; wherein Formula 1 is:

[0314] C r =C×r; C r represents the target ciphertext data after desensitization; C represents the target ciphertext data; r represents the desensitization parameter; when the data access level corresponding to the target ciphertext data is greater than 1, r=0, otherwise, r is a random number.

[0315] Furthermore, the information processing device also includes: a second receiving module, used to receive the corresponding access permission level, data access level and ciphertext data, as well as the corresponding target access identifier and target access permission level, sent by the data platform before determining the target ciphertext data based on the target access identifier, target access permission level and pre-stored information; a second processing module, used to obtain the pre-stored information based on the access permission level, data access level, ciphertext data, target access identifier and target access permission level.

[0316] Among them, the implementation embodiments of the above-mentioned server-side information processing method are all applicable to the embodiments of the information processing device and can achieve the same technical effects.

[0317] The embodiment of the present invention further provides an information processing device, which is applied to a terminal, such as Figure 6 As shown, including:

[0318] The second sending module 61 is used to send a registration request to the data platform;

[0319] A third receiving module 62 is used to receive the target access identifier, target access permission level and access key sent by the data platform according to the registration request;

[0320] A third sending module 63, configured to send an access request to the server according to the target access identifier and the target access permission level;

[0321] A fourth receiving module 64, configured to receive the desensitized target ciphertext data sent by the server according to the access request;

[0322] The third processing module 65 is used to decrypt the target ciphertext data according to the access key to obtain target plaintext data.

[0323] The information processing device provided in the embodiment of the present invention sends a registration request to a data platform; receives a target access identifier, a target access permission level, and an access key sent by the data platform according to the registration request; sends an access request to a server according to the target access identifier and the target access permission level; receives desensitized target ciphertext data sent by the server according to the access request; decrypts the target ciphertext data according to the access key to obtain target plaintext data; can support the implementation of a fine-grained ciphertext desensitization scheme based on data classification, so that the server can desensitize the encrypted data, and obtain different desensitized data each time the user accesses, which can not only ensure the confidentiality of the stored data, but also reduce the desensitization calculation overhead of the data opener; it well solves the problem that the information processing scheme for ciphertext desensitization in the prior art cannot ensure the confidentiality of the stored data and has high overhead.

[0324] The third processing module includes: a third processing submodule, which is used to use Formula 2 to decrypt the target ciphertext data according to the access key to obtain the target plaintext data; wherein the Formula 2 is:

[0325] mt represents the target plaintext data, C r represents the desensitized target ciphertext data, SK represents the access key, C represents the target ciphertext data, and r represents the desensitization parameter; SK=e(g,g)ab ; e(g,g) represents a bilinear pair whose generator is g, and a and b represent fixed parameter values.

[0326] Among them, the implementation embodiments of the above-mentioned terminal-side information processing method are all applicable to the embodiments of the information processing device and can achieve the same technical effects.

[0327] The embodiment of the present invention also provides an information processing device, which is applied to a data platform, such as Figure 7 As shown, including:

[0328] The fifth receiving module 71 is used to receive a registration request sent by a terminal;

[0329] A first generating module 72, configured to generate a target access identifier, a target access permission level and an access key for the terminal according to the registration request;

[0330] The fourth sending module 73 is used to send the target access identifier, the target access authority level and the access key to the terminal.

[0331] The information processing device provided by the embodiment of the present invention receives a registration request sent by a terminal; generates a target access identifier, a target access permission level and an access key for the terminal according to the registration request; and sends the target access identifier, the target access permission level and the access key to the terminal; it can support the implementation of a fine-grained ciphertext desensitization scheme based on data classification, so that the server can desensitize the encrypted data and obtain different desensitized data each time the user accesses, which can not only ensure the confidentiality of the stored data, but also reduce the desensitization calculation overhead of the data opener; it solves the problem that the information processing scheme for ciphertext desensitization in the prior art cannot ensure the confidentiality of the stored data and has high overhead.

[0332] The first generation module includes: a first generation submodule, which is used to generate an access key for the terminal using Formula 3; wherein the Formula 3 is:

[0333] SK=e(g,g) ab ; SK represents the access key; a, b represent fixed parameter values; e(g, g) represents a bilinear pairing whose generator is g.

[0334] Furthermore, the information processing device also includes: a fourth processing module, used to divide the shared data table according to fields before receiving the registration request sent by the terminal, and match the corresponding access permission level to each divided part; a fifth processing module, used to form a data access level corresponding to the access permission level for each part; a second generation module, used to generate the ciphertext data of the corresponding part according to the access permission level and the data access level.

[0335] Among them, the second generation module includes: a first determination submodule, used to determine the partial data table corresponding to the access permission level and the data access level, and the random number corresponding to the partial data table; a first selection submodule, used to select bilinear pairings from the cyclic group; a second generation submodule, used to generate ciphertext data corresponding to the partial data table based on a fixed parameter value, the random number, the bilinear pairing and the partial data table.

[0336] Specifically, generating the ciphertext data corresponding to the partial data table according to the fixed parameter value, the random number, the bilinear pairing, and the partial data table includes: using formula 4 to generate the ciphertext data corresponding to the partial data table according to the fixed parameter value, the random number, the bilinear pairing, and the partial data table; wherein the formula 4 is:

[0337] C=m k ×c k ×e(g a ,g b ), k∈[1,n]; C represents the ciphertext data corresponding to the partial data table; m k Indicates the plaintext data corresponding to the partial data table; c k represents the random number; a and b represent the fixed parameter values ​​respectively; e(g, g) represents the bilinear pairing.

[0338] Furthermore, the information processing device also includes: a fifth sending module, which is used to send the corresponding access permission level, data access level and ciphertext data to the server for storage after generating the corresponding part of the ciphertext data according to the access permission level and data access level.

[0339] Furthermore, the information processing device also includes: a sixth sending module, which is used to send the corresponding target access identifier and target access permission level to the server for storage after generating the target access identifier, target access permission level and access key for the terminal according to the registration request.

[0340] Among them, the implementation embodiments of the information processing method on the above-mentioned data platform side are all applicable to the embodiments of the information processing device and can achieve the same technical effects.

[0341] The embodiment of the present invention also provides a server, such as Figure 8 As shown, it includes: a processor 81 and a transceiver 82;

[0342] The processor 81 is configured to receive an access request sent by a terminal through the transceiver 82, wherein the access request carries a target access identifier and a target access permission level corresponding to the terminal;

[0343] In the case where the verification of the target access identifier is passed, determining the target ciphertext data according to the target access identifier, the target access authority level and the pre-stored information;

[0344] Performing a desensitization operation on the target ciphertext data;

[0345] Sending the desensitized target ciphertext data to the terminal via the transceiver 82;

[0346] The pre-stored information includes: an access identifier, an access permission level, a data access level and ciphertext data which correspond to each other in sequence.

[0347] The server provided in the embodiment of the present invention receives an access request sent by a terminal, wherein the access request carries a target access identifier and a target access permission level corresponding to the terminal; when the verification of the target access identifier is passed, the target ciphertext data is determined according to the target access identifier, the target access permission level and the pre-stored information; the target ciphertext data is desensitized; and the desensitized target ciphertext data is sent to the terminal; wherein the pre-stored information includes: an access identifier, an access permission level, a data access level and ciphertext data that correspond to each other in sequence; the server can support the implementation of a fine-grained ciphertext desensitization scheme based on data classification, so that the server can desensitize the encrypted data and obtain different desensitized data each time the user accesses, which can not only ensure the confidentiality of the stored data, but also reduce the desensitization calculation overhead of the data opener; the information processing scheme for ciphertext desensitization in the prior art is well solved, which has the problem that the confidentiality of the stored data cannot be guaranteed and the overhead is high.

[0348] Among them, the processor is specifically used to: match the target access identifier with the access identifier in the pre-stored information, and match the target access permission level with the access permission level in the pre-stored information to obtain the data access level allowed for the terminal; and according to the allowed data access level, obtain the corresponding ciphertext data from the pre-stored information as the target ciphertext data.

[0349] Specifically, the processor is specifically used to: use Formula 1 to perform a desensitization operation on the target ciphertext data; wherein the Formula 1 is:

[0350] C r =C×r; C r represents the target ciphertext data after desensitization; C represents the target ciphertext data; r represents the desensitization parameter; when the data access level corresponding to the target ciphertext data is greater than 1, r=0, otherwise, r is a random number.

[0351] Furthermore, the processor is also used to: before determining the target ciphertext data based on the target access identifier, the target access permission level and the pre-stored information, receive the corresponding access permission level, data access level and ciphertext data sent by the data platform through the transceiver, as well as the corresponding target access identifier and target access permission level; and obtain the pre-stored information based on the access permission level, data access level, ciphertext data, target access identifier and target access permission level.

[0352] Among them, the implementation embodiments of the information processing method on the above-mentioned server side are all applicable to the embodiments of the server and can achieve the same technical effects.

[0353] The embodiment of the present invention further provides a terminal, such as Fig. 9 As shown, it includes: a processor 91 and a transceiver 92;

[0354] The processor 91 is used to send a registration request to the data platform through the transceiver 92;

[0355] Receiving, by the transceiver 92, the target access identifier, the target access permission level and the access key sent by the data platform according to the registration request;

[0356] Sending an access request to the server through the transceiver 92 according to the target access identifier and the target access permission level;

[0357] Receiving, by the transceiver 92, the desensitized target ciphertext data sent by the server according to the access request;

[0358] The target ciphertext data is decrypted according to the access key to obtain the target plaintext data.

[0359] The terminal provided in the embodiment of the present invention sends a registration request to a data platform; receives a target access identifier, a target access permission level, and an access key sent by the data platform according to the registration request; sends an access request to a server according to the target access identifier and the target access permission level; receives desensitized target ciphertext data sent by the server according to the access request; decrypts the target ciphertext data according to the access key to obtain target plaintext data; can support the implementation of a fine-grained ciphertext desensitization scheme based on data classification, so that the server can desensitize the encrypted data, and obtain different desensitized data each time the user accesses, which can not only ensure the confidentiality of the stored data, but also reduce the desensitization calculation overhead of the data opener; it well solves the problem that the information processing scheme for ciphertext desensitization in the prior art cannot ensure the confidentiality of the stored data and has high overhead.

[0360] The processor is specifically used to: use Formula 2 to decrypt the target ciphertext data according to the access key to obtain the target plaintext data; wherein Formula 2 is:

[0361] mt represents the target plaintext data, C r represents the desensitized target ciphertext data, SK represents the access key, C represents the target ciphertext data, and r represents the desensitization parameter; SK=e(g,g) ab ; e(g,g) represents a bilinear pair whose generator is g, and a and b represent fixed parameter values.

[0362] Among them, the implementation embodiments of the information processing method on the above-mentioned terminal side are all applicable to the embodiments of the terminal and can achieve the same technical effects.

[0363] The embodiment of the present invention also provides a data platform, such as Fig.10 As shown, it includes: a processor 101 and a transceiver 102;

[0364] The processor 101 is configured to receive a registration request sent by a terminal through the transceiver 102;

[0365] Generating a target access identifier, a target access rights level and an access key for the terminal according to the registration request;

[0366] The target access identifier, the target access permission level and the access key are sent to the terminal via the transceiver 102 .

[0367] The data platform provided in the embodiment of the present invention receives a registration request sent by a terminal; generates a target access identifier, a target access permission level and an access key for the terminal according to the registration request; and sends the target access identifier, the target access permission level and the access key to the terminal; it can support the implementation of a fine-grained ciphertext desensitization scheme based on data classification, so that the server can desensitize the encrypted data and obtain different desensitized data each time the user accesses, which can not only ensure the confidentiality of the stored data, but also reduce the desensitization calculation overhead of the data opener; it well solves the problem that the information processing scheme for ciphertext desensitization in the prior art cannot ensure the confidentiality of the stored data and has high overhead.

[0368] The processor is specifically used to: generate an access key for the terminal using Formula 3; wherein Formula 3 is:

[0369] SK=e(g,g) ab ; SK represents the access key; a, b represent fixed parameter values; e(g, g) represents a bilinear pairing whose generator is g.

[0370] Furthermore, the processor is also used to: before receiving the registration request sent by the terminal, divide the data table to be shared according to the fields, and match the corresponding access permission level to each divided part; form a data access level corresponding to the access permission level for each part; and generate ciphertext data of the corresponding part according to the access permission level and the data access level.

[0371] Among them, the processor is specifically used to: determine the partial data table corresponding to the access permission level and the data access level, and the random number corresponding to the partial data table; select a bilinear pairing from a cyclic group; and generate ciphertext data corresponding to the partial data table based on a fixed parameter value, the random number, the bilinear pairing and the partial data table.

[0372] Specifically, the processor is specifically used to: use Formula 4 to generate ciphertext data corresponding to the partial data table according to the fixed parameter value, the random number, the bilinear pairing and the partial data table; wherein the Formula 4 is:

[0373] C=m k ×c k ×e(g a ,g b ), k∈[1,n]; C represents the ciphertext data corresponding to the partial data table; m k Indicates the plaintext data corresponding to the partial data table; c k represents the random number; a and b represent the fixed parameter values ​​respectively; e(g, g) represents the bilinear pairing.

[0374] Furthermore, the processor is also used to: after generating the corresponding part of the ciphertext data according to the access permission level and the data access level, send the corresponding access permission level, data access level and ciphertext data to the server through the transceiver for storage.

[0375] Furthermore, the processor is also used to: after generating a target access identifier, a target access permission level and an access key for the terminal according to the registration request, send the corresponding target access identifier and target access permission level to the server via the transceiver for storage.

[0376] Among them, the implementation embodiments of the information processing method on the above-mentioned data platform side are all applicable to the embodiments of the data platform and can achieve the same technical effects.

[0377] An embodiment of the present invention further provides a server, comprising a memory, a processor, and a program stored in the memory and executable on the processor; when the processor executes the program, the above-mentioned server-side information processing method is implemented.

[0378] Among them, the implementation embodiments of the information processing method on the above-mentioned server side are all applicable to the embodiments of the server and can achieve the same technical effects.

[0379] An embodiment of the present invention further provides a terminal, comprising a memory, a processor, and a program stored in the memory and executable on the processor; when the processor executes the program, the above-mentioned information processing method on the terminal side is implemented.

[0380] Among them, the implementation embodiments of the information processing method on the above-mentioned terminal side are all applicable to the embodiments of the terminal and can achieve the same technical effects.

[0381] An embodiment of the present invention also provides a data platform, including a memory, a processor, and a program stored in the memory and executable on the processor; when the processor executes the program, the information processing method on the data platform side is implemented.

[0382] Among them, the implementation embodiments of the information processing method on the above-mentioned data platform side are all applicable to the embodiments of the data platform and can achieve the same technical effects.

[0383] An embodiment of the present invention also provides a readable storage medium having a program stored thereon, which, when executed by a processor, implements the steps of the information processing method on the server side; or, when executed by a processor, implements the steps of the information processing method on the terminal side; or, when executed by a processor, implements the steps of the information processing method on the data platform side.

[0384] Among them, the implementation embodiments of the information processing method on the above-mentioned server side, terminal side or data platform side are all applicable to the embodiments of the readable storage medium, and can also achieve the corresponding same technical effects.

[0385] It should be noted that many functional components described in this specification are referred to as modules / sub-modules in order to more particularly emphasize the independence of their implementation methods.

[0386] In the embodiment of the present invention, module / submodule can be implemented with software so that it can be performed by various types of processors. For example, an executable code module of an identification can include one or more physical or logical blocks of computer instructions, for example, it can be constructed as an object, process or function. Nevertheless, the executable code of the identified module does not need to be physically located together, but can include different instructions stored in different positions, and when these instructions are logically combined together, it constitutes a module and realizes the specified purpose of this module.

[0387] In fact, executable code module can be a single instruction or many instructions, and can even be distributed on a plurality of different code segments, distributed among different programs, and distributed across a plurality of memory devices. Similarly, operating data can be identified in the module, and can be implemented and organized in the data structure of any appropriate type according to any appropriate form. The operating data can be collected as a single data set, or can be distributed in different locations (including on different storage devices), and can only be present on a system or network as an electronic signal at least in part.

[0388] When a module can be implemented by software, considering the level of existing hardware technology, a person skilled in the art can build a corresponding hardware circuit to implement the corresponding function of the module that can be implemented by software without considering the cost. The hardware circuit includes a conventional very large scale integration (VLSI) circuit or gate array and existing semiconductors such as logic chips, transistors, or other discrete components. The module can also be implemented by a programmable hardware device, such as a field programmable gate array, a programmable array logic, a programmable logic device, etc.

[0389] The above is a preferred embodiment of the present invention. It should be pointed out that for ordinary personnel in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. An information processing method, applied to a server, characterized in that: include: Receiving an access request sent by a terminal, the access request carrying a target access identifier and a target access permission level corresponding to the terminal; In the case where the verification of the target access identifier is passed, determining the target ciphertext data according to the target access identifier, the target access authority level and the pre-stored information; Performing a desensitization operation on the target ciphertext data; Sending the desensitized target ciphertext data to the terminal; The pre-stored information includes: access identifiers, access permission levels, data access levels, and ciphertext data that correspond to each other in sequence; The ciphertext data is formed by the data platform in the following manner: Divide the data table to be shared according to the fields, and match the corresponding access permission levels to each divided part; forming a data access level corresponding to the access authority level for each of the parts; Determine the access permission level and the partial data table corresponding to the data access level, and the random number corresponding to the partial data table; Selecting a bilinear pairing from a cyclic group; the cyclic group comprising a set of numbers; Generate ciphertext data corresponding to the partial data table according to the fixed parameter value, the random number, the bilinear pairing and the partial data table; The ciphertext data corresponding to the partial data table is generated according to the fixed parameter value, the random number, the bilinear pairing and the partial data table by the following formula: C=m k ×c k ×e(g a ,g b ),k∈[1,n]; C represents the ciphertext data corresponding to the partial data table; m k Indicates the plaintext data corresponding to the partial data table; c k represents the random number; a and b represent the fixed parameter values ​​respectively; e(g,g) represents the bilinear pairing; k represents a column of the partial data table, and n is a positive integer.

2. The information processing method according to claim 1, characterized in that: The determining the target ciphertext data according to the target access identifier, the target access permission level and the pre-stored information includes: Matching the target access identifier with the access identifier in the pre-stored information, and matching the target access permission level with the access permission level in the pre-stored information, to obtain the data access level allowed for the terminal; According to the permitted data access level, corresponding ciphertext data is acquired from the pre-stored information as target ciphertext data.

3. The information processing method according to claim 1, characterized in that: Before determining the target ciphertext data according to the target access identifier, the target access permission level and the pre-stored information, the method further includes: Receive the corresponding access permission level, data access level and ciphertext data sent by the data platform, as well as the corresponding target access identifier and target access permission level; The pre-stored information is obtained according to the access permission level, the data access level, the ciphertext data, the target access identifier and the target access permission level.

4. An information processing method, applied to a terminal, characterized in that: include: Send a registration request to the data platform; Receiving a target access identifier, a target access permission level, and an access key sent by the data platform according to the registration request; Sending an access request to a server according to the target access identifier and the target access permission level; Receiving the desensitized target ciphertext data sent by the server according to the access request; Decrypting the target ciphertext data according to the access key to obtain target plaintext data; The ciphertext data of the pre-stored information in the server is formed by the data platform in the following manner: Divide the data table to be shared according to the fields, and match the corresponding access permission levels to each divided part; forming a data access level corresponding to the access authority level for each of the parts; Determine the access permission level and the partial data table corresponding to the data access level, and the random number corresponding to the partial data table; Selecting a bilinear pairing from a cyclic group; the cyclic group comprising a set of numbers; Generate ciphertext data corresponding to the partial data table according to the fixed parameter value, the random number, the bilinear pairing and the partial data table; The ciphertext data corresponding to the partial data table is generated according to the fixed parameter value, the random number, the bilinear pairing and the partial data table by the following formula: C=m k ×c k ×e(g a ,g b ),k∈[1,n]; C represents the ciphertext data corresponding to the partial data table; m k Indicates the plaintext data corresponding to the partial data table; c k represents the random number; a and b represent the fixed parameter values ​​respectively; e(g,g) represents the bilinear pairing; k represents a column of the partial data table, and n is a positive integer.

5. An information processing method, applied to a data platform, characterized in that: include: Receiving a registration request sent by a terminal; Generating a target access identifier, a target access rights level and an access key for the terminal according to the registration request; Sending the target access identifier, target access permission level and access key to the terminal; Before receiving the registration request sent by the terminal, it also includes: Divide the data table to be shared according to the fields, and match the corresponding access permission levels to each divided part; forming a data access level corresponding to the access authority level for each of the parts; Generate corresponding ciphertext data according to the access permission level and data access level; The generating corresponding part of the ciphertext data according to the access permission level and the data access level includes: Determine the partial data tables corresponding to the access permission levels and data access levels, and the random numbers corresponding to the partial data tables; Selecting a bilinear pairing from a cyclic group; the cyclic group comprising a set of numbers; Generate ciphertext data corresponding to the partial data table according to the fixed parameter value, the random number, the bilinear pairing and the partial data table; The ciphertext data corresponding to the partial data table is generated according to the fixed parameter value, the random number, the bilinear pairing and the partial data table by the following formula: C=m k ×c k ×e(g a ,g b ),k∈[1,n]; C represents the ciphertext data corresponding to the partial data table; m k Indicates the plaintext data corresponding to the partial data table; c k represents the random number; a and b represent the fixed parameter values ​​respectively; e(g,g) represents the bilinear pairing; k represents a column of the partial data table, and n is a positive integer.

6. An information processing device, applied to a server, characterized in that: include: A first receiving module, configured to receive an access request sent by a terminal, wherein the access request carries a target access identifier and a target access permission level corresponding to the terminal; A first determination module, configured to determine target ciphertext data according to the target access identifier, the target access permission level and pre-stored information when the verification of the target access identifier is passed; A first processing module, used for performing a desensitization operation on the target ciphertext data; A first sending module, used to send the desensitized target ciphertext data to the terminal; The pre-stored information includes: access identifiers, access permission levels, data access levels, and ciphertext data that correspond to each other in sequence; The ciphertext data is formed by the data platform in the following manner: Divide the data table to be shared according to the fields, and match the corresponding access permission levels to each divided part; forming a data access level corresponding to the access authority level for each of the parts; Determine the access permission level and the partial data table corresponding to the data access level, and the random number corresponding to the partial data table; Selecting a bilinear pairing from a cyclic group; the cyclic group comprising a set of numbers; Generate ciphertext data corresponding to the partial data table according to the fixed parameter value, the random number, the bilinear pairing and the partial data table; The ciphertext data corresponding to the partial data table is generated according to the fixed parameter value, the random number, the bilinear pairing and the partial data table by the following formula: C=m k ×c k ×e(g a ,g b ),k∈[1,n]; C represents the ciphertext data corresponding to the partial data table; m k Indicates the plaintext data corresponding to the partial data table; c k represents the random number; a and b represent the fixed parameter values ​​respectively; e(g,g) represents the bilinear pairing; k represents a column of the partial data table, and n is a positive integer.

7. The information processing device according to claim 6, characterized in that: The first determining module includes: A first processing submodule, configured to match the target access identifier with the access identifier in the pre-stored information, and to match the target access permission level with the access permission level in the pre-stored information, to obtain the data access level permitted to the terminal; The first acquisition submodule is used to acquire corresponding ciphertext data as target ciphertext data from the pre-stored information according to the allowed data access level.

8. The information processing device according to claim 6, characterized in that Also includes: A second receiving module is used to receive the corresponding access permission level, data access level and ciphertext data, as well as the corresponding target access permission level and target access permission level sent by the data platform before determining the target ciphertext data according to the target access permission identification, the target access permission level and the pre-stored information; The second processing module is used to obtain the pre-stored information according to the access permission level, the data access level, the ciphertext data, the target access identifier and the target access permission level.

9. An information processing device, applied to a terminal, characterized in that: include: The second sending module is used to send a registration request to the data platform; A third receiving module is used to receive the target access identifier, target access permission level and access key sent by the data platform according to the registration request; A third sending module, used to send an access request to the server according to the target access identifier and the target access permission level; A fourth receiving module, used to receive the desensitized target ciphertext data sent by the server according to the access request; A third processing module, configured to decrypt the target ciphertext data according to the access key to obtain target plaintext data; The ciphertext data of the pre-stored information in the server is formed by the data platform in the following manner: Divide the data table to be shared according to the fields, and match the corresponding access permission levels to each divided part; forming a data access level corresponding to the access authority level for each of the parts; Determine the access permission level and the partial data table corresponding to the data access level, and the random number corresponding to the partial data table; Selecting a bilinear pairing from a cyclic group; the cyclic group comprising a set of numbers; Generate ciphertext data corresponding to the partial data table according to the fixed parameter value, the random number, the bilinear pairing and the partial data table; The ciphertext data corresponding to the partial data table is generated according to the fixed parameter value, the random number, the bilinear pairing and the partial data table by the following formula: C=m k ×c k ×e(g a ,g b ),k∈[1,n]; C represents the ciphertext data corresponding to the partial data table; m k Indicates the plaintext data corresponding to the partial data table; c k represents the random number; a and b represent the fixed parameter values ​​respectively; e(g,g) represents the bilinear pairing; k represents a column of the partial data table, and n is a positive integer.

10. An information processing device, applied to a data platform, characterized in that: include: A fifth receiving module, used to receive a registration request sent by a terminal; A first generating module, configured to generate a target access identifier, a target access permission level and an access key for the terminal according to the registration request; A fourth sending module, used to send the target access identifier, the target access permission level and the access key to the terminal; A fourth processing module is used for dividing the data table to be shared according to fields before receiving the registration request sent by the terminal, and matching the corresponding access permission level to each divided part; A fifth processing module, configured to form a data access level corresponding to the access authority level for each of the parts; A second generating module, used to generate a corresponding portion of ciphertext data according to the access permission level and the data access level; The second generating module comprises: A first determination submodule, used to determine the partial data tables corresponding to the access permission levels and data access levels, and the random numbers corresponding to the partial data tables; A first selection submodule is used to select a bilinear pair from a cyclic group; the cyclic group includes a set of numbers; A second generating submodule, used for generating ciphertext data corresponding to the partial data table according to the fixed parameter value, the random number, the bilinear pairing and the partial data table; The ciphertext data corresponding to the partial data table is generated according to the fixed parameter value, the random number, the bilinear pairing and the partial data table by the following formula: C=m k ×c k ×e(g a ,g b ),k∈[1,n]; C represents the ciphertext data corresponding to the partial data table; m k Indicates the plaintext data corresponding to the partial data table; c k represents the random number; a and b represent the fixed parameter values ​​respectively; e(g,g) represents the bilinear pairing; k represents a column of the partial data table, and n is a positive integer.

11. A server, characterized in that: include: processor and transceiver; The processor is configured to receive, through the transceiver, an access request sent by a terminal, wherein the access request carries a target access identifier and a target access permission level corresponding to the terminal; In the case where the verification of the target access identifier is passed, determining the target ciphertext data according to the target access identifier, the target access authority level and the pre-stored information; Performing a desensitization operation on the target ciphertext data; Sending the desensitized target ciphertext data to the terminal through the transceiver; The pre-stored information includes: access identifiers, access permission levels, data access levels, and ciphertext data that correspond to each other in sequence; The ciphertext data of the pre-stored information in the server is formed by the data platform in the following manner: Divide the data table to be shared according to the fields, and match the corresponding access permission levels to each divided part; forming a data access level corresponding to the access authority level for each of the parts; Determine the access permission level and the partial data table corresponding to the data access level, and the random number corresponding to the partial data table; Selecting a bilinear pairing from a cyclic group; the cyclic group comprising a set of numbers; Generate ciphertext data corresponding to the partial data table according to the fixed parameter value, the random number, the bilinear pairing and the partial data table; The ciphertext data corresponding to the partial data table is generated according to the fixed parameter value, the random number, the bilinear pairing and the partial data table by the following formula: C=m k ×c k ×e(g a ,g b ),k∈[1,n]; C represents the ciphertext data corresponding to the partial data table; m k Indicates the plaintext data corresponding to the partial data table; c k represents the random number; a and b represent the fixed parameter values ​​respectively; e(g,g) represents the bilinear pairing; k represents a column of the partial data table, and n is a positive integer.

12. A terminal, characterized in that: include: processor and transceiver; The processor is used to send a registration request to the data platform through the transceiver; Receiving, by the transceiver, a target access identifier, a target access permission level, and an access key sent by the data platform according to the registration request; Sending an access request to a server through the transceiver according to the target access identifier and the target access authority level; Receiving, by the transceiver, the desensitized target ciphertext data sent by the server according to the access request; Decrypting the target ciphertext data according to the access key to obtain target plaintext data; The ciphertext data of the pre-stored information in the server is formed by the data platform in the following manner: Divide the data table to be shared according to the fields, and match the corresponding access permission levels to each divided part; forming a data access level corresponding to the access authority level for each of the parts; Determine the access permission level and the partial data table corresponding to the data access level, and the random number corresponding to the partial data table; Selecting a bilinear pairing from a cyclic group; the cyclic group comprising a set of numbers; Generate ciphertext data corresponding to the partial data table according to the fixed parameter value, the random number, the bilinear pairing and the partial data table; The ciphertext data corresponding to the partial data table is generated according to the fixed parameter value, the random number, the bilinear pairing and the partial data table by the following formula: C=m k ×c k ×e(g a ,g b ),k∈[1,n]; C represents the ciphertext data corresponding to the partial data table; m k Indicates the plaintext data corresponding to the partial data table; c k represents the random number; a and b represent the fixed parameter values ​​respectively; e(g,g) represents the bilinear pairing; k represents a column of the partial data table, and n is a positive integer.

13. A data platform, characterized in that: include: processor and transceiver; The processor is configured to receive, through the transceiver, a registration request sent by a terminal; Generating a target access identifier, a target access rights level and an access key for the terminal according to the registration request; Sending the target access identifier, target access permission level and access key to the terminal via the transceiver; The processor is further configured to: before receiving a registration request sent by a terminal, divide the data table to be shared according to fields, and match the corresponding access permission level to each divided part; form a data access level corresponding to the access permission level for each part; and generate ciphertext data of the corresponding part according to the access permission level and the data access level; The processor is further specifically configured to: determine a portion of the data table corresponding to the access permission level and the data access level, and a random number corresponding to the portion of the data table; Selecting a bilinear pairing from a cyclic group; generating ciphertext data corresponding to the partial data table according to a fixed parameter value, the random number, the bilinear pairing and the partial data table; The cyclic group includes a set of numbers; The ciphertext data corresponding to the partial data table is generated according to the fixed parameter value, the random number, the bilinear pairing and the partial data table by the following formula: C=m k ×c k ×e(g a ,g b ),k∈[1,n]; C represents the ciphertext data corresponding to the partial data table; m k Indicates the plaintext data corresponding to the partial data table; c k represents the random number; a and b represent the fixed parameter values ​​respectively; e(g,g) represents the bilinear pairing; k represents a column of the partial data table, and n is a positive integer.

14. A server comprising a memory, a processor, and a program stored in the memory and executable on the processor; characterized in that: When the processor executes the program, the information processing method according to any one of claims 1 to 3 is implemented.

15. A terminal comprising a memory, a processor, and a program stored in the memory and executable on the processor; characterized in that: When the processor executes the program, the information processing method according to claim 4 is implemented.

16. A data platform, comprising a memory, a processor, and a program stored in the memory and executable on the processor; characterized in that: When the processor executes the program, the information processing method according to claim 5 is implemented.

17. A readable storage medium having a program stored thereon, characterized in that: When the program is executed by a processor, the steps of the information processing method according to any one of claims 1 to 3 are implemented; or When the program is executed by a processor, the steps of the information processing method as claimed in claim 4 are implemented; or, When the program is executed by a processor, the steps of the information processing method according to claim 5 are implemented.

Images