Data decryption method for mobile data storage device

Abstract

The present invention discloses a data decryption method for a mobile data storage device, which includes the following steps: S1, verifying the identity of the user, assigning access rights, and generating an identity authority key; S2, reading a request instruction for data access, determining the type of access data, and generating a data access key; S3, performing a point multiplication operation on the identity authority key and the data access key to generate a decryption request key; S4, the decryption request key obtains the corresponding data decryption key from the decryption key data management library; S5, the data decryption key decrypts the corresponding data; S6, a hash function verifies whether the file has been tampered with; S7, the mobile data storage device outputs the target data. In the present invention, the identity authority key can be generated only after identity authentication, the data decryption key corresponding to the access data type is decrypted from the decryption key data management library through the decryption request key, and the data decryption key is then decrypted, which increases the difficulty of decryption, thereby improving data security.

Description

Technical Field

[0001] The present invention relates to the technical field of data decryption methods, and in particular to a data decryption method for a mobile data storage device. Background Art

[0002] The data message stored in the mobile data storage device is called plain text. The process of disguising data information by some method to hide its content is called encryption. The encrypted data information is called cipher text, and the process of converting cipher text into plain text is called decryption. When viewing the encrypted data information in the mobile data storage device, the encrypted data information needs to be decrypted first, so a data decryption method for the mobile data storage device is needed.

[0003] The defects of existing data decryption methods are:

[0004] 1. Application document WO2023066212A1 discloses a network device and a data decryption method. In the network device decryption method of the document, the hardware encryption and decryption component is used to obtain the root key plaintext from the OTP storage area, and decrypt the ciphertext by the root key plaintext to obtain the plaintext. However, the decryption method of the document has a low difficulty in obtaining the target data, and the data security is low;

[0005] 2. Patent document KR100666285B1 proposes a data decryption device and a data decryption method. The decryption method of the patent document can access the row data before and after the memory, but the decryption method of the patent document does not consider controlling the viewing of the data in the memory by setting strict permission control management;

[0006] 3. Application document WO2019141113A1 discloses a data decryption method, device and electronic device. The patent document does not take into account the identity authentication of the user of the data storage device. If the data storage device is lost, other people can open the data storage device at will to view the data;

[0007] 4. Application document JP2005260374A proposes a memory card, a data encryption method and a data decryption method. The patent document uses key data to encrypt data stored in a transmission rate encryption area of ​​a user data area. However, the patent document does not consider the problem of classifying and encrypting the stored data and verifying the originality of the data before outputting the plain text. Summary of the invention

[0008] The object of the present invention is to provide a data decryption method for a mobile data storage device to solve the problems raised in the above background technology.

[0009] To achieve the above object, the present invention provides the following technical solution: a data decryption method for a mobile data storage device, the data decryption method comprising the following steps:

[0010] S1. The mobile data storage device verifies the user's identity, assigns corresponding access rights, and generates a corresponding identity authority key according to the user's identity;

[0011] S2, reading the user's data access request instruction, determining the type of data in the encrypted database accessed by the user, and generating a data access key;

[0012] S3, perform a point multiplication operation on the user's identity authority key and the data access key to generate a decryption request key;

[0013] S4. The decryption request key can obtain the data decryption key corresponding to the user access data type from the decryption key data management library;

[0014] S5. Use the data decryption key to decrypt the corresponding data in the encrypted database to obtain the target data;

[0015] S6. Perform a hash operation on the target data using the SHA-256 hash function, and compare the hash value generated by the SHA-256 hash function with the pre-calculated hash value to determine whether the file has been tampered with;

[0016] S7. After confirming that the target data has not been tampered with, the mobile data storage device outputs the target data.

[0017] Preferably, in step S1, the method for verifying the identity of the user includes an identity card recognition unit and a biometric recognition unit. The identity card recognition unit recognizes the RFID tag on the user's identity badge through RFID technology to obtain the user's identity information. The biometric recognition unit includes one or more of face recognition, voice recognition, fingerprint recognition and iris recognition.

[0018] Preferably, in step S1, the user identity is verified by two identity verification methods: an identity card recognition unit and a biometric recognition unit.

[0019] Preferably, in step S1, the method for managing access rights includes: simplifying permission management by creating and managing database roles, assigning users of the same position to a role according to their different positions, and assigning different permissions to different roles, and dividing the permission levels into administrator level, user level and visitor level, and the administrator level has the highest authority.

[0020] Preferably, the identity authority key corresponds the identity information to the job role based on the identified identity information, and corresponds the user's job role to the identity authority key of the specific role according to the access permission management method.

[0021] Preferably, in step S2, the data stored in the encrypted database is classified according to data structure relationships, and the classified data is encrypted according to categories.

[0022] Preferably, in step S2, the data access request instruction issued by the user generates a data access key of a corresponding number of characters according to a preset algorithm, and the number of characters of the data access key and the identity authority key are the same.

[0023] Preferably, in step S4, the decryption key data management library stores the data decryption key to be decrypted.

[0024] Preferably, in step S4, the decryption key data management library records the correspondence between the decryption request key and the data decryption key, and the decryption request key performs a decryption operation on the data decryption key to be decrypted in the decryption key data management library, and finally obtains the data decryption key corresponding to the decryption request key.

[0025] Preferably, in step S6, the SHA-256 hash function can convert target data of any length into a hash value of fixed length, and analyze and compare the generated hash value of fixed length with the hash value calculated in advance based on the stored data to track minor changes in the data.

[0026] Compared with the prior art, the present invention has the following beneficial effects:

[0027] 1. The present invention generates an identity authority key only after identity authentication, and uses a decryption request key generated by multiplying the identity authority key generated after verifying the identity of the user and the data access key as a decryption method to obtain a data decryption key corresponding to the user's access data type from a decryption key data management library, and then uses the obtained data decryption key to decrypt the target data, thereby increasing the difficulty of decrypting the target data and thus improving the data security of the mobile data storage device.

[0028] 2. The decryption request key in the present invention is calculated by the joint action of identity authority keys with different authorities and different types of data access keys, so that the decryption request key can help users view the encrypted data content under their identity authority according to the different identity authorities of the users. At the same time, users cannot view data outside their authority, which improves the ability of the mobile data storage device to strictly control and manage data authority.

[0029] 3. The present invention verifies the user's identity information through two different identity authentication methods, an identity card recognition unit and a biometric recognition unit, to ensure that the user's identity can view the data information on the mobile data storage device, avoiding the situation where the data is accessed after the identity card is lost and picked up by others, thereby effectively improving data security to a certain extent.

[0030] 4. The present invention encrypts the data stored in the mobile storage device by classification, so that different data require corresponding different decryption keys. When decrypting one type of data, the security of other types of data is not affected. At the same time, the present invention verifies the decrypted data through the SHA-256 hash function to ensure that the decrypted data has not been tampered with by attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 The figure is a flow chart of the method of the present invention. DETAILED DESCRIPTION

[0032] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0033] The following combination Figure 1 , the technical solution of the present invention is further explained:

[0034] Embodiment 1

[0035] The embodiment provided by the present invention is a method for decrypting data in a mobile data storage device, comprising the following steps:

[0036] S1. The mobile data storage device identifies the user's identity card. The identity card identification unit uses RFID technology to send out radio waves to activate the RFID tag on the user's identity badge and read the user's identity information. After the user passes the identity card identification unit, the biometric identification unit is also required to verify his or her identity. The biometric identification unit of the mobile data storage device confirms the user's identity through face recognition technology. If the face recognition fails, the identity is confirmed through one of voice recognition, fingerprint recognition and iris recognition. If the user cannot pass the identity authentication of the biometric identification unit after passing the identity card identification unit, the user cannot be assigned a user-level authority level, and the identity authority key with the corresponding number of characters cannot be generated.

[0037] Embodiment 2

[0038] An embodiment of the present invention provides a method for decrypting data in a mobile data storage device, comprising the following steps:

[0039] S1. The mobile data storage device identifies the user's ID card. The ID card identification unit uses RFID technology to send out radio waves to activate the RFID tag on the user's ID badge and read the user's identity information. After the user passes the ID card identification unit, the biometric identification unit is also required to verify his identity. The biometric identification unit of the mobile data storage device confirms the user's identity through face recognition technology, combines the identification results of the ID card identification unit and the biometric identification unit, checks the user's identity information, and after verifying the user's identity information, assigns a role according to the user's position information through the access rights management method, assigns a visitor-level permission level to the user, and generates an identity permission key with a corresponding number of characters according to a preset algorithm;

[0040] S2. Read the user's data access request instruction, classify the data in the encrypted database according to the relationship between the data structures, encrypt the classified data according to the categories, determine the type of data the user wants to access, and generate a data access key with the same number of characters as the identity authority key according to the type of data the user wants to access;

[0041] S3, performing a dot multiplication operation on the user's identity authority key and data access key with the same number of characters to generate a decryption request key;

[0042] S4. The decryption key for the data to be decrypted is stored in the decryption key data management library. The decryption key data management library records the correspondence between the decryption request key and the data decryption key. The decryption request key generated in step S3 can decrypt the data decryption key corresponding to the user access data type in the decryption key data management library. Because the visitor level has low authority, the decryption request key generated by the visitor level identity authority key and the data access key cannot decrypt the data decryption key corresponding to the user access data type.

[0043] Embodiment 3

[0044] An embodiment of the present invention provides a method for decrypting data in a mobile data storage device, comprising the following steps:

[0045] S1. The mobile data storage device identifies the user's identity card. The identity card identification unit uses RFID technology to send out radio waves to activate the RFID tag on the user's identity badge and read the user's identity information. After the user passes the identity card identification unit, the biometric identification unit is also required to verify his identity. The biometric identification unit of the mobile data storage device confirms the user's identity through face recognition technology, combines the identification results of the identity card identification unit and the biometric identification unit, checks the user's identity information, and after verifying the user's identity information, assigns a role according to the user's position information through the access rights management method, assigns a user-level authority level to the user, and generates an identity authority key with a corresponding number of characters according to a preset algorithm;

[0046] S2. Read the user's data access request instruction, classify the data in the encrypted database according to the relationship between the data structures, encrypt the classified data according to the categories, determine the type of data the user wants to access, and generate a data access key with the same number of characters as the identity authority key according to the type of data the user wants to access;

[0047] S3, performing a dot multiplication operation on the user's identity authority key and data access key with the same number of characters to generate a decryption request key;

[0048] S4. The decryption key data management library stores the data decryption key to be decrypted. The decryption key data management library records the correspondence between the decryption request key and the data decryption key. The decryption request key generated in step S3 can decrypt the data decryption key corresponding to the user access data type in the decryption key data management library. The user level authority can view limited data types. The decryption request key generated by the user level identity authority key and the data access key can decrypt the data decryption key corresponding to the user accessible data type, but cannot decrypt the data decryption key corresponding to the user inaccessible data type.

[0049] S5. If the data decryption key is not decrypted in the above step S4, the corresponding data in the encrypted database cannot be decrypted. If the data decryption key is decrypted in the above step S3, the decrypted data decryption key is used to decrypt the corresponding data in the encrypted database to obtain the target data.

[0050] S6. Perform a hash operation on the acquired target data using the SHA-256 hash function, and compare the hash value generated by the SHA-256 hash function with the pre-calculated hash value to determine whether the file has been tampered with;

[0051] S7. After confirming that the target data has not been tampered with, the mobile data storage device outputs the target data.

[0052] Embodiment 4

[0053] An embodiment of the present invention provides a method for decrypting data in a mobile data storage device, comprising the following steps:

[0054] S1. The mobile data storage device identifies the user's identity card. The identity card identification unit uses RFID technology to send out radio waves to activate the RFID tag on the user's identity badge and read the user's identity information. After the user passes the identity card identification unit, the biometric identification unit is also required to verify his identity. The biometric identification unit of the mobile data storage device confirms the user's identity through fingerprint recognition technology, combines the identification results of the identity card identification unit and the biometric identification unit, checks the user's identity information, and after verifying the user's identity information, assigns a role according to the user's position information through the access rights management method, assigns a manager-level authority level to the user, and generates an identity authority key with a corresponding number of characters according to a preset algorithm;

[0055] S2. Read the user's data access request instruction, classify the data in the encrypted database according to the relationship between the data structures, encrypt the classified data according to the categories, determine the type of data the user wants to access, and generate a data access key with the same number of characters as the identity authority key according to the type of data the user wants to access;

[0056] S3, performing a dot multiplication operation on the user's identity authority key and data access key with the same number of characters to generate a decryption request key;

[0057] S4. The decryption key data management library stores the data decryption key to be decrypted. The decryption key data management library records the correspondence between the decryption request key and the data decryption key. The decryption request key generated in step S3 can decrypt the data decryption key corresponding to the user access data type in the decryption key data management library. The administrator-level authority can view all data types in the encrypted database. The decryption request key generated by the administrator-level identity authority key and the data access key can decrypt the data decryption key corresponding to the user accessible data type.

[0058] S5. Use the data decryption key to decrypt the corresponding data in the encrypted database to obtain the target data;

[0059] S6. Perform a hash operation on the target data using the SHA-256 hash function, and compare the hash value generated by the SHA-256 hash function with the pre-calculated hash value to determine whether the file has been tampered with;

[0060] S7. After confirming that the target data has not been tampered with, the mobile data storage device outputs the target data.

[0061] Embodiment 5

[0062] An embodiment of the present invention provides a method for decrypting data in a mobile data storage device, comprising the following steps:

[0063] S1. The mobile data storage device identifies the user's identity card. The identity card identification unit uses RFID technology to send out radio waves to activate the RFID tag on the user's identity badge and read the user's identity information. After the user passes the identity card identification unit, the biometric identification unit is also required to verify his identity. The biometric identification unit of the mobile data storage device confirms the user's identity through face recognition technology. If the face recognition fails, the identity is confirmed by one of voice recognition, fingerprint recognition and iris recognition. The identification results of the identity card identification unit and the biometric identification unit are combined to check the user's identity information. After verifying the user's identity information, the user's role is assigned according to the user's position information through the access rights management method, and the user's level of authority is assigned to the user, and an identity authority key with a corresponding number of characters is generated according to a preset algorithm;

[0064] S2. Read the user's data access request instruction, classify the data in the encrypted database according to the relationship between the data structures, encrypt the classified data according to the categories, determine the type of data the user wants to access, and generate a data access key with the same number of characters as the identity authority key according to the type of data the user wants to access;

[0065] S3, performing a dot multiplication operation on the user's identity authority key and data access key with the same number of characters to generate a decryption request key;

[0066] S4. The decryption key data management library stores the data decryption key to be decrypted. The decryption key data management library records the correspondence between the decryption request key and the data decryption key. The decryption request key generated in step S3 can decrypt the data decryption key corresponding to the user access data type in the decryption key data management library. The user level authority can view limited data types. The decryption request key generated by the user level identity authority key and the data access key can decrypt the data decryption key corresponding to the user accessible data type, but cannot decrypt the data decryption key corresponding to the user inaccessible data type.

[0067] S5. If the data decryption key is not decrypted in the above step S4, the corresponding data in the encrypted database cannot be decrypted. If the data decryption key is decrypted in the above step S3, the decrypted data decryption key is used to decrypt the corresponding data in the encrypted database to obtain the target data.

[0068] S6. Perform a hash operation on the acquired target data using the SHA-256 hash function, and compare the hash value generated by the SHA-256 hash function with the pre-calculated hash value to determine whether the file has been tampered with;

[0069] S7. After confirming that the target data has not been tampered with, the mobile data storage device outputs the target data.

[0070] It will be apparent to those skilled in the art that the invention is not limited to the details of the exemplary embodiments described above and that the invention can be implemented in other specific forms without departing from the spirit or essential features of the invention. Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description, and it is intended that all variations falling within the meaning and scope of the equivalent elements of the claims be included in the invention. Any reference numeral in a claim should not be considered as limiting the claim to which it relates.

Claims

1. A data decryption method for a mobile data storage device, characterized in that: The data decryption method comprises the following steps: S1. The mobile data storage device verifies the user's identity, assigns corresponding access rights, and generates a corresponding identity authority key according to the user's identity; S2, reading the user's data access request instruction, determining the type of data the user accesses in the encrypted database, and generating a data access key; S3, perform a point multiplication operation on the user's identity authority key and the data access key to generate a decryption request key; S4. The decryption request key can obtain the data decryption key corresponding to the user access data type from the decryption key data management library; S5. Use the data decryption key to decrypt the corresponding data in the encrypted database to obtain the target data; S6. Perform a hash operation on the target data using the SHA-256 hash function, and compare the hash value generated by the SHA-256 hash function with the pre-calculated hash value to determine whether the file has been tampered with; S7. After confirming that the target data has not been tampered with, the mobile data storage device outputs the target data.

2. The data decryption method of a mobile data storage device according to claim 1, characterized in that: In step S1, the method for verifying the identity of the user includes an identity card recognition unit and a biometric recognition unit. The identity card recognition unit recognizes the RFID tag on the user's identity badge through RFID technology to obtain the user's identity information. The biometric recognition unit includes one or more of face recognition, voice recognition, fingerprint recognition and iris recognition.

3. The data decryption method of a mobile data storage device according to claim 2, characterized in that: In step S1, the user's identity is verified by two identity verification methods: an identity card recognition unit and a biometric recognition unit.

4. The data decryption method of a mobile data storage device according to claim 1, characterized in that: In step S1, the method for managing access rights includes: simplifying permission management by creating and managing database roles, assigning users of the same position to a role according to their different positions, and assigning different permissions to different roles. The permission levels are divided into administrator level, user level and visitor level, and the administrator level has the highest authority.

5. The data decryption method of a mobile data storage device according to claim 4, characterized in that: The identity authority key corresponds the identity information to the job role according to the identified identity information, and corresponds the user's job to the identity authority key of the specific role according to the access permission management method.

6. The data decryption method of a mobile data storage device according to claim 1, characterized in that: In step S2, the data stored in the encrypted database is classified according to the data structure relationship, and the classified data is encrypted according to the categories.

7. The data decryption method of a mobile data storage device according to claim 1, characterized in that: In step S2, the data access request instruction issued by the user generates a data access key with a corresponding number of characters according to a preset algorithm, and the number of characters in the data access key and the identity authority key are the same.

8. The data decryption method of a mobile data storage device according to claim 1, characterized in that: In step S4, the decryption key data management library stores the data decryption key to be decrypted.

9. The data decryption method of a mobile data storage device according to claim 1, characterized in that: In step S4, the decryption key data management library records the correspondence between the decryption request key and the data decryption key. The decryption request key decrypts the data decryption key to be decrypted in the decryption key data management library, and finally obtains the data decryption key corresponding to the decryption request key.

10. The data decryption method of a mobile data storage device according to claim 1, characterized in that: In step S6, the SHA-256 hash function can convert target data of any length into a hash value of fixed length, and analyze and compare the generated fixed-length hash value with the hash value calculated in advance based on the stored data to track minor changes in the data.

Images