Data security processing method and apparatus

Abstract

The present disclosure provides a data security processing method and device, and relates to the technical field of data security processing. The method comprises the following steps: receiving a data request message sent by a second terminal device, and obtaining a public key of a target object and a device identifier of a first terminal device; the data request message carries an evaluation total value and a device identifier of the second terminal device; determining whether the evaluation total value is within a preset range; if the evaluation total value is within the preset range, determining to-be-processed data based on the data request message; encrypting the to-be-processed data multiple times based on the device identifier of the first terminal device, the device identifier of the second terminal device, the evaluation total value and the public key, and sending the encrypted to-be-processed data to the second terminal device. The present disclosure realizes flexible changes of the key, and makes the changes of the key closely related to the current behavior of the target object, reduces the possibility of cracking the key, and improves the security of data transmission.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of data security processing, and particularly relates to a data security processing method and device. BACKGROUND

[0002] In the related art, when data security processing is performed, it is determined whether the identity authentication information input by a target object is consistent with the pre-stored information. If the information is consistent, the authentication is passed, and if the information is inconsistent, the authentication is not passed. However, in actual scenarios, there may be a case where the identity authentication information is correct but not the real user (for example, the identity authentication information is input by a stolen device after being stolen, at this time, although the information is correct, it is not the real user, or, it is input correctly after multiple trials, at this time, although it is correct, it is not the real user). In addition, in the existing scheme, a pre-allocated key (such as a certificate authority CA allocated key) is used to implement data transmission encryption and decryption, and the key can be cracked through multiple attempts.

[0003] Therefore, how to improve the security of data processing and improve the flexibility of data security processing has become one of the important research directions. SUMMARY

[0004] The present disclosure aims to at least solve one of the technical problems in the related art. The first aspect of the present disclosure provides a data security processing method, comprising:

[0005] receiving a data request message sent by a second terminal device, and obtaining a public key of a target object and a device identifier of a first terminal device, the data request message carrying an evaluation total value and a device identifier of the second terminal device;

[0006] determining whether the evaluation total value is within a preset range, and if the evaluation total value is within the preset range, determining to-be-processed data based on the data request message;

[0007] encrypting the to-be-processed data multiple times based on the device identifier of the first terminal device, the device identifier of the second terminal device, the evaluation total value, and the public key, and sending the encrypted to-be-processed data to the second terminal device.

[0008] In the embodiments of the present disclosure, the total evaluation value of the current visitor is obtained based on the input condition of the identity authentication information, whether the current visitor has abnormal behavior is evaluated, and then whether data access can be performed is judged, so that in the case of correct input of the identity authentication information, whether the target object is a real user is verified through the total evaluation value, and if it is a real user, data access is performed. In addition, the key is flexible and changes, and the change is based on the currently input identity authentication information. Not only the flexible change of the key is realized, but also the change of the key is closely related to the current behavior of the target object, the possibility of cracking the key is reduced, and the problem that the data security processing effect is not good caused by the key obtained after multiple trials or the key stolen through other channels is avoided.

[0009] The second aspect of the embodiments of the present disclosure provides a data security processing method, comprising:

[0010] obtaining reference identity authentication information, candidate identity authentication information input by a target object, and time information corresponding to the candidate identity authentication information;

[0011] obtaining a plurality of evaluation values based on the reference identity authentication information, the candidate identity authentication information, and the time information, and obtaining a total evaluation value based on the plurality of evaluation values;

[0012] generating a data request message based on the total evaluation value and a device identifier of the second terminal device, and sending the data request message to the first terminal device to instruct the first terminal device to send the to-be-processed data to the second terminal device;

[0013] receiving the to-be-processed data sent by the first terminal device, and decrypting the to-be-processed data based on the device identifier and the total evaluation value to obtain target data.

[0014] In the embodiments of the present disclosure, for the encryption and decryption scheme, the total evaluation value obtained during identity authentication is not simply implemented by a private key and a public key, but the key for each encryption is flexibly determined, and the data is decrypted multiple times. Not only the flexible change of the key is realized, but also the change of the key is closely related to the current behavior of the target object, the possibility of cracking the key is reduced, and the security of data transmission is improved.

[0015] The third aspect of the embodiments of the present disclosure provides a data security processing device, comprising:

[0016] The obtaining module is configured to receive a data request message sent by a second terminal device, and obtain a public key of a target object and a device identifier of a first terminal device. The data request message carries a total evaluation value and a device identifier of the second terminal device.

[0017] The determining module is configured to determine whether the total evaluation value is within a preset range, and determine the to-be-processed data based on the data request message if the total evaluation value is within the preset range.

[0018] The processing module is configured to encrypt the to-be-processed data multiple times based on the device identifier of the first terminal device, the device identifier of the second terminal device, the total evaluation value, and the public key, and send the encrypted to-be-processed data to the second terminal device.

[0019] The fourth aspect of the present disclosure provides a data security processing device, comprising:

[0020] The first obtaining module is configured to obtain reference identity authentication information, candidate identity authentication information input by a target object, and time information corresponding to the candidate identity authentication information.

[0021] The second obtaining module is configured to obtain a plurality of evaluation values based on the reference identity authentication information, the candidate identity authentication information, and the time information, and obtain a total evaluation value based on the plurality of evaluation values.

[0022] The first processing module is configured to generate a data request message based on the total evaluation value and the device identifier of the second terminal device, and send the data request message to the first terminal device to instruct the first terminal device to send to-be-processed data to the second terminal device.

[0023] The second processing module is configured to receive the to-be-processed data sent by the first terminal device, and decrypt the to-be-processed data based on the device identifier and the total evaluation value to obtain target data.

[0024] The fifth aspect of the present disclosure provides an electronic device, comprising:

[0025] at least one processor; and

[0026] a memory in communication with the at least one processor; wherein

[0027] The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the data security processing method provided in the first aspect of the present disclosure, or execute the data security processing method provided in the second aspect of the present disclosure.

[0028] The sixth aspect of the present disclosure provides a computer readable storage medium having computer instructions stored thereon, wherein the computer instructions are used to make a computer execute the data security processing method according to the first aspect of the present disclosure, or execute the data security processing method according to the second aspect of the present disclosure.

[0029] The seventh aspect of the present disclosure provides a computer program product comprising a computer program which, when executed by a processor, implements the data security processing method provided in the first aspect of the present disclosure or the data security processing method provided in the second aspect of the present disclosure. BRIEF DESCRIPTION OF DRAWINGS

[0030] Figure 1 is a flowchart of a data security processing method according to an embodiment of the present disclosure;

[0031] Figure 2 is a flowchart of a data security processing method according to an embodiment of the present disclosure;

[0032] Figure 3 is a flowchart of a data security processing method according to an embodiment of the present disclosure;

[0033] Figure 4 is a flowchart of a data security processing method according to an embodiment of the present disclosure;

[0034] Figure 5 is a structural diagram of a data security processing system according to an embodiment of the present disclosure;

[0035] Figure 6 is a structural block diagram of a data security processing apparatus according to an embodiment of the present disclosure;

[0036] Figure 7 is a structural block diagram of a data security processing apparatus according to an embodiment of the present disclosure;

[0037] Figure 8 is a structural diagram of an electronic device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0038] Embodiments of the present disclosure are described in detail below with reference to the accompanying drawings, examples of which are shown in the drawings, wherein the same or similar notations represent the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to explain the present disclosure, and cannot be understood as a limitation of the present disclosure.

[0039] For ease of understanding, the terms in the embodiments of the present disclosure are explained as follows:

[0040] Unicode is an industry standard in the field of computer science, including character sets, encoding schemes, etc. Unicode is produced to solve the limitations of traditional character encoding schemes, and it sets a unified and unique binary code for each character in each language to meet the requirements of text conversion and processing across languages and platforms. Therefore, each character has a corresponding Unicode code.

[0041] The data security processing method and apparatus of the embodiments of the present disclosure are described below with reference to the drawings.

[0042] Figure 1 FIG. 1 is a flowchart of a data security processing method according to an embodiment of the present disclosure. Figure 1 The method is performed by a first terminal device and includes the following steps.

[0043] S101, receiving a data request message sent by a second terminal device, and obtaining a public key of a target object, a device identifier of the first terminal device, the data request message carrying an evaluation total value and a device identifier of the second terminal device.

[0044] In some embodiments, the data request message carries the public key of the target object.

[0045] In some embodiments, the second terminal device broadcasts the public key of the target object, and the first terminal device obtains the public key of the target object based on the broadcast of the second terminal device.

[0046] S102, determining whether the evaluation total value is within a preset range, and if the evaluation total value is within the preset range, determining to-be-processed data based on the data request message.

[0047] In some embodiments, according to the evaluation total value, it is determined whether the target object can access the to-be-processed data, if the evaluation total value is within the preset range, the target object can access the to-be-processed data, and if the evaluation total value is not within the preset range, the target object is denied to access the to-be-processed data.

[0048] This step does not determine whether the data processing operation can be performed after the identity authentication information is correct, but further verifies whether the target object is a real user through the evaluation total value, and if the target object is a real user, the data processing is performed.

[0049] Optionally, in the embodiments of the present disclosure, the lower the evaluation total value, the greater the gap between the current target object and the normal user, indicating that the access behavior is less normal, and it is possible that the cracking behavior is a high-frequency attack. Therefore, an experience threshold value (such as an abnormal standard value of a normal user learned through a large number of samples) can be set, and if the evaluation total value is higher than the experience threshold value, it is determined that the evaluation total value is within the preset range.

[0050] In the embodiments of the present disclosure, the first terminal device is a device where the to-be-processed data is located, and the to-be-processed data can be obtained based on the data request message.

[0051] S103, encrypting the to-be-processed data multiple times based on the device identifier of the first terminal device, the device identifier of the second terminal device, the evaluation total value, and the public key, and sending the encrypted to-be-processed data to the second terminal device.

[0052] In the embodiments of the present disclosure, the encryption key of data transmission is not fixed but flexible and changes according to the evaluation total value, so that the encryption key of different target objects is different, and the encryption key of the same target object is different each time, and the dynamic encryption of one-time-one-key is realized.

[0053] For example, in the embodiments of the present disclosure, the encryption key is obtained based on the device identifier of the first terminal device, the device identifier of the second terminal device and the evaluation total value to encrypt the to-be-processed data for the first time, the to-be-processed data is encrypted for the second time based on the public key of the target object, and the to-be-processed data encrypted for the two times is sent to the second terminal device.

[0054] In the embodiments of the present disclosure, the evaluation total value of the current visitor is obtained based on the input condition of the identity authentication information, whether the current visitor has behavior anomaly is evaluated, and whether the data access can be performed is judged, so that if the identity authentication information is correctly input, whether the target object is a real user is verified by the evaluation total value, and if the target object is a real user, the data access is performed. In addition, the encryption key is flexible and changes, and the change is based on the currently input identity authentication information, so that the flexible change of the encryption key is realized, and the change of the encryption key is closely related to the current behavior of the target object, the possibility of cracking the encryption key is reduced, and the problem that the data security processing effect is not good due to the encryption key obtained through multiple tests or the encryption key stolen through other channels is avoided.

[0055] Figure 2 FIG. 1 is a flowchart of a data security processing method according to an embodiment of the present disclosure, as shown in the figure, the method is executed by a first terminal device, and includes the following steps: Figure 2

[0056] S201, receiving a data request message sent by a second terminal device, and obtaining a public key of a target object and a device identifier of the first terminal device, the data request message carrying an evaluation total value and a device identifier of the second terminal device.

[0057] S202, judging whether the evaluation total value is in a preset range, if the evaluation total value is in the preset range, determining to-be-processed data based on the data request message.

[0058] The description of steps S201 to S202 can be referred to the related content in the above embodiments, and will not be described here.

[0059] S203, obtaining an encryption key based on the device identifier of the first terminal device, the device identifier of the second terminal device and the evaluation total value.

[0060] The device identifier in the embodiments of the present disclosure can be an Internet Protocol (IP) address, a Media Access Control (MAC) address or other unique identifier. ​

[0061] The device identifier of the first terminal device and the device identifier of the second terminal device are merged to obtain a fused device identifier. For example, if the device identifier of the first terminal device is ABC and the device identifier of the second terminal device is DEF, the fused device identifier can be ABCDEF. In other embodiments, the fused device identifier can be obtained based on a preset connection symbol. The connection symbol can be “+” or “-”, for example. In this case, the fused device identifier can be ABC+DEF or ABC-DEF. The first hash value H1 of the fused device identifier and the second hash value H2 of the evaluation total value are obtained respectively, and the exclusive or value of the first hash value and the second hash value is used as the encryption key.

[0062] In S204, the first encryption is performed on the to-be-processed data based on the encryption key, and the second encryption is performed on the to-be-processed data based on the public key.

[0063] The first encryption is performed on the to-be-processed data based on the encryption key, and the second encryption is performed on the data based on the public key of the target object. The to-be-processed data after the two encryptions is the encrypted to-be-processed data that needs to be sent.

[0064] In S205, the encrypted to-be-processed data is sent to the second terminal device.

[0065] In some embodiments, to prevent the data from being tampered with, the digest of the to-be-processed data can be encrypted based on the public key of the target object to obtain a signature. The signature and the encrypted to-be-processed data are both sent to the second terminal device. At this time, there are two pieces of data transmitted, one is the final encrypted to-be-processed data, and the other is the signature.

[0066] Through the two encryption behaviors, and the upper layer is asymmetric encryption, the cracking difficulty is improved. The decrypted data is also encrypted data at a single time. At this time, the encryption key is also dynamically changing and has no regularity, which increases the security of data transmission.

[0067] In S206, if the evaluation total value is not in the preset range, the to-be-processed data is not sent, or a destructive encryption algorithm is adopted to perform destructive processing on the to-be-processed data during the encryption processing, and the to-be-processed data after the destructive processing is sent to the second terminal device.

[0068] In some embodiments, if the evaluation total value is not in the preset range, the access of the target object is refused. If the evaluation total value is not in the preset range, it indicates that the access behavior is abnormal. Even if the identity authentication information is input correctly, it is considered that the data access cannot be performed, and the to-be-processed data is not sent.

[0069] In practice, two experience values can also be set, one for the correct input of identity authentication information, and the other for the case of incorrect input, so that the target object access control in the correct input case is more accurate.

[0070] On another level, if the total evaluation value is not within the preset range, the target object behavior is abnormal, a destructive encryption algorithm can be used to perform destructive processing such as "data deletion, obfuscated editing, formatted editing" on the encrypted data, so that the decrypted data after feedback or the decrypted non-original plaintext cannot be obtained.

[0071] For the encryption and decryption scheme, the private key and public key are not simply implemented in the embodiments of the present disclosure, but the key for each encryption is flexibly determined according to the total evaluation value obtained during identity authentication, and the data is finally encrypted through two-layer encryption, which not only realizes the flexible change of the key, but also makes the change of the key closely related to the current target object behavior, reduces the possibility of key cracking, avoids the situation of obtaining the key after multiple trials, reduces the problem that the data security processing effect is not good due to the key stolen through other channels, and improves the security of data transmission.

[0072] Figure 3 is a flowchart of a data security processing method according to an embodiment of the present disclosure, as shown in Figure 3 The method is executed by a second terminal device and includes the following steps:

[0073] S301, obtaining reference identity authentication information, candidate identity authentication information input by a target object, and time information corresponding to the candidate identity authentication information.

[0074] When the target object inputs the candidate identity authentication information (such as the target object B inputs the password), the behavior attribute of the target object B is listened to. Here, the target object can be the target object B or other target objects (users). If it is the target object B, it is the correct user. If it is other target objects, it can be a target object stealing data or an authorized other target object.

[0075] In addition, the candidate identity authentication information includes the keys triggered by the target object, the time information corresponding to the candidate identity authentication information is the input time of each key, and the reference identity authentication information is the preset correct identity authentication information.

[0076] S302, obtaining a plurality of evaluation values based on the reference identity authentication information, the candidate identity authentication information, and the time information, and obtaining a total evaluation value based on the plurality of evaluation values.

[0077] In some embodiments, taking the acquisition of three evaluation values as an example, the first encoding information of the candidate identity authentication information and the second encoding information of the reference identity authentication information can be respectively acquired based on a preset character encoding standard; the first evaluation value can be acquired based on the character length of the candidate identity authentication information and the character length of the reference identity authentication information; the second evaluation value can be acquired based on the similarity of each character in the first encoding information and the second encoding information; and the third evaluation value can be acquired based on the time information corresponding to the candidate identity authentication information.

[0078] In some embodiments, the evaluation total value can be acquired based on the sum of the weighted values of the plurality of evaluation values.

[0079] In some embodiments, the device where the to-be-processed data is located can be determined as the first terminal device, and the data request message can be sent to the first terminal device.

[0080] In some embodiments, the device where the to-be-processed data is located can be determined as the first terminal device, and the data request message can be sent to the first terminal device.

[0081] For example, the target object wants to acquire data stored in device A, and the first terminal device is device A. Here, the device information of the first terminal device can be information input by the target object, or can be determined according to a preset data processing requirement of the target object. If the target object explicitly indicates the storage location of the to-be-processed data, the device where the to-be-processed data is located can be provided by the target object. If the target object does not indicate the storage location of the to-be-processed data, each data storage device can be searched according to the data description information input by the target object, and finally the device where the data is located can be determined.

[0082] S304, receiving the to-be-processed data sent by the first terminal device, and decrypting the to-be-processed data based on the device identifier and the evaluation total value to obtain the target data.

[0083] The first terminal device sends the encrypted to-be-processed data to the second terminal device, the second terminal device receives the to-be-processed data sent by the first terminal device, and the to-be-processed data is decrypted multiple times based on the device identifier of the first terminal device, the device identifier of the second terminal device, the evaluation total value, and the public key of the target object to obtain the target data.

[0084] In the embodiments of the present disclosure, for the encryption and decryption scheme, the private key and the public key are not simply implemented, but the key for each encryption is flexibly determined according to the evaluation total value obtained during identity authentication, and the data is decrypted multiple times. Not only the flexibility of the key is realized, but also the change of the key is closely related to the current behavior of the target object, which reduces the possibility of cracking the key and improves the security of data transmission.

[0085] Figure 4 is a flowchart of a data security processing method of one embodiment of the present disclosure, as shown in the figure, the method is executed by a second terminal device, wherein, based on reference identity authentication information, candidate identity authentication information, time information, a plurality of evaluation values are obtained, including: Figure 4

[0086] S401, based on a preset character encoding standard, respectively obtaining first encoding information of the candidate identity authentication information, and second encoding information of the reference identity authentication information.

[0087] Wherein, the preset character encoding standard can be Unicode character encoding standard.

[0088] S402, based on the character length of the candidate identity authentication information and the character length of the reference identity authentication information, a first evaluation value is obtained.

[0089] According to the character length of the candidate identity authentication information and the character length of the reference identity authentication information, the first evaluation value is determined to evaluate whether there is information anomaly. Taking the identity authentication information as a password as an example, it is composed of a string of characters, for example, the candidate identity authentication information is "X1 number%", which is composed of 4 characters. The characters can be the same or different, and the character length is the number of characters.

[0090] Optionally, the first evaluation value can be obtained by using the following formula:

[0091]

[0092] Wherein, L SK (0) is the character length of the reference identity authentication information, L SK (1) is the character length of the candidate identity authentication information, C SK is the first evaluation value.

[0093] If the length is correct, then C SK =0, if the length is incorrect (long or short), then C SK ≠0, only in the case of correct length, the candidate identity authentication information is possible to be correct.

[0094] S403, based on the first encoding information and the second encoding information, a second evaluation value is obtained.

[0095] The second evaluation value is used to evaluate the identity authentication information similarity, in the embodiment of the present disclosure, the similarity of each character in the first encoding information and the second encoding information is obtained; the second evaluation value is obtained according to the average value of the similarity of each character.

[0096] ​In some embodiments, the similarity of each character in the first encoded information and the second encoded information is obtained by: traversing the characters in the first encoded information, if the i-th first character in the current traversal and the i-th second character in the second encoded information are the same, determining that the similarity of the i-th character is 1; if the first character is a preset abnormal symbol, determining that the similarity of the i-th character is 0; if the first character and the second character are not the same, and the first character is not a preset abnormal symbol, obtaining the similarity of the i-th character according to the character type and the character form of the first character and the second character.

[0097] In some embodiments, the similarity of the i-th character is obtained according to the character type and the character form of the first character and the second character, including: if the character type of the first character and the second character is the same, determining that the first similarity is 1, otherwise determining that the first similarity is 0; obtaining a first contour image of the first character, a second contour image of the second character, and a second similarity of the first contour image and the second contour image; and obtaining the similarity of the i-th character according to the average of the first similarity and the second similarity.

[0098] In some embodiments, one character of the candidate identity authentication information can be obtained in sequence, and the similarity of the character with the corresponding position character of the reference identity authentication information is calculated.

[0099] For example, for the i-th character, the Unicode code of the character is If the i-th character exists in the reference identity authentication information, the Unicode code of the character is determined as If the i-th character does not exist in the reference identity authentication information (i.e., the length of the input candidate identity authentication information is greater than the length of the reference identity authentication information), the Unicode code of the i-th character is determined as

[0100] Wherein, null is a null value, which can also be a pre-agreed abnormal value, as long as the abnormal value does not appear in the identity authentication information.

[0101] If The similarity of the i-th character is If The similarity of the i-th character is

[0102] In some embodiments, if And The character type similarity index is And the character form similarity index is The similarity of the i-th character is determined as

[0103] In the embodiments of the present disclosure, the second evaluation value is Wherein, Ab SKThe greater the value, the greater the similarity between the two strings.

[0104] Optionally, the character types are, for example, numbers, Chinese characters, letters, symbols, etc., each type corresponding to a Unicode code, for example, Chinese characters correspond to [4E00, 9FA5] (here, in hexadecimal), if the i-th character in the reference identity authentication information and the i-th character in the candidate identity authentication information are of the same type, then If not, then

[0105] Optionally, the i-th character in the candidate identity authentication information and the i-th character in the reference identity authentication information are formed into contour images (the envelope image can be used as the contour image), the similarity of the two contour images is compared, and the similarity is The more similar the two characters The greater the value.

[0106] S404, obtaining a third evaluation value based on the time information.

[0107] In the embodiments of the present disclosure, the third evaluation value is used to evaluate whether the speed of the target object inputting the candidate identity authentication information is abnormal.

[0108] In some embodiments, the input time of each key can be arranged from far to near in time to form a time queue, the difference between the adjacent two values in the queue is calculated to form a time difference queue.

[0109] Optionally, the time difference can be the difference between the latter time value and the former time value in the queue, and for the last time value, since it has no latter time value, the difference of the time value is not calculated. For example, if the time queue has 5 time values, the time difference queue has 4 time difference values.

[0110] The difference between the last time value and the first time value in the time queue is calculated, which is denoted as ΔT, and the standard deviation σ of all values in the time difference queue is calculated Δ , and the third evaluation value Sp is obtained by using the following formula SK :

[0111]

[0112] The value represents the input time length of each character in the entire string. Since the target object has different thinking, recalling, and input device usage, the value of each target object is different. The input value of a sample target object can be collected and averaged to obtain an average time length of each character of a sample target object, and the time length is ​It can be known that the current target object and the sample target object are different, the smaller the value is, the more abnormal the input speed is, and it is possible that the high-frequency attack cracking behavior. Sigma Δ The time difference between the input of the characters by the target object is represented, the larger the value is, the more uneven the input time of the target object is, and the average input time of the target object fluctuates due to thinking and other behaviors, therefore, the smaller the sigma Δ is, the more possible the high-frequency attack cracking behavior is.

[0113] In some embodiments, the evaluation total value Ex U may be obtained by using the following formula:

[0114] If C SK ≠ 0, then

[0115] If C SK = 0, then

[0116] The smaller the Ex U is, the more abnormal the candidate identity information is.

[0117] If the input candidate identity authentication information is correct (the same as the reference identity information), the Ex U is not necessarily a fixed value, because the candidate identity authentication information input is correct, then only C SK = 0, Ab SK = 1 can be guaranteed, but the value of Sp SK cannot be guaranteed to be a fixed value, because the input of the target object is different, the value of Sp SK is different, and therefore the Ex U is also different, therefore, through the Ex U value, it can also be reflected whether the target object is the identity authentication information obtained after multiple trials or the identity authentication information stolen through other channels under the premise that the identity authentication information is correct.

[0118] In the embodiments of the present disclosure, the similarity of the candidate identity authentication information and the reference identity information is determined by the similarity of the type and form of the candidate identity authentication information and the reference identity information, the evaluation total value is determined based on the similarity, and the flexibility of data security processing can be improved.

[0119] Figure 5 is a flowchart of a data security processing method of one embodiment of the present disclosure, as Figure 5 shown, the method is executed by a second terminal device, and includes the following steps:

[0120] S501, obtaining reference identity authentication information, candidate identity authentication information input by a target object, and time information corresponding to the candidate identity authentication information.

[0121] S502, obtain a plurality of evaluation values based on the reference identity authentication information, the candidate identity authentication information, and the time information, and obtain an evaluation total value based on the plurality of evaluation values.

[0122] S503, generate a data request message based on the evaluation total value and the device identifier of the second terminal device, and send the data request message to the first terminal device to instruct the first terminal device to send the to-be-processed data to the second terminal device.

[0123] S504, receive the to-be-processed data sent by the first terminal device.

[0124] For the description of steps S501-S504, refer to the related content in the above embodiments.

[0125] S505, perform first decryption on the to-be-processed data based on the private key of the target object.

[0126] Obtain the private key of the target object, and perform first decryption on the to-be-processed data based on the private key of the target object.

[0127] S506, obtain an encryption key based on the device identifier of the first terminal device, the device identifier of the second terminal device, and the evaluation total value.

[0128] The device identifier in the embodiments of the present disclosure can be an Internet Protocol (IP) address, a Media Access Control (MAC) address, or other unique identifiers.

[0129] The device identifier of the first terminal device and the device identifier of the second terminal device are merged to obtain a fused device identifier. For example, if the device identifier of the first terminal device is ABC and the device identifier of the second terminal device is DEF, the fused device identifier can be ABCDEF. In other embodiments, the fused device identifier can be obtained based on a preset connection symbol, such as "+" or "-". In this case, the fused device identifier can be ABC+DEF or ABC-DEF. The present disclosure does not limit this. A first hash value H1 of the fused device identifier and a second hash value H2 of the evaluation total value are obtained, and the exclusive OR value of the first hash value and the second hash value is used as the encryption key.

[0130] S507, perform second decryption on the to-be-processed data based on the encryption key to obtain target data.

[0131] The process of decrypting the received to-be-processed data by the private key and the encryption key performed by the second terminal device is the inverse process of the encryption process of the first terminal device described above, and the present disclosure does not repeat the description.

[0132] In some embodiments, a first digest is generated based on the target data, and a private key of the target object is obtained. A signature sent by the second terminal device is received, and the signature is decrypted based on the private key to obtain a second digest. If the first digest and the second digest are the same, it is determined that the target data has not been tampered with.

[0133] That is, a digest is generated based on the to-be-processed data, and finally the digest is obtained by decrypting the signature based on the private key of the target object. If the generated digest and the decrypted digest are the same, it indicates that the data has not been tampered with in the middle, and the security processing of the to-be-processed data is completed. If the generated digest and the decrypted digest are not the same, it indicates that the data may be tampered with, and a security warning is performed.

[0134] Since the evaluation total value used at this time is calculated by the second terminal device, retransmission of the evaluation total value is not involved, the risk of leakage of the decryption key is reduced, and the data security is improved.

[0135] Through the scheme of the present application, the data security management platform performs security processing on the network-wide data collected by the data security management platform, so that whether the target object is an abnormal target object is verified through the evaluation total value, and if it is a real user, the data is decrypted, realizing centralized management and control of the network-wide data security strategy.

[0136] Figure 6 is a structural diagram of a data security processing apparatus according to one embodiment of the present disclosure, as shown in Figure 6 The data security processing apparatus 600 includes:

[0137] The obtaining module 610 is configured to receive a data request message sent by the second terminal device, and obtain a public key of the target object and a device identifier of the first terminal device. The data request message carries an evaluation total value and a device identifier of the second terminal device.

[0138] The determining module 620 is configured to determine whether the evaluation total value is within a preset range. If the evaluation total value is within the preset range, the to-be-processed data is determined based on the data request message.

[0139] The processing module 630 is configured to encrypt the to-be-processed data multiple times based on the device identifier of the first terminal device, the device identifier of the second terminal device, the evaluation total value, and the public key, and send the encrypted to-be-processed data to the second terminal device.

[0140] In some embodiments, the processing module 630 is further configured to:

[0141] If the evaluation total value is not within the preset range, the to-be-processed data is not sent, or a destructive encryption algorithm is adopted to perform destructive processing on the to-be-processed data during encryption processing, and the to-be-processed data after the destructive processing is sent to the second terminal device.

[0142] In some embodiments, the processing module 630 is further configured to:

[0143] obtain an encryption key based on the device identifier of the first terminal device, the device identifier of the second terminal device, and the total evaluation value;

[0144] perform first encryption on the to-be-processed data based on the encryption key, and perform second encryption on the to-be-processed data based on the public key.

[0145] In some embodiments, the processing module 630 is further configured to:

[0146] merge the device identifier of the first terminal device and the device identifier of the second terminal device to obtain a fused device identifier;

[0147] obtain a first hash value of the fused device identifier and a second hash value of the total evaluation value, respectively;

[0148] use an exclusive or value of the first hash value and the second hash value as the encryption key.

[0149] In some embodiments, the processing module 630 is further configured to:

[0150] perform encryption on a digest of the to-be-processed data based on the public key to obtain a signature;

[0151] send the signature to the second terminal device.

[0152] In the embodiments of the present disclosure, the total evaluation value of the current visitor is obtained based on the input condition of the identity authentication information, whether the current visitor has abnormal behavior is evaluated, and then whether data access can be performed is judged, so that if the identity authentication information is correctly input, it is verified whether the target object is a real user through the total evaluation value, and if it is a real user, data access is performed. In addition, the key is flexible and changes during data transmission, and the change is based on the currently input identity authentication information. Not only is the flexible change of the key realized, but also the change of the key is closely related to the current behavior of the target object, which reduces the possibility of cracking the key and avoids the problem that the data security processing effect is not good after the key is obtained through multiple trials or the key is stolen through other channels.

[0153] Figure 7 is a structural diagram of a data security processing apparatus according to an embodiment of the present disclosure, as shown in Figure 7 the data security processing apparatus 700 includes:

[0154] a first obtaining module 710, configured to obtain reference identity authentication information, candidate identity authentication information input by a target object, and time information corresponding to the candidate identity authentication information;

[0155] The second obtaining module 720 is configured to obtain a plurality of evaluation values based on the reference identity authentication information, the candidate identity authentication information, and time information, and obtain an evaluation total value based on the plurality of evaluation values;

[0156] The first processing module 730 is configured to generate a data request message based on the evaluation total value and the device identifier of the second terminal device, and send the data request message to the first terminal device to instruct the first terminal device to send the to-be-processed data to the second terminal device.

[0157] The second processing module 740 is configured to receive the to-be-processed data sent by the first terminal device, and decrypt the to-be-processed data based on the device identifier and the evaluation total value to obtain target data.

[0158] In some embodiments, the second obtaining module 720 is further configured to:

[0159] obtain first encoding information of the candidate identity authentication information and second encoding information of the reference identity authentication information based on a preset character encoding standard;

[0160] obtain a first evaluation value based on a character length of the candidate identity authentication information and a character length of the reference identity authentication information;

[0161] obtain a second evaluation value based on the first encoding information and the second encoding information;

[0162] obtain a third evaluation value based on the time information.

[0163] In some embodiments, the second processing module 740 is further configured to:

[0164] perform a first decryption on the to-be-processed data based on a private key of the target object;

[0165] obtain an encryption key based on the device identifier of the first terminal device, the device identifier of the second terminal device, and the evaluation total value;

[0166] perform a second decryption on the to-be-processed data based on the encryption key.

[0167] In some embodiments, the second processing module 740 is further configured to:

[0168] merge the device identifier of the first terminal device and the device identifier of the second terminal device to obtain a fused device identifier;

[0169] obtain a first hash value of the fused device identifier and a second hash value of the evaluation total value, respectively;

[0170] use an exclusive or value of the first hash value and the second hash value as the encryption key.

[0171] In some embodiments, the second processing module 740 is further configured to:

[0172] generate a first digest based on the target data, and obtain a private key of the target object;

[0173] receive a signature sent by the second terminal device, decrypt the signature based on the private key to obtain a second digest;

[0174] If the first digest and the second digest are the same, it is determined that the target data has not been tampered with.

[0175] In the embodiments of the present disclosure, for the encryption and decryption scheme, instead of simply using private keys and public keys, the evaluation total value obtained during identity authentication is used to flexibly determine the encryption key each time, and the data is decrypted multiple times. Not only is the key changed flexibly, but also the change of the key is closely related to the current behavior of the target object, reducing the possibility of key cracking and improving the security of data transmission.

[0176] Figure 8 is a block diagram of an electronic device 800 according to an example embodiment.

[0177] As shown in Figure 8 the electronic device 800 includes:

[0178] a memory 801 and a processor 802, a bus 803 connecting different components including the memory 801 and the processor 802, the memory 801 storing a computer program, and the processor 802 executing the program to implement the data security processing method of the embodiments of the present disclosure.

[0179] The bus 803 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor or a local bus using any of a variety of bus structures. For example, these architectures include but are not limited to industry standard architecture (ISA) bus, micro channel architecture (MAC) bus, enhanced ISA bus, video electronics standards association (VESA) local bus, and peripheral component interconnect (PCI) bus.

[0180] The electronic device 800 typically includes a variety of electronic device readable media. These media can be any available media that can be accessed by the electronic device 800 and include both volatile and nonvolatile media, removable and non-removable media.

[0181] The storage 806, which can be implemented as a non- volatile storage device such as a magnetic disk drive and / or optical disk drive, is coupled to the bus 803 by a storage interface 807. The storage interface 807 facilitates access to information such as computer- readable instructions, data structures, program modules, and the like. Figure 8 not shown, a magnetic hard disk drive, read-only memory (ROM) 810, a flash drive, or a Figure 8 combination of storage types. The ROM 810 is used for storing fixed information such as the Basic Input-Output (BIOS) for the electronic device 800. The storage 806 can include a magnetic hard disk drive for reading from and writing to a magnetic hard disk, a magnetic floppy disk drive for reading from or writing to a magnetic floppy disk, and / or an optical disk drive for reading from or writing to an optical disk such as a CD-ROM or other optical media.

[0182] The storage 806 can include a solid state drive for reading from and writing to a solid state drive. The storage 806 can also include a magnetic hard disk drive for reading from and writing to a magnetic hard disk, a magnetic floppy disk drive for reading from or writing to a magnetic floppy disk, and / or an optical disk drive for reading from or writing to an optical disk such as a CD-ROM or other optical media. The storage 806 can further include an array of storage devices, such as a Redundant Array of Independent Disks (RAID) storage device. The storage interface 807 can include a storage controller capable of reading from and writing to a file system.

[0183] The storage 806 can include a solid state drive for reading from and writing to a solid state drive. The storage 806 can also include a magnetic hard disk drive for reading from and writing to a magnetic hard disk, a magnetic floppy disk drive for reading from or writing to a magnetic floppy disk, and / or an optical disk drive for reading from or writing to an optical disk such as a CD-ROM or other optical media. The storage 806 can further include an array of storage devices, such as a Redundant Array of Independent Disks (RAID) storage device. The storage interface 807 can include a storage controller capable of reading from and writing to a file system. Figure 8 The storage 806 can include a solid state drive for reading from and writing to a solid state drive. The storage 806 can also include a magnetic hard disk drive for reading from and writing to a magnetic hard disk, a magnetic floppy disk drive for reading from or writing to a magnetic floppy disk, and / or an optical disk drive for reading from or writing to an optical disk such as a CD-ROM or other optical media. The storage 806 can further include an array of storage devices, such as a Redundant Array of Independent Disks (RAID) storage device. The storage interface 807 can include a storage controller capable of reading from and writing to a file system.

[0184] The processor 802 performs a variety of functions. For example, the processor 802 processes electronic device 800.

[0185] It should be noted that the implementation process and technical principles of the electronic device of the present embodiment are referred to the foregoing explanation and description of the data security processing method of the embodiments of the present disclosure, which will not be repeated here.

[0186] In order to realize the above-mentioned embodiments, the present disclosure further proposes a computer readable storage medium.

[0187] The instructions in the computer readable storage medium are executed by the processor of the electronic device, so that the electronic device can execute the foregoing data security processing method. Optionally, the computer readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, and an optical data storage device, etc.

[0188] Other embodiments of the present disclosure will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure following the general principles thereof and including the general principles thereof disclosed in the specification and examples. The specification and examples are to be regarded as illustrative only, and the true scope and spirit of the present disclosure are indicated by the following claims.

[0189] It should be understood that the present disclosure is not limited to the precise structures described above and shown in the drawings, and various modifications and changes can be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A data security processing method, characterized by, The method is performed by a first terminal device, comprising: receiving a data request message sent by a second terminal device, and obtaining a public key of a target object and a device identifier of the first terminal device, wherein the data request message carries an evaluation total value and a device identifier of the second terminal device; determining whether the evaluation total value is within a preset range, and determining to-be-processed data based on the data request message if the evaluation total value is within the preset range; encrypting the to-be-processed data multiple times based on the device identifier of the first terminal device, the device identifier of the second terminal device, the evaluation total value and the public key, and sending the encrypted to-be-processed data to the second terminal device; wherein the encrypting the to-be-processed data multiple times based on the device identifier of the first terminal device, the device identifier of the second terminal device, the evaluation total value and the public key comprises: obtaining an encryption key based on the device identifier of the first terminal device, the device identifier of the second terminal device and the evaluation total value; encrypting the to-be-processed data for the first time based on the encryption key, and encrypting the to-be-processed data for the second time based on the public key; wherein the obtaining the encryption key based on the device identifier of the first terminal device, the device identifier of the second terminal device and the evaluation total value comprises: merging the device identifier of the first terminal device and the device identifier of the second terminal device to obtain a fused device identifier; obtaining a first hash value of the fused device identifier and a second hash value of the evaluation total value respectively; and taking an exclusive or value of the first hash value and the second hash value as the encryption key.

2. The method of claim 1, wherein, The method further comprises: if the evaluation total value is not within the preset range, not sending the to-be-processed data, or adopting a destructive encryption algorithm to destructively process the to-be-processed data in the encryption process, and sending the destructively processed to-be-processed data to the second terminal device.

3. The method according to claim 1 or 2, characterized in that, The method further comprises: encrypting a digest of the to-be-processed data based on the public key to obtain a signature; sending the signature to the second terminal device.

4. A data security processing method characterized by, The method is performed by a second terminal device, comprising: obtaining reference identity authentication information, candidate identity authentication information input by a target object and time information corresponding to the candidate identity authentication information; obtaining multiple evaluation values based on the reference identity authentication information, the candidate identity authentication information and the time information, and obtaining an evaluation total value based on the multiple evaluation values; generating a data request message based on the evaluation total value and a device identifier of the second terminal device, and sending the data request message to a first terminal device to instruct the first terminal device to send to-be-processed data to the second terminal device; receiving the to-be-processed data sent by the first terminal device, and decrypting the to-be-processed data based on the device identifier and the evaluation total value to obtain target data; The decrypting the to-be-processed data based on the device identifier and the evaluation total value comprises: decrypting the to-be-processed data for the first time based on a private key of the target object; obtaining an encryption key based on the device identifier of the first terminal device, the device identifier of the second terminal device and the evaluation total value; and decrypting the to-be-processed data for the second time based on the encryption key. The obtaining the encryption key based on the device identifier of the first terminal device, the device identifier of the second terminal device and the evaluation total value comprises: merging the device identifier of the first terminal device and the device identifier of the second terminal device to obtain a fused device identifier; obtaining a first hash value of the fused device identifier and a second hash value of the evaluation total value respectively; and taking an exclusive or value of the first hash value and the second hash value as the encryption key.

5. The method of claim 4, wherein, The obtaining the plurality of evaluation values based on the reference identity authentication information, the candidate identity authentication information and the time information comprises: obtaining first encoding information of the candidate identity authentication information and second encoding information of the reference identity authentication information based on a preset character encoding standard; obtaining a first evaluation value based on a character length of the candidate identity authentication information and a character length of the reference identity authentication information; obtaining a second evaluation value based on the first encoding information and the second encoding information; obtaining a third evaluation value based on the time information.

6. The method according to claim 4 or 5, characterized in that, Further comprising: generating a first digest based on the target data and obtaining a private key of the target object; receiving a signature sent by the second terminal device, decrypting the signature based on the private key to obtain a second digest; if the first digest and the second digest are the same, determining that the target data has not been tampered with.

7. A data security processing device, characterized by comprising: Comprise: an obtaining module, configured to receive a data request message sent by a second terminal device, and obtain a public key of a target object, a device identifier of the first terminal device, the data request message carrying an evaluation total value and a device identifier of the second terminal device; a determining module, configured to determine whether the evaluation total value is within a preset range, and if the evaluation total value is within the preset range, determine to-be-processed data based on the data request message; a processing module, configured to encrypt the to-be-processed data multiple times based on the device identifier of the first terminal device, the device identifier of the second terminal device, the evaluation total value and the public key, and send the encrypted to-be-processed data to the second terminal device; The processing module is further configured to: obtain an encryption key based on the device identifier of the first terminal device, the device identifier of the second terminal device and the evaluation total value; encrypt the to-be-processed data for the first time based on the encryption key, and encrypt the to-be-processed data for the second time based on the public key. The processing module is further configured to: merge the device identifier of the first terminal device and the device identifier of the second terminal device to obtain a fused device identifier; obtain a first hash value of the fused device identifier and a second hash value of the evaluation total value; and use an exclusive OR value of the first hash value and the second hash value as the encryption key.

8. A data security processing device, characterized by comprising: The method comprises: The first obtaining module is configured to obtain reference identity authentication information, candidate identity authentication information input by a target object, and time information corresponding to the candidate identity authentication information; The second obtaining module is configured to obtain a plurality of evaluation values based on the reference identity authentication information, the candidate identity authentication information, and the time information, and obtain an evaluation total value based on the plurality of evaluation values; The first processing module is configured to generate a data request message based on the evaluation total value and a device identifier of the second terminal device, and send the data request message to a first terminal device to instruct the first terminal device to send to-be-processed data to the second terminal device; The second processing module is configured to receive the to-be-processed data sent by the first terminal device, and decrypt the to-be-processed data based on the device identifier and the evaluation total value to obtain target data; The second processing module is further configured to: perform first decryption on the to-be-processed data based on a private key of the target object; obtain an encryption key based on the device identifier of the first terminal device, the device identifier of the second terminal device, and the evaluation total value; and perform second decryption on the to-be-processed data based on the encryption key. The second processing module is further configured to: merge the device identifier of the first terminal device and the device identifier of the second terminal device to obtain a fused device identifier; obtain a first hash value of the fused device identifier and a second hash value of the evaluation total value; and use an exclusive OR value of the first hash value and the second hash value as the encryption key. 9.An electronic device comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-3, or perform the method of any one of claims 4-6.

10. A non-transitory computer readable storage medium having stored thereon computer instructions, wherein, The computer instructions are used to enable the computer to perform the steps of the method of any one of claims 1-3, or perform the steps of the method of any one of claims 4-6.

Images