Data security sharing method, system, device and product for integrated system
By adopting local encryption and secondary encryption mechanisms in the integrated system, combining identity authentication and behavioral pattern detection, the problem of low security in the data sharing process of integrated system is solved, and the high security of data in the transmission and storage process is achieved. Integrity.
Patent Information
- Application Number
- CN202411419067.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-12
- Publication Date
- 2024-12-24
- Estimated Expiration
- 2044-10-12
AI Technical Summary
Integrated systems have low security problems during data sharing, especially in data transmission and storage between multi-institution platforms.
Using local encryption and secondary encryption mechanisms, data is encrypted through symmetric keys and public and private keys on the data sharing end, and distributed storage is performed in the shared database, combining user authentication and behavioral pattern detection to ensure that only authorized users can Access data.
It effectively avoids unauthorized access and leakage of shared data during transmission and storage procedures, improves data security, and ensures data consistency and integrity in transmission and storage procedures.
Smart Images
Figure CN118972166B_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the field of computer technology, and in particular relates to a data security sharing method, system, device and product for an integrated system. Background Art
[0002] An integrated system is a unified, coordinated system formed by integrating different applications and services through various software and hardware technologies. Its main purpose is to achieve seamless data flow and efficient use of resources to achieve overall benefits. During operation, the integrated system usually needs to process data from different platforms, different protocols and different formats, and ensure that each platform and integrated system can communicate and collaborate with each other. However, in the process of using the prior art, the inventor found that there are at least the following problems in the prior art:
[0003] Integrated systems usually communicate with multiple institutional platforms, involving many platforms, such as hospitals, research institutes, patients and insurance agencies, and the user groups of each platform are relatively complex. In the existing technology, shared data is easily leaked during storage and transmission, resulting in low security of shared data. Summary of the invention
[0004] The present invention aims to solve the above technical problems at least to a certain extent. The present invention provides a data security sharing method, system, device and product for an integrated system.
[0005] In order to achieve the above object, the present invention adopts the following technical solutions:
[0006] In a first aspect, the present invention provides a data security sharing method for an integrated system, comprising:
[0007] Receiving the locally encrypted data sent by the data sharing end, and storing the locally encrypted data in a preset shared database; wherein the locally encrypted data is obtained after the data sharing end locally encrypts the shared data;
[0008] Receive a data access request sent by any data request end, authenticate the data request end based on the data access request, and proceed to the next step after the authentication is passed;
[0009] Extracting local encrypted data matching the data access request from the shared database, and using the local encrypted data as target shared data;
[0010] Performing secondary encryption on the target shared data to obtain secondary encrypted data;
[0011] The secondary encrypted data is sent to the data request end so that the data request end decrypts the secondary encrypted data and obtains the data to be shared.
[0012] In a possible design, the data sharing end performs local encryption processing on the shared data to obtain the locally encrypted data, including:
[0013] The data sharing end obtains a symmetric key and a sharing end public-private key pair, and encrypts the shared data based on the symmetric key to obtain an initial ciphertext; wherein the sharing end public-private key pair includes a sharing end public key and a sharing end private key;
[0014] The data sharing end encrypts the symmetric key based on the sharing end public key to obtain an initial encrypted symmetric key;
[0015] The data sharing end binds the initial ciphertext and the initial encrypted symmetric key to obtain local encrypted data.
[0016] In a possible design, the shared database adopts a distributed database; correspondingly, when the local encrypted data is stored in a preset shared database, the local encrypted data is distributedly stored.
[0017] In a possible design, the data access request is bound to the user identity information and the access data identifier of the access user corresponding to the data request end; correspondingly, authenticating the data request end based on the data access request includes:
[0018] Authentication of the access user corresponding to the data request end is performed based on the user identity information in the data access request, and proceeding to the next step after the identity authentication is passed;
[0019] According to the user identity information, user behavior data of the access user corresponding to the data request end is obtained, and user behavior pattern detection is performed on the access user corresponding to the data request end according to the user behavior data to obtain the current behavior pattern of the access user corresponding to the data request end;
[0020] According to the current behavior pattern and based on the access data identifier, the access user corresponding to the data request end is authorized with access rights to the shared data that matches the access data identifier. When the access rights granted to the access user corresponding to the data request end are full access rights, it is determined that the data request end has been authenticated.
[0021] In one possible design, after receiving the locally encrypted data sent by the data sharing end, the method further includes:
[0022] Receive a re-encryption key generated by the data sharing end and matching the data requesting end; wherein the re-encryption key is generated by the data sharing end based on a sharing end private key in a sharing end public-private key pair of the data sharing end and a requesting end public key in a requesting end public-private key pair of the data requesting end;
[0023] The target shared data includes the initial ciphertext and the initially encrypted symmetric key; correspondingly, the target shared data is re-encrypted to obtain re-encrypted data, including:
[0024] Calling the re-encryption key, and re-encrypting the initial ciphertext based on the re-encryption key to obtain a secondary ciphertext;
[0025] Calling the re-encryption key, and re-encrypting the initially encrypted symmetric key based on the re-encryption key to obtain a re-encrypted symmetric key;
[0026] The secondary ciphertext and the secondary encrypted symmetric key are bound to obtain secondary encrypted data.
[0027] In a possible design, the data requesting end decrypts the secondary encrypted data and obtains the data to be shared, including:
[0028] The data requesting end decrypts the re-encryption key based on the requesting end private key in the requesting end public-private key pair to obtain the sharing end private key in the sharing end public-private key pair of the data sharing end;
[0029] The data requesting end decrypts the secondary encrypted data based on the requesting end private key in the requesting end public-private key pair, and obtains an initial ciphertext corresponding to the secondary ciphertext in the secondary encrypted data and an initial encrypted symmetric key corresponding to the secondary encrypted symmetric key in the secondary encrypted data;
[0030] The data requesting end decrypts the initially encrypted symmetric key based on the shared end private key to obtain a symmetric key corresponding to the initially encrypted symmetric key;
[0031] The data requesting end decrypts the initial ciphertext based on the symmetric key to obtain the data to be shared.
[0032] In one possible design, the shared end public key, the requesting end public key and the re-encryption key are all stored in a preset key database.
[0033] In a second aspect, the present invention provides a data security sharing system for an integrated system, which is used to implement any of the data security sharing methods for an integrated system as described above; the data security sharing system for an integrated system comprises:
[0034] A data storage module, used for receiving the local encrypted data sent by the data sharing end, and storing the local encrypted data in a preset shared database; wherein the local encrypted data is obtained after the data sharing end locally encrypts the shared data;
[0035] An access request receiving module, used to receive a data access request sent by any data request end, authenticate the data request end based on the data access request, and proceed to the next step after the authentication is passed;
[0036] a data matching module, which is in communication with the data storage module and the access request receiving module, respectively, and is used to extract local encrypted data matching the data access request from the shared database, and use the local encrypted data as target shared data;
[0037] A secondary encryption module, which is in communication with the data matching module and is used to perform secondary encryption on the target shared data to obtain secondary encrypted data;
[0038] The data output module is communicatively connected with the secondary encryption module, and is used for sending the secondary encrypted data to the data request end, so that the data request end decrypts the secondary encrypted data and obtains the data to be shared.
[0039] In a third aspect, the present invention provides an electronic device, comprising:
[0040] a memory for storing computer program instructions; and,
[0041] A processor is used to execute the computer program instructions to complete the operation of the data security sharing method for an integrated system as described in any one of the above.
[0042] In a fourth aspect, the present invention provides a computer program product, comprising a computer program or instructions, which, when executed by a computer, implements the data security sharing method for an integrated system as described in any one of the above.
[0043] The beneficial effects of the present invention are:
[0044] The present invention discloses a data security sharing method, system, device and product for an integrated system, which can avoid unauthorized access and leakage of shared data during transmission and storage, thereby improving the security of shared data, and at the same time ensuring the consistency and integrity of shared data during transmission and storage. Specifically, during the implementation of the present invention, local encrypted data sent by a data sharing terminal can be received, and the local encrypted data can be stored in a preset shared database; when a data access request sent by any data request terminal is received, the data request terminal is authenticated based on the data access request, and after the authentication is passed, the local encrypted data matching the data access request is extracted from the shared database, and then the local encrypted data is used as the target shared data, and then the target shared data is re-encrypted to obtain the re-encrypted data, and finally the re-encrypted data is sent to the data request terminal. In this process, the data to be shared is encrypted twice, that is, the data to be shared is encrypted when stored on each platform, and then the integrated system encrypts it again. At the same time, unified identity authentication and permission management are performed through the integrated system to ensure that only authorized users can access the data, thereby ensuring that the shared data is protected during both data storage and transmission, avoiding unauthorized access and leakage of data during transmission and storage, and effectively improving the security of shared data; in addition, the local encryption of the data sharing end and the secondary encryption mechanism of the integrated system in the present invention can ensure the consistency and integrity of the data during transmission and storage, and avoid data tampering and loss.
[0045] Other beneficial effects of the present invention will be further described in the specific embodiments. BRIEF DESCRIPTION OF THE DRAWINGS
[0046] Figure 1 is a flow chart of a data security sharing method for an integrated system in an embodiment;
[0047] Figure 2 is a module block diagram of a data security sharing system for an integrated system in an embodiment;
[0048] Figure 3 It is a module block diagram of an electronic device in an embodiment. DETAILED DESCRIPTION
[0049] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the present invention will be briefly introduced below in combination with the drawings and the description of the embodiments or the prior art. Obviously, the following description of the structure of the drawings is only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. It should be noted that the description of these embodiments is used to help understand the present invention, but does not constitute a limitation of the present invention.
[0050] Embodiment 1:
[0051] This embodiment discloses a data security sharing method for an integrated system, which can be executed by, but is not limited to, a computer device or a virtual machine with certain computing resources, such as a personal computer, a smart phone, a personal digital assistant, or a wearable device, or by a virtual machine.
[0052] like Figure 1 As shown, a data security sharing method for an integrated system is performed based on a data center of the integrated system; the method may include but is not limited to the following steps:
[0053] S1. Receive the local encrypted data sent by the data sharing end, and store the local encrypted data in a preset shared database; wherein, the local encrypted data is obtained after the data sharing end locally encrypts the shared data m; it should be noted that when the data sharing end transmits the shared data m to the data center of the integrated system, it pre-encrypts the shared data m locally, which can ensure the security of the shared data m during transmission and avoid data leakage during transmission.
[0054] In step S1, the data sharing end performs local encryption processing on the shared data m to obtain the locally encrypted data, including:
[0055] S101. The data sharing end obtains a symmetric key k and a public-private key pair of the sharing end, and encrypts the shared data m based on the symmetric key k to obtain an initial ciphertext C; wherein the public-private key pair of the sharing end includes a public key pk A and the shared end private key sk A ; Specifically, the initial ciphertext C can be expressed as: C=Enc(m,k), where Enc(x,y) represents an encryption function that uses the key y to encrypt the data x. In this embodiment, the encryption function corresponding to the initial ciphertext C adopts the AES (Advanced Encryption Standard) function;
[0056] That is, the key of the data sharing end includes: symmetric key k, sharing end public key pkA and the shared end private key sk A , shared end public key pk A and the shared end private key sk A Constitute a shared public and private key pair.
[0057] S102. The data sharing end is based on the shared end public key pk A The symmetric key k is encrypted to obtain an initial encrypted symmetric key k'; in this embodiment, the initial encrypted symmetric key k' can be expressed as: k'=Enc(k,pk A ), in this embodiment, the encryption function corresponding to the symmetric key k' after the initial encryption adopts the RSA (Rivest-Shamir-Adleman, asymmetric encryption algorithm) function.
[0058] S103. The data sharing terminal binds the initial ciphertext C and the initial encrypted symmetric key k' to obtain local encrypted data. In this embodiment, the local encrypted data can be expressed as [C, k'].
[0059] It should be noted that, in the process of locally encrypting the shared data m, the data sharing end uses the symmetric key k for encryption. Since the efficiency of symmetric encryption is higher than that of asymmetric encryption, the speed of locally encrypting the shared data m in this embodiment is improved. At the same time, since the symmetric key k is smaller than the data to be shared m, the encryption operation of the symmetric key is faster than the asymmetric encryption of the shared data m, which makes the use of the shared end public key pk A Encrypting it will not affect the speed of local encryption of the shared data m. It can be seen that the technical solution based on the above data sharing end performing local encryption on the shared data m can ensure the security of the data sharing end during the transmission of the shared data m. At the same time, the efficiency of local encryption is higher, which is suitable for scenarios where the amount of data m to be shared is large.
[0060] In addition, in step S1, the shared database adopts a distributed database; correspondingly, when the local encrypted data is stored in the preset shared database, the local encrypted data is distributedly stored. It should be noted that in this embodiment, based on the distributed database, the function of storing data on multiple nodes can be realized, and the data access and transmission speed can be improved through parallel processing. At the same time, the distributed database has a flexible storage architecture. In the process of storing shared data, the storage capacity can be horizontally expanded at any time as needed without downtime or interruption of service, thereby meeting the needs of different application scenarios. For example, when the storage demand increases, more nodes or storage resources can be easily added to the distributed database.
[0061] S2. Receive a data access request sent by any data request end, authenticate the data request end based on the data access request, and proceed to the next step after the authentication is passed; it should be noted that, in this embodiment, the data request end can be a data sharing end, or it can be a user end that only needs to use the data sharing end to provide data, which is not limited here.
[0062] In step S2, the data access request is bound with the user identity information and the access data identifier of the access user corresponding to the data request end; correspondingly, the data request end is authenticated based on the data access request, including:
[0063] S201. Authenticate the access user corresponding to the data request end based on the user identity information in the data access request, and proceed to the next step after the identity authentication is passed; otherwise, a prompt message that the identity authentication fails and the data is not shared can be output; it should be noted that, in this embodiment, when authenticating the access user, it is used to confirm whether the access user has the access right to the shared data corresponding to the access data identifier. During the implementation process, the identity authentication of the access user can be achieved based on the authorized user list and authorized user requirements pre-generated by the data sharing end corresponding to the access data identifier. In this embodiment, the identity authentication of the access user is achieved based on the authorized user list, which can improve the efficiency of identity authentication and minimize the leakage of the information to be shared on the data sharing end.
[0064] To further improve the security of data access, during the implementation of this embodiment, the accessing user logs in to the integrated system through a multi-factor authentication method so that the integrated system receives the data access request sent by the data request end. The multiple authentication factors include passwords, SMS verification codes, fingerprints, etc. For example, the accessing user submits a password and an SMS verification code, and the integrated system uniformly verifies the correctness of both, and determines that the authentication is successful when both are correct, and then receives the data access request and extracts the user identity information from it.
[0065] S202.According to the user identity information, obtain the user behavior data of the access user corresponding to the data request end, and perform user behavior pattern detection on the access user corresponding to the data request end according to the user behavior data to obtain the current behavior pattern of the access user corresponding to the data request end; in this embodiment, the user behavior data is a multidimensional array, which may include but is not limited to data access time, data access type, IP address, device type, etc. For example, if the data access time in the user behavior data is during working hours and the device type is a designated device, the current behavior pattern of the access user is set to the normal behavior pattern.
[0066] S203. According to the current behavior mode and based on the access data identifier, the access user corresponding to the data request end is authorized to have access rights to the shared data that matches the access data identifier, and when the access rights granted to the access user corresponding to the data request end are all access rights, it is determined that the data request end has been authenticated. For example, when the current behavior mode is the normal behavior mode, the access user corresponding to the data request end is granted all access rights to the shared data that matches the access data identifier, otherwise access is denied.
[0067] It should be noted that, in the present embodiment, after the identity of the accessing user is authenticated, the behavior pattern of the accessing user is detected based on the user behavior data of the accessing user, and based on this, dynamic authorization of the accessing user corresponding to the data requesting end is implemented, that is, by analyzing the real-time behavior and environment of the accessing user to dynamically adjust the shared data permissions of the accessing user, which can effectively ensure the secure sharing of data.
[0068] S3. Extract local encrypted data matching the data access request from the shared database, and use the local encrypted data as target shared data.
[0069] It should be noted that, in this embodiment, the local encrypted data is bound to a data identifier. Correspondingly, in step S3, extracting the local encrypted data matching the data access request from the shared database includes:
[0070] Based on the access data identifier bound to the data access request, local encrypted data matching the access data identifier is retrieved from the shared database, and the local encrypted data is used as the local encrypted data matching the data access request. In this embodiment, the data identifier bound to the local encrypted data can be pre-set based on the data sharing end, or can be obtained by the data sharing end by extracting keywords from the data to be shared m before the data sharing end locally encrypts the data to be shared m, so that when the corresponding data request end requests data sharing, the target shared data can be quickly retrieved.
[0071] S4. The target shared data is double-encrypted to obtain double-encrypted data. It should be noted that, in this embodiment, by double-encrypting the target shared data, an additional layer of protection can be provided during the storage and transmission of the data m to be shared, thereby ensuring the security of the data m to be shared during storage and transmission. At the same time, the setting of double encryption can prevent the data from being tampered with during the transmission and storage process, which helps to ensure the integrity and consistency of the data during the transmission and storage process.
[0072] In step S1, after receiving the local encrypted data sent by the data sharing terminal, the method further includes:
[0073] Receive the re-encryption key rk generated by the data sharing end and matching the data request end A→B ; Wherein, the re-encryption key is the shared end private key sk in the shared end public-private key pair of the data sharing end based on the data sharing end A and the requester public key pk in the requester public-private key pair of the data requester B Generation; It should be noted that, in this embodiment, the data sharing end can initiate a public key extraction request to all users in the authorized user list according to its corresponding authorized user list in advance, and after receiving the public key of the specified user, generate a re-encryption key matching the specified user based on its shared end private key and the received public key, so as to facilitate the integrated system to call the re-encryption key.
[0074] That is, the key of the data request end includes: the request end public key pk B and the requester private key sk B , requesting end public key pk B and the requester private key sk B Constitute the public and private key pair of the requesting end.
[0075] The target shared data includes the initial ciphertext C and the initial encrypted symmetric key k'; correspondingly, in step S4, the target shared data is encrypted twice to obtain the secondary encrypted data, including:
[0076] S401. Call the re-encryption key rk A→B , and based on the re-encryption key rk A→B The initial ciphertext C is encrypted twice to obtain a secondary ciphertext C'; in this embodiment, the secondary ciphertext C' can be expressed as: C'=ReEnc(C,rk A→B ), where ReEnc(x,y) is an encryption function that uses key y to perform secondary encryption on data x.
[0077] S402. Call the re-encryption key rk A→B , and based on the re-encryption key rk A→B The initially encrypted symmetric key k' is re-encrypted to obtain a re-encrypted symmetric key k''; in this embodiment, the re-encrypted symmetric key k'' can be expressed as: k''=ReEnc(k',rk A→B ).
[0078] S403. Bind the secondary ciphertext C' and the secondary encrypted symmetric key k'' to obtain secondary encrypted data. In this embodiment, the secondary encrypted data can be expressed as: [C', k''].
[0079] It should be noted that in this embodiment, the re-encryption key rk A→B Used to re-encrypt the target shared data (i.e., the locally encrypted data matching the data access request) into the public key pk of the data requesting end. B The encrypted ciphertext allows the secondary encrypted data to be obtained through the requester's private key sk B Decryption is performed so that the integrated system does not need to access the original plaintext data to be shared by the data sharing end, as well as the private keys of the data sharing end and the data requesting end, thereby effectively ensuring the security of data storage and transmission.
[0080] In the implementation process of this embodiment, the re-encryption key rk A→B At the same time, the initial ciphertext C and the symmetric key k' after the initial encryption are re-encrypted to ensure that the data and the key in the re-encrypted data obtained after the re-encryption are corresponding, avoiding the problem that the key and the data may not match; at the same time, the data to be encrypted and the symmetric key k are both encrypted twice, locally encrypted and re-encrypted, providing higher security. Even if one part is cracked, there is still encryption protection for another part, which effectively prevents information leakage.
[0081] S5. Send the secondary encrypted data to the data requesting end, so that the data requesting end decrypts the secondary encrypted data and obtains the data m to be shared.
[0082] In step S5, the data requesting end decrypts the secondary encrypted data and obtains the data m to be shared, including:
[0083] S501. The data requesting end uses the requesting end private key sk in the requesting end public-private key pair. B The re-encryption key rk A→B Decryption is performed to obtain the shared end private key sk in the shared end public-private key pair of the data sharing end A In this embodiment, the shared end private key sk A It can be expressed as: sk A =Dec(rk A→B ,sk B ), where Dec(x,y) represents a decryption function that uses key y to decrypt data x.
[0084] S502. The data requesting end uses the requesting end private key sk in the requesting end public-private key pair. BThe secondary encrypted data is decrypted to obtain an initial ciphertext C corresponding to the secondary ciphertext C' in the secondary encrypted data and an initial encrypted symmetric key k' corresponding to the secondary encrypted symmetric key k'' in the secondary encrypted data; in this embodiment, the initial ciphertext C can be expressed as: C=Dec(C',sk B ); the symmetric key k' after initial encryption can be expressed as: k'=Dec(k'',sk B ).
[0085] S503. The data request end is based on the shared end private key sk A The initial encrypted symmetric key k' is decrypted to obtain a symmetric key k corresponding to the initial encrypted symmetric key k'; in this embodiment, the symmetric key k can be expressed as: k=Dec(k',sk A ).
[0086] S504. The data requesting end decrypts the initial ciphertext C based on the symmetric key k to obtain the to-be-shared data m. In this embodiment, the to-be-shared data m can be expressed as: m=Dec(C, k).
[0087] In this embodiment, the shared end public key pk A , the requesting end public key pk B and the re-encryption key rk A→B It should be noted that in this embodiment, the public keys of each data sharing terminal and data requesting terminal are uniformly stored in the key database, as well as the re-encryption key rk generated by each data sharing terminal according to the authorized user list. A→B , so that the data sharing end, data request end and the data center of the integrated system can call the key.
[0088] This embodiment can avoid unauthorized access and leakage of shared data during transmission and storage, thereby improving the security of shared data, and at the same time ensuring the consistency and integrity of shared data during transmission and storage. Specifically, during the implementation of this embodiment, local encrypted data sent by the data sharing end can be received, and the local encrypted data can be stored in a preset shared database; when a data access request sent by any data request end is received, the data request end is authenticated based on the data access request, and after the authentication is passed, the local encrypted data matching the data access request is extracted from the shared database, and then the local encrypted data is used as the target shared data, and then the target shared data is re-encrypted to obtain the re-encrypted data, and finally the re-encrypted data is sent to the data request end. During this process, the data to be shared is encrypted twice, that is, the data to be shared is encrypted when stored on each platform, and then the integrated system encrypts it again. At the same time, unified identity authentication and permission management are performed through the integrated system to ensure that only authorized users can access the data, thereby ensuring that the shared data is protected during both data storage and transmission, avoiding unauthorized access and leakage of data during transmission and storage, and effectively improving the security of shared data. In addition, in this embodiment, the local encryption of the data sharing end and the secondary encryption mechanism of the integrated system can ensure the consistency and integrity of the data during transmission and storage, and avoid data tampering and loss.
[0089] Embodiment 2:
[0090] This embodiment discloses a data security sharing system for an integrated system, which is used to implement the data security sharing method for an integrated system in Embodiment 1; Figure 2 As shown, the data security sharing system for the integrated system includes:
[0091] A data storage module, used for receiving the local encrypted data sent by the data sharing end, and storing the local encrypted data in a preset shared database; wherein the local encrypted data is obtained after the data sharing end locally encrypts the shared data;
[0092] An access request receiving module, used to receive a data access request sent by any data request end, authenticate the data request end based on the data access request, and proceed to the next step after the authentication is passed;
[0093] a data matching module, which is in communication with the data storage module and the access request receiving module, respectively, and is used to extract local encrypted data matching the data access request from the shared database, and use the local encrypted data as target shared data;
[0094] A secondary encryption module, which is in communication with the data matching module and is used to perform secondary encryption on the target shared data to obtain secondary encrypted data;
[0095] The data output module is communicatively connected with the secondary encryption module, and is used for sending the secondary encrypted data to the data request end, so that the data request end decrypts the secondary encrypted data and obtains the data to be shared.
[0096] It should be noted that the working process, working details and technical effects of the data security sharing system for integrated systems provided in this embodiment 2 can be found in embodiment 1 and will not be repeated here.
[0097] Embodiment 3:
[0098] Based on Embodiment 1 or 2, this embodiment discloses an electronic device, which may be a smart phone, a tablet computer, a laptop computer, or a desktop computer. The electronic device may be referred to as a user terminal, a portable terminal, a desktop terminal, etc. Figure 3 As shown, the electronic equipment includes:
[0099] a memory for storing computer program instructions; and,
[0100] A processor is used to execute the computer program instructions to complete the operations of the data security sharing method for an integrated system as described in any one of Embodiment 1.
[0101] Specifically, the processor 301 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 301 may be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 301 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 301 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen.
[0102] The memory 302 may include one or more computer-readable storage media, which may be non-transitory. The memory 302 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In some embodiments, the non-transitory computer-readable storage medium in the memory 302 is used to store at least one instruction, which is used to be executed by the processor 301 to implement the data security sharing method for the integrated system provided in Example 1 of the present application.
[0103] In some embodiments, the terminal may further optionally include: a communication interface 303 and at least one peripheral device. The processor 301, the memory 302 and the communication interface 303 may be connected via a bus or a signal line. Each peripheral device may be connected to the communication interface 303 via a bus, a signal line or a circuit board. Specifically, the peripheral device includes: at least one of a radio frequency circuit 304, a display screen 305 and a power supply 306.
[0104] The communication interface 303 may be used to connect at least one peripheral device related to I / O (Input / Output) to the processor 301 and the memory 302. In some embodiments, the processor 301, the memory 302, and the communication interface 303 are integrated on the same chip or circuit board; in some other embodiments, any one or two of the processor 301, the memory 302, and the communication interface 303 may be implemented on a separate chip or circuit board, which is not limited in this embodiment.
[0105] The radio frequency circuit 304 is used to receive and transmit RF (Radio Frequency) signals, also known as electromagnetic signals. The radio frequency circuit 304 communicates with a communication network and other communication devices through electromagnetic signals.
[0106] The display screen 305 is used to display a UI (User Interface). The UI may include graphics, text, icons, videos, and any combination thereof.
[0107] The power supply 306 is used to supply power to various components in the electronic device.
[0108] Embodiment 4:
[0109] Based on any one of Examples 1 to 3, this embodiment discloses a computer program product, including a computer program or instructions, which, when executed by a computer, implements the data security sharing method for an integrated system as described in any one of Example 1.
[0110] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, and optionally, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.
[0111] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the above embodiments, a person skilled in the art should understand that the technical solutions described in the above embodiments can still be modified, or some of the technical features can be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims
1. A data security sharing method for an integrated system, characterized in that: include: Receiving the locally encrypted data sent by the data sharing end, and storing the locally encrypted data in a preset shared database; wherein the locally encrypted data is obtained after the data sharing end locally encrypts the shared data; Receive a data access request sent by any data request end, authenticate the data request end based on the data access request, and proceed to the next step after the authentication is passed; Extracting local encrypted data matching the data access request from the shared database, and using the local encrypted data as target shared data; Performing secondary encryption on the target shared data to obtain secondary encrypted data; Sending the secondary encrypted data to the data requesting end so that the data requesting end decrypts the secondary encrypted data and obtains the data to be shared; The data sharing end performs local encryption processing on the shared data to obtain the locally encrypted data, including the following steps: The data sharing end obtains a symmetric key and a sharing end public-private key pair, and encrypts the shared data based on the symmetric key to obtain an initial ciphertext; wherein the sharing end public-private key pair includes a sharing end public key and a sharing end private key; The data sharing end encrypts the symmetric key based on the sharing end public key to obtain an initial encrypted symmetric key; The data sharing end binds the initial ciphertext and the initial encrypted symmetric key to obtain local encrypted data; The data access request is bound to the user identity information and the access data identifier of the access user corresponding to the data request end; correspondingly, authenticating the data request end based on the data access request includes: Authentication of the access user corresponding to the data request end is performed based on the user identity information in the data access request, and proceeding to the next step after the identity authentication is passed; According to the user identity information, user behavior data of the access user corresponding to the data request end is obtained, and user behavior pattern detection is performed on the access user corresponding to the data request end according to the user behavior data to obtain the current behavior pattern of the access user corresponding to the data request end; According to the current behavior mode, based on the access data identifier, the access user corresponding to the data request end is authorized to have access rights to the shared data that matches the access data identifier, and when the access rights granted to the access user corresponding to the data request end are all access rights, it is determined that the data request end is authenticated; After receiving the locally encrypted data sent by the data sharing terminal, the method further includes: Receive a re-encryption key generated by the data sharing end and matching the data requesting end; wherein the re-encryption key is generated by the data sharing end based on a sharing end private key in a sharing end public-private key pair of the data sharing end and a requesting end public key in a requesting end public-private key pair of the data requesting end; The target shared data includes the initial ciphertext and the initially encrypted symmetric key; correspondingly, the target shared data is re-encrypted to obtain re-encrypted data, including: Calling the re-encryption key, and re-encrypting the initial ciphertext based on the re-encryption key to obtain a secondary ciphertext; Calling the re-encryption key, and re-encrypting the initially encrypted symmetric key based on the re-encryption key to obtain a re-encrypted symmetric key; The secondary ciphertext and the secondary encrypted symmetric key are bound to obtain secondary encrypted data.
2. A data security sharing method for an integrated system according to claim 1, characterized in that: The shared database adopts a distributed database; correspondingly, when the local encrypted data is stored in the preset shared database, the local encrypted data is distributedly stored.
3. A data security sharing method for an integrated system according to claim 1, characterized in that: The data requesting end decrypts the secondary encrypted data and obtains the data to be shared, including: The data requesting end decrypts the re-encryption key based on the requesting end private key in the requesting end public-private key pair to obtain the sharing end private key in the sharing end public-private key pair of the data sharing end; The data requesting end decrypts the secondary encrypted data based on the requesting end private key in the requesting end public-private key pair, and obtains an initial ciphertext corresponding to the secondary ciphertext in the secondary encrypted data and an initial encrypted symmetric key corresponding to the secondary encrypted symmetric key in the secondary encrypted data; The data requesting end decrypts the initially encrypted symmetric key based on the shared end private key to obtain a symmetric key corresponding to the initially encrypted symmetric key; The data requesting end decrypts the initial ciphertext based on the symmetric key to obtain the data to be shared.
4. A data security sharing method for an integrated system according to claim 3, characterized in that: The shared end public key, the requesting end public key and the re-encryption key are all stored in a preset key database.
5. A data security sharing system for an integrated system, characterized in that: Used to implement the data security sharing method for an integrated system as described in any one of claims 1 to 4; the data security sharing system for an integrated system comprises: A data storage module, used for receiving the local encrypted data sent by the data sharing end, and storing the local encrypted data in a preset shared database; wherein the local encrypted data is obtained after the data sharing end locally encrypts the shared data; An access request receiving module, used to receive a data access request sent by any data request end, authenticate the data request end based on the data access request, and proceed to the next step after the authentication is passed; a data matching module, which is in communication with the data storage module and the access request receiving module, respectively, and is used to extract local encrypted data matching the data access request from the shared database, and use the local encrypted data as target shared data; A secondary encryption module, which is in communication with the data matching module and is used to perform secondary encryption on the target shared data to obtain secondary encrypted data; The data output module is communicatively connected with the secondary encryption module, and is used for sending the secondary encrypted data to the data request end, so that the data request end decrypts the secondary encrypted data and obtains the data to be shared.
6. An electronic device, characterized in that: include: a memory for storing computer program instructions; as well as, A processor is used to execute the computer program instructions to complete the operation of the data security sharing method for an integrated system as described in any one of claims 1 to 4.
7. A computer program product comprising a computer program or instructions, characterized in that: When the computer program or the instruction is executed by a computer, the method for secure data sharing for an integrated system as claimed in any one of claims 1 to 4 is implemented.