Data encryption and decryption verification method, electronic device, and storage medium

Abstract

The present application discloses a data encryption and decryption verification method, an electronic device, and a storage medium. The data encryption verification method is applied to a storage end, and includes: sending an encryption key acquisition request for encrypted data to a management platform; receiving encryption key data sent by the management platform, wherein the encryption key data is sent by the management platform after the encryption request signature data is verified, and the encryption key data includes an auxiliary encryption key and encryption key signature data; in response to the encryption key signature data being verified, the original encryption key is encrypted using the auxiliary encryption key to obtain a target key; the target key and the encrypted data are combined to obtain the target data provided to the operation end. The above scheme can enhance the credibility of both parties in the interaction.

Description

Technical Field

[0001] The present application relates to the field of data verification, and in particular to a data encryption and decryption verification method, an electronic device, and a storage medium. Background Art

[0002] In the prior art, in order to encrypt the original data, the storage end directly sends an encryption request to the management platform. After receiving the encryption request, the management platform also directly sends the original encryption key to the storage end. The storage end uses the received original encryption key to encrypt the original data to obtain encrypted data. However, the inventors have found that the original data is often leaked during the data transmission process. Summary of the invention

[0003] The present application at least provides a data encryption and decryption verification method, an electronic device, and a storage medium, which can enhance the credibility of both parties in the interaction.

[0004] In a first aspect, the present application provides a data encryption verification method, which is applied to a storage end, and the method includes: sending an encryption key acquisition request regarding encrypted data to a management platform, wherein the encryption key acquisition request includes encryption request signature data, and the encrypted data is encrypted using an original encryption key; receiving encryption key data sent by the management platform, wherein the encryption key data is sent after the management platform verifies the encryption request signature data, and the encryption key data includes an auxiliary encryption key and encryption key signature data; in response to the encryption key signature data being verified, encrypting the original encryption key using the auxiliary encryption key to obtain a target key; and combining the target key and the encrypted data to obtain target data provided to an operation end.

[0005] Among them, the encrypted request signature data is generated based on the authority public key provided by the management platform. The authority level corresponding to the authority public key matches the operation authority of the encrypted data. The management platform verifies the encrypted request signature data by using the authority private key to verify the encrypted request signature data in the encryption key acquisition request.

[0006] Among them, the authority public key is obtained by the storage end from the corresponding authority level certificate, and the authority level certificate corresponding to the authority public key is generated by the management platform for the authority public-private key pair and sent to the storage end. Different authority levels correspond to different authority level certificates; and / or, before the storage end sends an encryption key acquisition request for encrypted data to the management platform, it includes: dividing the authority level of the original data to determine the target authority level corresponding to the original data; and the storage end sends an encryption key acquisition request for the encrypted data to the management platform, including: based on the target authority level, determining the auxiliary encryption key identifier to be obtained; combining the encryption request signature data and the auxiliary encryption key identifier to obtain an encryption key acquisition request.

[0007] The encryption key signature data is generated based on the storage public key provided by the storage end, and the storage end verifies the encryption key signature data using the storage private key.

[0008] Among them, the storage public key is obtained by the management platform from the storage certificate, and the storage certificate is generated by the storage end and sent to the management platform; and / or, the encryption key data includes auxiliary key encryption data, and receiving the encryption key data sent by the management platform includes: using the storage private key to verify the encryption key signature data to obtain a verification result; and in response to the encryption key signature data verification being passed, it includes: using the storage private key to decrypt the auxiliary key encryption data to obtain an auxiliary encryption key.

[0009] Wherein, the encrypted data is video data; and / or, the target key and the encrypted data are combined to obtain target data provided to the operation terminal, including: combining the target key, the first identifier of the original encryption key and the second identifier of the auxiliary encryption key to obtain encrypted auxiliary data; storing the encrypted auxiliary data into the encrypted data to obtain the target data.

[0010] A second aspect of the present application provides a data encryption verification method, which is applied to an operation end, and the method includes: sending a decryption key acquisition request for target data to a management platform, wherein the decryption key acquisition request includes decryption request signature data and account data, and the target data includes a target key and encrypted data; receiving decryption key data sent by the management platform, wherein the decryption key data is sent after the management platform verifies both the decryption request signature data and the account data, and the decryption key data includes a decryption key signature data and an auxiliary encryption key; in response to the decryption key signature data being verified, decrypting the target key using the auxiliary encryption key to obtain the original encryption key; decrypting the encrypted data using the original encryption key to obtain the original data.

[0011] The decryption request signature data is generated based on the authentication public key provided by the management platform, and the management platform verifies the decryption request signature data by using the authentication private key to verify the decryption request signature data in the decryption key acquisition request.

[0012] Among them, the authentication public key is obtained by the operation end from the corresponding operation authentication certificate, and the operation authentication certificate corresponding to the authentication public key is generated by the management platform for the authentication private key pair and sent to the operation end; and / or, the target data also includes a first identifier of the original encryption key. Before the operation end sends a decryption key acquisition request for the target data to the management platform, it includes: parsing the target data to obtain the first identifier; and the operation end sends a decryption key acquisition request for the target data to the management platform, including: combining the first identifier and the decryption request signature data to obtain a decryption key acquisition request; and sending the decryption key acquisition request to the management platform.

[0013] Among them, the decryption key signature data is generated based on the operation public key provided by the operation end. The operation public key is obtained by the management platform from the operation certificate. The operation certificate is generated by the operation end and sent to the management platform. The operation end uses the operation private key to verify the decryption key signature data.

[0014] Among them, the auxiliary encryption key in the decryption key data is obtained by encrypting the target key using the operation public key by the management platform; before using the auxiliary encryption key to decrypt the target key to obtain the original encryption key, it includes: using the operation private key to decrypt the auxiliary encryption key to obtain the unencrypted auxiliary encryption key; using the auxiliary encryption key to decrypt the target key to obtain the original encryption key, including: using the unencrypted auxiliary encryption key to decrypt the target key to obtain the original encryption key.

[0015] A third aspect of the present application provides a verification method, which is applied to a management platform, and the method includes: receiving an encryption key acquisition request for encrypted data sent by a storage end, wherein the encryption key acquisition request includes encryption request signature data, and the encrypted data is encrypted using the original encryption key; verifying the encryption request signature data to obtain an encryption verification result; in response to the encryption verification result being a passed verification, sending encryption key data to the storage end, wherein the encryption key data includes an auxiliary encryption key and encryption key signature data, and the auxiliary encryption key is used to encrypt the original encryption key to obtain a target key after the encryption key signature data is verified on the storage end, and the target key is used to provide it to the operation end together with the encrypted data.

[0016] Among them, the encrypted request signature data is generated according to the authority public key provided by the management platform, the authority level corresponding to the authority public key matches the operation authority of the encrypted data, the authority public key is obtained by the storage end from the corresponding authority level certificate, and the authority level certificate corresponding to the authority public key is generated by the management platform for the authority public-private key pair and sent to the storage end. Different authority levels correspond to different authority level certificates; and / or, the encrypted request signature data is verified to obtain an encrypted verification result, including: using the authority private key to verify the encrypted request signature data to obtain an encrypted verification result; and before sending the encrypted key data to the storage end, including: using the storage public key to encrypt the auxiliary encryption key to obtain auxiliary key encrypted data; combining the encryption key signature data and the auxiliary key encrypted data to obtain the encryption key data, wherein the encryption key signature data is generated according to the storage public key provided by the storage end, the storage public key is obtained by the management platform from the storage certificate, and the storage certificate is generated by the storage end and sent to the management platform.

[0017] The method further includes: the management platform receives a decryption key acquisition request for target data sent by the operation end, wherein the decryption key acquisition request includes decryption request signature data and account data, and the target data includes a target key and encrypted data; the decryption request signature data is verified to obtain a decryption verification result; in response to the decryption verification result being a passed verification, the decryption key data is sent to the operation end, wherein the decryption key data includes a decryption key signature data and an auxiliary encryption key, and the auxiliary encryption key is used to decrypt the target key to obtain the original encryption key after the decryption key signature data is verified by the operation end.

[0018] Among them, the decryption request signature data is generated according to the authentication public key provided by the management platform, and the decryption request signature data is verified to obtain a decryption verification result, including: using the authentication private key to verify the decryption request signature data to obtain a sub-verification result; in response to the sub-verification result being a passed verification, the authority of the account data is verified, and the term of the auxiliary encryption key is verified to obtain a decryption verification result.

[0019] Among them, the decryption key signature data is generated according to the operation public key provided by the operation end, the operation public key is obtained by the management platform from the operation certificate, the operation certificate is generated by the operation end and sent to the management platform, and the operation end verifies the decryption key signature data using the operation private key; in response to the decryption verification result being a passed verification, the decryption key data is sent to the operation end, including: in response to the decryption verification result being a passed sub-verification result, a passed authority verification of the account data and a term of the auxiliary encryption key not expired, the auxiliary encryption key is encrypting the auxiliary encryption key using the operation public key to obtain an encrypted auxiliary encryption key; the decryption key signature data and the encrypted auxiliary encryption key are combined to obtain the decryption key data; the decryption key data is sent to the operation end.

[0020] The fourth aspect of the present application provides an electronic device, comprising a memory and a processor coupled to each other, the processor being used to execute program instructions stored in the memory to implement the data encryption verification method in the first aspect above, or to implement the data decryption verification method in the second aspect above, or to implement the verification method in the third aspect above.

[0021] The sixth aspect of the present application provides a computer-readable storage medium having program instructions stored thereon. When the program instructions are executed by a processor, the data encryption verification method in the first aspect described above is implemented, or the data decryption verification method in the second aspect described above is implemented, or the verification method in the third aspect described above is implemented.

[0022] In the above scheme, in order to further encrypt the encrypted data, the storage end sends an encryption key acquisition request for the encrypted data to the management platform, and the encryption key acquisition request includes encryption request signature data; after receiving the encryption key acquisition request, the management platform verifies the encryption request signature data therein to ensure that the identity of the storage end sending the encryption key acquisition request is legal and the encryption key acquisition request has not been tampered with. After the verification is passed, the management platform will send the encryption key data to the storage end, and the encryption key data includes an auxiliary encryption key and encryption key signature data; after receiving the encryption key data, the storage end verifies the encryption key signature data therein to ensure that the management platform sending the encryption key data is legal and can interact with the storage end, and can also verify whether the encryption key data has been tampered with. After the verification is passed, the storage end uses the auxiliary encryption key to encrypt the original encryption key to obtain the target key, and combines the target key and the encrypted data to obtain the target data provided to the operation end. In this way, through the mutual verification between the management platform and the storage end, it is possible to determine whether each other's identities are legal, so as to improve the credibility of the interacting parties, and at the same time avoid the leakage of the auxiliary encryption key.

[0023] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The drawings herein are incorporated into the specification and constitute a part of the specification. These drawings illustrate embodiments consistent with the present application and are used together with the specification to illustrate the technical solution of the present application.

[0025] Figure 1 It is a flowchart of an embodiment of an encryption and decryption method provided by the present application;

[0026] Figure 2 It is a schematic diagram of the framework of an embodiment of the encryption and decryption system of the present application;

[0027] Figure 3 It is a flowchart of an embodiment of the encryption method of the present application;

[0028] Figure 4 It is a flowchart of an embodiment of the decryption method of the present application;

[0029] Figure 5 It is a flowchart of an embodiment of the encryption verification method of the present application;

[0030] Figure 6 It is a flowchart of an embodiment of the decryption verification method of the present application;

[0031] Figure 7 It is a flowchart of an embodiment of the verification method of the present application;

[0032] Figure 8 It is a schematic diagram of the framework of an embodiment of the encryption verification device of the present application;

[0033] Fig. 9 It is a schematic diagram of the framework of an embodiment of the electronic device of the present application;

[0034] Fig.10 It is a schematic diagram of a framework of an embodiment of a computer-readable storage medium of the present application. DETAILED DESCRIPTION

[0035] The scheme of the embodiment of the present application is described in detail below in conjunction with the drawings of the specification.

[0036] In the following description, for the purpose of explanation rather than limitation, specific details such as specific system structures, interfaces, and technologies are provided to facilitate a thorough understanding of the present application.

[0037] The term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there may be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the objects associated before and after are in an "or" relationship. In addition, "many" in this article means two or more than two. In addition, the term "at least one" in this article means any combination of at least two of any one or more of a plurality of, for example, including at least one of A, B, and C, can mean including any one or more elements selected from the set consisting of A, B, and C.

[0038] As described in the background technology, there is a risk of data leakage in the original data transmission process in the prior art. The inventors have found through research that the reason for this problem is that during the data transmission between the storage end and the management platform, the request and sending of the encryption key are not protected and verified, which will cause the encryption key to be easily decrypted by a third party, thereby causing the original data to be leaked.

[0039] Based on the above questions, please refer to Figure 1 , Figure 1 This is a flow chart of an embodiment of the encryption and decryption method provided by the present application. Specifically, it may include the following steps:

[0040] Step S110: the management platform sends the permission level certificate to the storage end, and the storage end sends the storage certificate to the management platform.

[0041] In order to limit the authority of the operation object, different authority can be set for different operation objects to protect the original data. At the same time, when the original data is leaked, it can be traced more quickly to track the leaked operation object to determine the responsibility. Therefore, several authority levels are set in this encryption and decryption system. For example, three authority levels are set: restricted level, confidential level, and top secret level. The order of these three authority levels from low to high is restricted level, confidential level, and top secret level. In addition, corresponding authority level certificates are set for corresponding authority levels. Therefore, the authority of the original data is restricted by the authority level certificate, and only the operation object of the corresponding authority level can operate the original data.

[0042] Please refer to Figure 2 The encryption and decryption system 200 includes a storage end 210, a management platform 220 and an operation end 230, wherein a trusted network communication (for example, based on SSL / TLS) is established between the storage end 210 and the management platform 220, and between the management platform 220 and the operation end 230 to ensure data security of both communicating parties.

[0043] Storage end 210: has the capability of symmetric and asymmetric encryption and decryption. The original data needs to be encrypted when it is exported.

[0044] Management platform 220: responsible for managing the public and private key pairs for encryption and decryption of raw data and the corresponding certificates, and has the ability to issue certificates. It is also responsible for managing the permissions of all current raw data operation objects and the certificates of the corresponding operation objects.

[0045] Operation terminal 230: has the ability of symmetric and asymmetric encryption and decryption, is responsible for decrypting the encrypted data, and performs corresponding operations according to the authority of the operation object.

[0046] In some embodiments, three permission levels, namely restricted, confidential, and top secret, can be set for the original data in the encryption and decryption system 200. Therefore, in the management platform 220, corresponding permission public-private key pairs can be generated according to the permission levels in the encryption and decryption system 200, for example, a restricted public-private key pair, a confidential public-private key pair, and a top secret public-private key pair can be generated. And the management platform 220 can also issue corresponding permission level certificates for the corresponding permission public-private key pairs, for example, a restricted permission level certificate, a confidential permission level certificate, and a top secret permission level certificate can be issued, and the corresponding permission level certificates can also be set with corresponding numbers. The management platform 220 sends all levels of permission level certificates and their numbers generated by it to the storage end 210, so that the storage end 210 can quickly determine the permission level that needs to be encrypted for the original data.

[0047] In some embodiments, in order to improve the credibility of the identity between the storage end 210 and the management platform 220, the storage end 210 can generate a storage certificate for its own storage public-private key pair, and the storage certificate includes the storage public key. After the storage certificate is generated, the storage end 210 imports it into the management platform 220, so that the storage end 210 and the management platform 220 can be verified through the corresponding certificate during the interaction process, thereby ensuring the credibility of the identities of the two parties in the interaction, and also ensuring that the interactive content is not tampered with.

[0048] In addition, in the encryption and decryption system 200, a management platform 220 can be connected to multiple storage terminals 210 and multiple operation terminals 230. Therefore, the management platform 220 may store storage certificates imported by multiple different storage terminals 210 and operation certificates imported by multiple different operation terminals 230. In order to reasonably preserve these storage certificates and operation certificates, the management platform 220 may also be provided with a certificate management system, which is used to maintain these storage certificates and operation certificates. At the same time, the management platform 220 provides different key services for different authority levels, wherein the key service can provide key interfaces of different authority levels. For example, the key service may include a restricted key interface, a confidential key interface, a top secret key interface, etc. These key interfaces are used to provide corresponding encryption keys or decryption keys and maintain the access validity period of these keys.

[0049] The key service of the management platform 220 can distinguish the access rights of auxiliary encryption keys at different permission levels, thereby realizing permission control over the original data content. At the same time, the auxiliary encryption keys also have access period restrictions, thereby realizing time limits on the original data.

[0050] Step S120: The storage end divides the permission levels of the original data to determine the target permission level corresponding to the original data.

[0051] In some embodiments, the storage end 210 may automatically evaluate the permission level according to the content of the original data to determine the target permission level of the original data.

[0052] For example, if the original data is video data, the evaluation dimension of the storage end 210 is the type and quantity of events triggered in the corresponding time period of the video, as follows:

[0053]

[0054] Among them, the restricted events may be signing, running, etc., and no specific restrictions are made here.

[0055] The storage end 210 evaluates the viewing rights of the video (divided into restricted, confidential and top secret levels) based on the restricted event types, occurrence frequency and included intelligent events within the time period when the video is generated. The operating object can make a final confirmation of the viewing rights according to actual needs when exporting the video. After the operating object determines the permission level, the auxiliary encryption key is encrypting using the permission public key corresponding to the corresponding permission level certificate, so that only the operating object with this viewing permission can decrypt the key through the management platform 220, thereby realizing the permission control of the video data content.

[0056] For another example, the original data may be text data, and the evaluation dimension of the storage end 210 is the type and quantity of events triggered by the corresponding number of pages in the text data, as follows:

[0057]

[0058] The storage end 210 classifies the text data into permission levels according to the above-mentioned determination criteria to determine the target permission level corresponding to the original data.

[0059] Furthermore, after obtaining the target permission level, the storage end 210 can also modify or determine the final target permission level according to actual conditions.

[0060] It is understandable that the original data may be image data, etc. in addition to the above-mentioned video data and text data, which is not specifically limited here.

[0061] Step S130: The storage end encrypts the original data using the original encryption key, and sends an encryption key acquisition request to the management platform to encrypt the original encryption key to obtain the target data provided to the operation end.

[0062] Among them, the encryption key acquisition request includes encryption request signature data, which is generated based on the authority public key provided by the management platform 220. The authority level corresponding to the authority public key matches the operation authority of the encrypted data. The management platform 220 verifies the encryption request signature data by using the authority private key to verify the encryption request signature data in the encryption key acquisition request.

[0063] Please refer to Figure 3 After the target permission level is determined, the storage end 210 generates an original encryption key and a key ID through a secure key generation algorithm, and then uses the original encryption key to symmetrically encrypt the original data to obtain encrypted data.

[0064] For example, if the original data is video data, the original encryption key can be used to symmetrically encrypt frame data such as key frames, audio frames, and data frames in the video data.

[0065] Furthermore, to prevent the encrypted data from being easily cracked, multiple different original encryption keys can be used to encrypt different parts of the original data, so it is necessary to record the key ID of each original encryption key used to encrypt the original data. In the subsequent decryption process, the corresponding original encryption key can be found according to the key ID for decryption, and the original data can only be operated when the encrypted data is completely decrypted.

[0066] After the encryption is completed, the storage end 210 matches the multiple permission level certificates stored in the storage end 210 by the management platform 220 according to the target permission level corresponding to the original data, and generates the encryption request signature data according to the permission public key in the matched permission level certificate, wherein the permission level certificate corresponding to the permission public key is generated by the management platform 220 for the permission public-private key pair and sent to the storage end 210, and different permission levels correspond to different permission level certificates. At the same time, the storage end 210 determines the corresponding key interface in the management platform 220 according to the target permission level corresponding to the original data. In this way, the encryption request signature data and the key interface number to be connected are combined to obtain an encryption key acquisition request, and the encryption key acquisition request is sent to the management platform 220. In addition, the encryption key acquisition request may also include information such as the number of the corresponding permission level certificate, which is not specifically limited here.

[0067] The storage end 210 sends an encryption key acquisition request to the management platform 220 to request the auxiliary encryption key from the corresponding key interface in the management platform 220. After receiving the encryption key acquisition request, the management platform 220 first uses the corresponding authority private key to verify the encryption request signature data in the encryption key acquisition request to obtain an encryption verification result. In response to the encryption verification result being a verification pass, the corresponding key interface provides an auxiliary encryption key of the corresponding authority level and its corresponding second identifier, wherein the second identifier can be an ID, a number, etc., which is not specifically limited here. At the same time, the management platform 220 uses the storage public key in the storage certificate to asymmetrically encrypt the auxiliary encryption key. The management platform 220 also generates encryption key signature data through the storage public key in the storage certificate. The management platform 220 combines the encrypted auxiliary encryption key and the encryption key signature data to obtain encryption key data. The management platform 220 sends the encryption key data to the storage end 210.

[0068] Before the management platform 220 sends the encryption key data to the storage end 210, the auxiliary encryption key is encrypted to ensure the data security of the auxiliary encryption key during transmission. The original text can only be obtained by asymmetric decryption through the corresponding storage private key to prevent the auxiliary encryption key from being decrypted by a third party and leaked.

[0069] After receiving the encryption key data, the storage end 210 first uses the storage private key to verify the encryption key signature data in the encryption key data. After the verification is passed, the storage private key is used to asymmetrically decrypt the encrypted auxiliary encryption key to obtain the auxiliary encryption key. Then, the auxiliary encryption key is used to encrypt the original encryption key to obtain the target key. Then, the target key, the first identifier of the original encryption key and the second identifier of the auxiliary encryption key are combined to obtain the encrypted auxiliary data; the encrypted auxiliary data is stored in the encrypted data to obtain the target data.

[0070] The target key, the first identifier and the second identifier are stored together as encryption auxiliary data in a fixed position of the encrypted data, so that the operation terminal 230 can read it conveniently.

[0071] Step S140: the operation terminal sends the operation certificate to the management platform, and the management platform sends the operation authentication certificate to the operation terminal.

[0072] In some embodiments, the operation terminal 230 generates an operation public-private key pair, and sends the operation public key to the management platform 220 or a CA (Certificate Authority) organization to issue an operation certificate, and sends the operation certificate to the management platform 220. The management platform 220 generates an operation authentication certificate for authenticating the public-private key pair, the operation authentication certificate carries the authentication public key, and sends the operation authentication certificate to the operation terminal 230.

[0073] Step S150: The management platform receives a request for obtaining a decryption key for target data sent by the operation terminal, and after verification, sends the decryption key data to the operation terminal.

[0074] In some embodiments, after receiving the target data, the operation end 230 parses the target data to obtain a first identifier of the auxiliary encryption key, then combines the first identifier with the decryption request signature data and the account data to obtain a decryption key acquisition request, and then sends the decryption key acquisition request to the management platform 220.

[0075] After the management platform 220 receives the decryption key acquisition request, the management platform 220 first uses the authentication private key to verify the decryption request signature data in the decryption key acquisition request to obtain a sub-verification result. Further, after the sub-verification result is verified, the authority of the account data is verified, and the access period of the corresponding auxiliary encryption key is verified by the first identifier to obtain the decryption verification result. If the decryption verification result is a sub-verification result and the authority verification of the account data is passed and the period of the auxiliary encryption key has not expired, the management platform 220 finds the corresponding auxiliary encryption key according to the first identifier and uses the operation public key to asymmetrically encrypt it to obtain the encrypted auxiliary encryption key, and combines the decryption key signature data with the encrypted auxiliary encryption key to obtain the decryption key data, and then sends the decryption key data to the operation terminal 230.

[0076] Among them, the decryption key acquisition request sent by the operation terminal 230 to the management platform 220 includes decryption request signature data and account data. The decryption request signature data is generated based on the authentication public key provided by the management platform 220. The authentication public key is obtained by the operation terminal 230 from the corresponding operation authentication certificate. The operation authentication certificate corresponding to the authentication public key is generated by the management platform 220 for the authentication private key pair and sent to the operation terminal 230.

[0077] Step S160: After receiving the decryption key data, the operation end verifies it, and after the verification is passed, decrypts the target data to obtain the original data.

[0078] In some embodiments, after receiving the decryption key data, the operation terminal 230 may perform subsequent operations according to the feedback of the received decryption key data. Figure 4 .

[0079] After receiving the decryption key data, the operation terminal 230 parses the decryption key data. If the information fed back by the decryption key data includes the decryption key signature data and the auxiliary encryption key, it is considered that the decryption key acquisition request sent by the operation terminal 230 is successful; if the information fed back by the decryption key data is empty or does not include the decryption key signature data and the auxiliary encryption key, it means that the request of the operation terminal 230 has failed, and the reason for the failure of the request is analyzed according to the decryption key data. If the result of the analysis is no permission, the operation terminal 230 should prompt that there is no operation permission for the target data; if the result of the analysis is that the key has expired, it will prompt that the target data has expired.

[0080] The decryption key signature data is generated based on the operation public key provided by the operation terminal 230 . The operation public key is obtained by the management platform 220 from the operation certificate. The operation certificate is generated by the operation terminal 230 and sent to the management platform 220 .

[0081] In the case that the decryption key acquisition request sent by the known operation terminal 230 is successful, the operation terminal 230 verifies the decryption key signature data using the operation private key. If the verification fails, the verification failure is prompted; if the verification is successful, the operation terminal 230 decrypts the encrypted auxiliary encryption key using the operation private key. If the decryption fails, the decryption failure is prompted; if the decryption is successful, the auxiliary encryption key is obtained, and the operation terminal 230 continues to read the target data and parse it to obtain the first identifier and the target key of the original encryption key, and then decrypts the target key using the auxiliary encryption key according to the first identifier. If the decryption fails, the decryption failure is prompted; if the decryption is successful, the original encryption key is obtained, and then the encrypted data is decrypted using the original encryption key to obtain the original data. The operation terminal 230 can then operate on the original data.

[0082] Specifically, the corresponding permission level can be determined according to the account data of the operation terminal 230, and different operations can be performed at different permission levels. For example, if the original data is video data, and the account data of the operation terminal 230 is a restricted permission level, the account can watch 25% of the video time of the video data; if the account data of the operation terminal 230 is a confidential permission level, the account can watch 60% of the video time of the video data; if the account data of the operation terminal 230 is a top secret permission level, the account can complete the viewing of the video data.

[0083] In a specific embodiment, the above encryption verification process is described from the perspective of the storage end 210. Figure 5 , Figure 5 This is a flow chart of an embodiment of the encryption verification method of the present application. Specifically, it may include the following steps:

[0084] Step S510: Send an encryption key acquisition request for encrypted data to the management platform.

[0085] The encryption key acquisition request includes encryption request signature data, and the encrypted data is obtained by encrypting using the original encryption key. The encrypted data may be video data.

[0086] In some embodiments, in order to further encrypt the original data, an encryption key acquisition request may be sent to the management platform 220 to encrypt the original encryption key, thereby avoiding leakage of the original data caused by leakage of the original encryption key.

[0087] In some embodiments, in order to better protect the original data, the operation permissions of the operation object can be restricted. At the same time, in the process of interaction between the storage end 210 and the management platform 220, in order to prevent the leakage of interactive information and ensure the rationality of the identities of both parties, the interactive information sent by both parties can be verified. Specifically, the management platform 220 can generate an authority level certificate for the corresponding level of authority public-private key pair, and send the authority level certificates of each level to the storage end 210. The authority level certificate carries the corresponding authority public key. For example, the management platform 220 can generate a restricted level authority level certificate, a confidential level authority level certificate, a top secret level authority level certificate, etc. The storage end 210 also generates a storage certificate for the storage public-private key pair, and sends the storage certificate to the management platform 220. The storage certificate carries the corresponding storage public key.

[0088] Therefore, after receiving the encryption key acquisition request sent by the storage end 210, the management platform 220 can use the authority private key to sign the encryption request data therein. Similarly, after receiving the data sent by the management platform 220, the storage end 210 can use the storage private key to verify its signature data. Among them, the encryption request signature data is generated based on the authority public key provided by the management platform 220, and the authority level corresponding to the authority public key matches the operation authority of the encrypted data. The authority public key is obtained by the storage end 210 from the corresponding authority level certificate, and the authority level certificate corresponding to the authority public key is generated by the management platform 220 for the authority public-private key pair and sent to the storage end 210. Different authority levels correspond to different authority level certificates.

[0089] In order to obtain the operation permission level of the encrypted data, the permission level of the original data can be divided before sending the encryption key acquisition request to determine the target permission level corresponding to the original data. For example, the divided levels can be restricted, confidential, and top secret. After that, based on the target permission level, the second identifier of the auxiliary encryption key to be obtained is determined, and then the encryption request signature data and the second identifier of the auxiliary encryption key are combined to obtain the encryption key acquisition request. Among them, the auxiliary encryption key is used to encrypt the original encryption key.

[0090] After receiving the encryption key acquisition request, the management platform 220 first uses the corresponding authority private key to verify the encryption request signature data in the encryption key acquisition request to obtain an encryption verification result. In response to the encryption verification result being a verification pass, the corresponding auxiliary encryption key is found according to the auxiliary encryption key identifier. Afterwards, the management platform 220 uses the storage public key to asymmetrically encrypt the auxiliary encryption key. The management platform 220 also generates encryption key signature data through the storage public key. The management platform 220 combines the encrypted auxiliary encryption key and the encryption key signature data to obtain encryption key data. The management platform 220 sends the encryption key data to the storage end 210. Among them, the storage public key is obtained by the management platform 220 from the storage certificate, the storage certificate is generated by the storage end 210 and sent to the management platform 220, and the encryption key signature data is generated based on the storage public key provided by the storage end 210.

[0091] In other embodiments, key interfaces with different permission levels are provided in the management platform 220, for example, a restricted key interface, a confidential key interface, and a top secret key interface may be provided. These key interfaces are used to provide corresponding encryption keys or decryption keys and maintain the access validity period of these keys. Therefore, the storage end 210 can determine the corresponding key interface in the management platform 220 according to the target permission level, and then combine the encryption request signature data and the key interface number to be connected to obtain an encryption key acquisition request, and send the encryption key acquisition request to the management platform 220.

[0092] Step S520: Receive encryption key data sent by the management platform.

[0093] The encryption key data is sent after the management platform 220 verifies the encryption request signature data, and the encryption key data includes the auxiliary encryption key and the encryption key signature data.

[0094] In some embodiments, after receiving the encryption key data, the storage end 210 uses the storage private key to verify the encryption key signature data to obtain a verification result.

[0095] Step S530: In response to the encryption key signature data being verified successfully, the original encryption key is encrypted using the auxiliary encryption key to obtain a target key.

[0096] In some embodiments, after the storage end 210 verifies the encryption key signature data, it uses the storage private key to decrypt the auxiliary key encrypted data to obtain the auxiliary encryption key, and then uses the auxiliary encryption key to encrypt the original encryption key to obtain the target key.

[0097] Step S540: Combine the target key and the encrypted data to obtain target data provided to the operation terminal.

[0098] In some embodiments, the storage end 210 combines the target key, the first identifier of the original encryption key, and the second identifier of the auxiliary encryption key to obtain encrypted auxiliary data, stores the encrypted auxiliary data into the encrypted data, obtains the target data, and then sends the target data to the operation end 230.

[0099] In a specific embodiment, the above encryption verification process is described from the perspective of the operating terminal 230. Figure 6 , Figure 6 This is a flowchart of an embodiment of the decryption verification method of the present application. Specifically, it may include the following steps:

[0100] Step S610: Send a decryption key acquisition request for target data to the management platform.

[0101] The decryption key acquisition request includes decryption request signature data and account data, and the target data includes the target key and encrypted data.

[0102] In order to better protect the original data, the operation rights of the operation object can be restricted. At the same time, in the process of interaction between the operation terminal 230 and the management platform 220, in order to ensure the rationality of the identities of both parties in the leakage of the interactive information, the information sent by both parties can be verified. Specifically, the operation terminal 230 generates an operation public-private key pair, and sends the operation public key to the management platform 220 to issue an operation certificate, and sends the operation certificate to the management platform 220. The management platform 220 generates an operation authentication certificate for the authentication public-private key pair, and the operation authentication certificate carries the authentication public key, and sends the operation authentication certificate to the operation terminal 230.

[0103] In some embodiments, the target data also includes a first identifier of the original encryption key. After receiving the target data, the operation terminal 230 parses the target data to obtain the first identifier, and then combines the first identifier with the decryption request signature data to obtain a decryption key acquisition request, and sends the decryption key acquisition request to the management platform 220. The decryption request signature data is generated according to the authentication public key provided by the management platform 220. The authentication public key is obtained by the operation terminal 230 from the corresponding operation authentication certificate. The operation authentication certificate corresponding to the authentication public key is generated by the management platform 220 for the authentication private key pair and sent to the operation terminal 230.

[0104] After the management platform 220 receives the decryption key acquisition request, the management platform 220 first uses the authentication private key to verify the decryption request signature data in the decryption key acquisition request to obtain a sub-verification result. Further, after the sub-verification result is verified, the authority of the account data is verified, and the access period of the corresponding auxiliary encryption key is verified by the first identifier to obtain the decryption verification result. If the decryption verification result is a sub-verification result and the authority verification of the account data is passed and the period of the auxiliary encryption key has not expired, the management platform 220 finds the corresponding auxiliary encryption key according to the first identifier and uses the operation public key to asymmetrically encrypt it to obtain the encrypted auxiliary encryption key, and combines the decryption key signature data with the encrypted auxiliary encryption key to obtain the decryption key data, and then sends the decryption key data to the operation terminal 230.

[0105] Step S620: Receive decryption key data sent by the management platform.

[0106] The decryption key data is sent after the management platform 220 verifies both the decryption request signature data and the account data. The decryption key data includes the decryption key signature data and the auxiliary encryption key.

[0107] In some embodiments, after the operation terminal 230 receives the decryption key data, the operation terminal 230 verifies the decryption key signature data using the operation private key. The decryption key signature data is generated based on the operation public key provided by the operation terminal 230, and the operation public key is obtained by the management platform 220 from the operation certificate, and the operation certificate is generated by the operation terminal 230 and sent to the management platform 220.

[0108] Step S630: In response to the decryption key signature data being verified, the target key is decrypted using the auxiliary encryption key to obtain the original encryption key.

[0109] In some embodiments, after the decryption key signature data is verified, the operation terminal 230 uses the operation private key to decrypt the auxiliary encryption key to obtain an unencrypted auxiliary encryption key, and then uses the unencrypted auxiliary encryption key to decrypt the target key to obtain the original encryption key.

[0110] Step S640: Decrypt the encrypted data using the original encryption key to obtain the original data.

[0111] In some embodiments, the operation terminal 230 may use the original encryption key to decrypt the encrypted data to obtain the original data, and then the operation terminal 230 may operate on the original data.

[0112] Specifically, when the obtained original data is video data, a watermark can be superimposed on the video during the playback of the video data to mark the name of the operation object and other information, so that the source can be traced after the video is reshot and reversed.

[0113] In a specific embodiment, the above encryption verification process is described from the perspective of the management platform 220. Figure 7 , Figure 7 This is a flow chart of an embodiment of the verification method of the present application. Specifically, it may include the following steps:

[0114] Step S711: Receive an encryption key acquisition request for encrypted data sent by the storage end.

[0115] The encryption key acquisition request includes encryption request signature data, and the encrypted data is obtained by encrypting with the original encryption key.

[0116] In some embodiments, after the storage end 210 encrypts the original data using the original encryption key to obtain the encrypted data, in order to further ensure the security of the encrypted data, it sends an encryption key acquisition request to the management platform 220 to obtain the auxiliary encryption key to encrypt the original encryption key.

[0117] Step S712: Verify the encrypted request signature data to obtain an encrypted verification result.

[0118] In some embodiments, after receiving the encryption key acquisition request, the management platform 220 first uses the corresponding authority private key to verify the encryption request signature data in the encryption key acquisition request to obtain an encryption verification result. Among them, the encryption request signature data is generated based on the authority public key provided by the management platform 220, the authority level corresponding to the authority public key matches the operation authority of the encrypted data, the authority public key is obtained by the storage end 210 from the corresponding authority level certificate, the authority level certificate corresponding to the authority public key is generated by the management platform 220 for the authority public-private key pair, and sent to the storage end 210, and different authority levels correspond to different authority level certificates.

[0119] Step S713: In response to the encryption verification result being verification passed, the encryption key data is sent to the storage end.

[0120] Among them, the encryption key data includes an auxiliary encryption key and encryption key signature data. The auxiliary encryption key is used to encrypt the original encryption key to obtain a target key after the encryption key signature data is verified at the storage end 210. The target key is used to provide it to the operation end 230 together with the encrypted data.

[0121] In some embodiments, after the encryption verification result is verified as passed, the management platform 220 uses the storage public key to encrypt the auxiliary encryption key to obtain auxiliary key encrypted data, and combines the encryption key signature data and the auxiliary key encrypted data to obtain encryption key data, wherein the encryption key signature data is generated based on the storage public key provided by the storage end 210, and the storage public key is obtained by the management platform 220 from the storage certificate, and the storage certificate is generated by the storage end 210 and sent to the management platform 220.

[0122] In some embodiments, the authentication method between the management platform 220 and the operation terminal 230 may refer to steps S721 to S723 .

[0123] Step S721: The management platform receives a request for obtaining a decryption key for target data sent by the operation terminal.

[0124] The decryption key acquisition request includes decryption request signature data and account data, and the target data includes the target key and encrypted data.

[0125] In some embodiments, after receiving the target data, the operation end 230 parses the target data to obtain a first identifier of the auxiliary encryption key, then combines the first identifier with the decryption request signature data and the account data to obtain a decryption key acquisition request, and then sends the decryption key acquisition request to the management platform 220.

[0126] Step S722: Verify the decryption request signature data to obtain a decryption verification result.

[0127] The decryption request signature data is generated based on the authentication public key provided by the management platform 220 .

[0128] In some embodiments, after receiving the decryption key acquisition request, the management platform 220 uses the authentication private key to verify the decryption request signature data to obtain a sub-verification result; in response to the sub-verification result being a passed verification, the permissions of the account data are verified, and the term of the auxiliary encryption key is verified to obtain a decryption verification result.

[0129] Step S723: In response to the decryption verification result being verification passed, the decryption key data is sent to the operation end.

[0130] The decryption key data includes decryption key signature data and an auxiliary encryption key. The auxiliary encryption key is used to decrypt the target key to obtain the original encryption key after the decryption key signature data is verified by the operation terminal 230.

[0131] In some embodiments, in response to the decryption verification result being that the sub-verification result has passed, the permission verification of the account data has passed, and the term of the auxiliary encryption key has not expired, the management platform 220 encrypts the auxiliary encryption key using the operation public key to obtain an encrypted auxiliary encryption key, and then combines the decryption key signature data with the encrypted auxiliary encryption key to obtain decryption key data, and then sends the decryption key data to the operation terminal 230. Among them, the decryption key signature data is generated according to the operation public key provided by the operation terminal 230, the operation public key is obtained by the management platform 220 from the operation certificate, the operation certificate is generated by the operation terminal 230 and sent to the management platform 220, and the operation terminal 230 verifies the decryption key signature data using the operation private key.

[0132] The decryption key acquisition request interaction between the operation terminal 230 and the management platform 220 adopts a two-way signature verification operation to ensure the credibility of the identities of both parties in the interaction and at the same time ensure that the interactive content is not tampered with. At the same time, asymmetric encryption is used to encrypt the auxiliary encryption key, so that only the corresponding operation terminal 230 account can decrypt the encrypted content.

[0133] Those skilled in the art will appreciate that, in the above method of specific implementation, the order in which the steps are written does not imply a strict execution order and does not constitute any limitation on the implementation process. The specific execution order of the steps should be determined by their functions and possible internal logic.

[0134] See also Figure 8 , Figure 8It is a schematic diagram of the framework of an embodiment of an encryption verification device 800 of the present application. The encryption verification device 800 includes an encryption request sending module 810, an encryption data receiving module 820, an encryption module 830 and a combination module 840. The encryption request sending module 810 executes the storage end to send an encryption key acquisition request for encrypted data to the management platform, wherein the encryption key acquisition request includes encryption request signature data, and the encrypted data is encrypted using the original encryption key. The encryption data receiving module 820 executes receiving the encryption key data sent by the management platform, wherein the encryption key data is sent after the management platform verifies the encryption request signature data, and the encryption key data includes an auxiliary encryption key and encryption key signature data. The encryption module 830 executes, in response to the encryption key signature data verification, to encrypt the original encryption key using the auxiliary encryption key to obtain the target key. The combination module 840 executes to combine the target key and the encrypted data to obtain the target data provided to the operation end.

[0135] In some embodiments, the encryption request sending module 810 executes encryption request signature data based on the authority public key provided by the management platform. The authority level corresponding to the authority public key matches the operation authority of the encrypted data. The management platform uses the authority private key to verify the encryption request signature data in the encryption key acquisition request.

[0136] In some embodiments, the execution authority public key of the encryption request sending module 810 is obtained by the storage end from the corresponding authority level certificate, and the authority level certificate corresponding to the authority public key is generated by the management platform for the authority public-private key pair and sent to the storage end, and different authority levels correspond to different authority level certificates; and / or, before the storage end sends an encryption key acquisition request for encrypted data to the management platform, it includes: dividing the authority level of the original data to determine the target authority level corresponding to the original data; and the storage end sends an encryption key acquisition request for the encrypted data to the management platform, including: based on the target authority level, determining the auxiliary encryption key identifier to be obtained; combining the encryption request signature data and the auxiliary encryption key identifier to obtain an encryption key acquisition request.

[0137] In some embodiments, the encrypted data receiving module 820 generates the encrypted key signature data based on the storage public key provided by the storage end, and the storage end verifies the encrypted key signature data using the storage private key.

[0138] In some embodiments, the encrypted data receiving module 820 executes a storage public key obtained by the management platform from a storage certificate, and the storage certificate is generated by the storage end and sent to the management platform; and / or, the encryption key data includes auxiliary key encryption data, and the encryption key data sent by the management platform is received, including: using the storage private key to verify the encryption key signature data to obtain a verification result; and in response to the encryption key signature data verification being passed, including: using the storage private key to decrypt the auxiliary key encrypted data to obtain an auxiliary encryption key.

[0139] In some embodiments, the combination module 840 executes the encrypted data into video data; and / or combines the target key and the encrypted data to obtain the target data provided to the operation end, including: combining the target key, the first identifier of the original encryption key and the second identifier of the auxiliary encryption key to obtain encrypted auxiliary data; storing the encrypted auxiliary data into the encrypted data to obtain the target data.

[0140] See also Fig. 9 , Fig. 9 : is a schematic diagram of a framework of an embodiment of an electronic device 90 of the present application. The electronic device 90 includes a memory 91 and a processor 92 coupled to each other, and the processor 92 is used to execute program instructions stored in the memory 91 to implement the steps of any of the above encryption verification method embodiments, or to implement the steps of any of the above decryption verification method embodiments, or to implement the steps of any of the above verification method embodiments. In a specific implementation scenario, the electronic device 90 may include, but is not limited to: a microcomputer, a server, and in addition, the electronic device 90 may also include mobile devices such as laptops and tablet computers, which are not limited here.

[0141] Specifically, the processor 92 is used to control itself and the memory 91 to implement the steps of any of the above encryption verification method embodiments, or to implement the steps of any of the above decryption verification method embodiments, or to implement the steps of any of the above verification method embodiments. The processor 92 can also be called a CPU (Central Processing Unit). The processor 92 may be an integrated circuit chip with signal processing capabilities. The processor 92 can also be a general-purpose processor, a digital signal processor (Digital Signal Processor, DSP), an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field-programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. In addition, the processor 92 can be implemented by an integrated circuit chip.

[0142] See also Fig.10 , Fig.10 1 is a schematic diagram of a framework of an embodiment of a computer-readable storage medium 100 of the present application. The computer-readable storage medium 100 stores program instructions 1001 that can be executed by a processor, and the program instructions 1001 are used to implement the steps of any of the above encryption verification method embodiments, or to implement the steps of any of the above decryption verification method embodiments, or to implement the steps of any of the above verification method embodiments.

[0143] In some embodiments, the functions or modules included in the device provided by the embodiments of the present disclosure can be used to execute the method described in the above method embodiments. The specific implementation can refer to the description of the above method embodiments, and for the sake of brevity, it will not be repeated here.

[0144] The above description of various embodiments tends to emphasize the differences between the various embodiments. The same or similar aspects can be referenced to each other, and for the sake of brevity, they will not be repeated herein.

[0145] In the several embodiments provided in the present application, it should be understood that the disclosed methods and devices can be implemented in other ways. For example, the device implementation described above is only schematic. For example, the division of modules or units is only a logical function division. There may be other division methods in actual implementation, such as units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0146] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0147] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) or a processor to execute all or part of the steps of each implementation method of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program code.

Claims

1. A data encryption verification method, characterized in that: Applied to the storage side, including: Classifying the permission levels of the original data to determine the target permission level corresponding to the original data; Sending an encryption key acquisition request for the encrypted data to the management platform, wherein the encryption key acquisition request includes encryption request signature data, the encrypted data is encrypted using the original encryption key, the encryption request signature data is generated based on the authority public key provided by the management platform, the authority level corresponding to the authority public key matches the operation authority of the encrypted data, the authority public key is obtained by the storage end from the corresponding authority level certificate, the authority level certificate corresponding to the authority public key is generated by the management platform for the authority public-private key pair and sent to the storage end, and different authority levels correspond to different authority level certificates; Receiving encryption key data sent by the management platform, wherein the encryption key data is sent by the management platform after the encryption request signature data is verified, and the encryption key data includes an auxiliary encryption key and encryption key signature data; In response to the encryption key signature data being verified, encrypting the original encryption key using the auxiliary encryption key to obtain a target key; Combining the target key and the encrypted data to obtain target data provided to the operation terminal; The sending of the encryption key acquisition request for the encrypted data to the management platform includes: determining the auxiliary encryption key identifier to be acquired based on the target authority level; and combining the encryption request signature data and the auxiliary encryption key identifier to obtain the encryption key acquisition request.

2. The method according to claim 1, characterized in that The management platform verifies the encryption request signature data by using an authority private key to verify the encryption request signature data in the encryption key acquisition request.

3. The method according to claim 1, characterized in that: The encryption key signature data is generated based on the storage public key provided by the storage end, and the storage end verifies the encryption key signature data using the storage private key.

4. The method according to claim 3, characterized in that The storage public key is obtained by the management platform from a storage certificate, and the storage certificate is generated by the storage end and sent to the management platform; And / or, the encryption key data includes auxiliary key encryption data, and the receiving of the encryption key data sent by the management platform includes: Verifying the encryption key signature data using the stored private key to obtain a verification result; and, After the response to the encryption key signature data being verified, the method further comprises: The auxiliary key encrypted data is decrypted using the stored private key to obtain the auxiliary encryption key.

5. The method according to claim 1, characterized in that The encrypted data is video data; And / or, combining the target key and the encrypted data to obtain target data provided to the operation terminal includes: Combining the target key, the first identifier of the original encryption key, and the second identifier of the auxiliary encryption key to obtain encrypted auxiliary data; The encryption auxiliary data is stored in the encrypted data to obtain the target data.

6. A data decryption verification method, characterized in that: Applied to the operation end, including: Sending a decryption key acquisition request for target data to the management platform, wherein the decryption key acquisition request includes decryption request signature data and account data, the target data is obtained by the storage end by combining the target key and the encrypted data and providing it to the operation end, the target key is obtained by the storage end based on the encryption key data sent after the management platform verifies the encryption request signature data, the encryption request signature data is generated according to the authority public key provided by the management platform, the authority level corresponding to the authority public key matches the operation authority of the encrypted data, the authority public key is obtained by the storage end from the corresponding authority level certificate, the authority level certificate corresponding to the authority public key is generated by the management platform for the authority public-private key pair and sent to the storage end, different authority levels correspond to different authority level certificates, the encryption request signature data is the storage end dividing the authority level of the original data to determine the target authority level corresponding to the original data; based on the target authority level, determining the auxiliary encryption key identifier to be obtained; combining the encryption request signature data and the auxiliary encryption key identifier; Receiving decryption key data sent by the management platform, wherein the decryption key data is sent by the management platform after verifying both the decryption request signature data and the account data, and the decryption key data includes the decryption key signature data and the auxiliary encryption key; In response to the decryption key signature data being verified, decrypting the target key using the auxiliary encryption key to obtain an original encryption key; The encrypted data is decrypted using the original encryption key to obtain the original data.

7. The method according to claim 6, characterized in that The decryption request signature data is generated according to the authentication public key provided by the management platform, and the management platform verifies the decryption request signature data by using the authentication private key to verify the decryption request signature data in the decryption key acquisition request.

8. The method according to claim 7, characterized in that The authentication public key is obtained by the operation terminal from the corresponding operation authentication certificate. The operation authentication certificate corresponding to the authentication public key is generated by the management platform for the authentication private key pair and sent to the operation terminal. And / or, the target data further includes the first identifier of the original encryption key, and before the operation terminal sends a request for obtaining the decryption key of the target data to the management platform, the operation terminal includes: parsing the target data to obtain the first identifier; and, The operation end sends a request for obtaining a decryption key for target data to the management platform, including: Combining the first identifier and the decryption request signature data to obtain the decryption key acquisition request; The decryption key acquisition request is sent to the management platform.

9. The method according to claim 6, characterized in that The decryption key signature data is generated based on the operation public key provided by the operation terminal. The operation public key is obtained by the management platform from the operation certificate. The operation certificate is generated by the operation terminal and sent to the management platform. The operation terminal uses the operation private key to verify the decryption key signature data.

10. The method according to claim 6, characterized in that The auxiliary encryption key in the decryption key data is obtained by the management platform encrypting the operation public key; Before decrypting the target key using the auxiliary encryption key to obtain the original encryption key, the method includes: Decrypting the auxiliary encryption key using the operation private key to obtain the unencrypted auxiliary encryption key; The decrypting the target key by using the auxiliary encryption key to obtain the original encryption key includes: The target key is decrypted using the unencrypted auxiliary encryption key to obtain the original encryption key.

11. A verification method, characterized in that: Applied to management platforms, including: Receive an encryption key acquisition request for encrypted data sent by a storage end, wherein the encryption key acquisition request includes encryption request signature data, the encrypted data is encrypted using an original encryption key, the encryption request signature data is generated based on an authority public key provided by the management platform, the authority level corresponding to the authority public key matches the operation authority of the encrypted data, the authority public key is obtained by the storage end from a corresponding authority level certificate, the authority level certificate corresponding to the authority public key is generated by the management platform for an authority public-private key pair and sent to the storage end, different authority levels correspond to different authority level certificates, the encryption key acquisition request is the storage end dividing the authority level of the original data to determine the target authority level corresponding to the original data; based on the target authority level, determining the auxiliary encryption key identifier to be obtained; and combining the encryption request signature data and the auxiliary encryption key identifier to obtain; Verifying the encrypted request signature data to obtain an encrypted verification result; In response to the encryption verification result being a passed verification, encryption key data is sent to the storage end, wherein the encryption key data includes an auxiliary encryption key and encryption key signature data, and the auxiliary encryption key is used to encrypt the original encryption key to obtain a target key after the encryption key signature data is verified by the storage end, and the target key is used to provide it to the operation end together with the encrypted data.

12. The method according to claim 11, characterized in that The encrypted request signature data is generated according to the authority public key provided by the management platform. The authority level corresponding to the authority public key matches the operation authority of the encrypted data. The authority public key is obtained by the storage end from the corresponding authority level certificate. The authority level certificate corresponding to the authority public key is generated by the management platform for the authority public-private key pair and sent to the storage end. Different authority levels correspond to different authority level certificates. And / or, the verifying the encrypted request signature data to obtain an encrypted verification result includes: Using the authority private key to verify the encrypted request signature data to obtain the encrypted verification result; and, Before sending the encryption key data to the storage end, the method includes: Encrypting the auxiliary encryption key using the stored public key to obtain auxiliary key encrypted data; The encryption key signature data and the auxiliary key encryption data are combined to obtain the encryption key data, wherein the encryption key signature data is generated based on the storage public key provided by the storage end, the storage public key is obtained by the management platform from the storage certificate, and the storage certificate is generated by the storage end and sent to the management platform.

13. The method according to claim 11, characterized in that The method further comprises: The management platform receives a decryption key acquisition request for target data sent by the operation terminal, wherein the decryption key acquisition request includes decryption request signature data and account data, and the target data includes a target key and encrypted data; Verifying the decryption request signature data to obtain a decryption verification result; In response to the decryption verification result being a passed verification, decryption key data is sent to the operation end, wherein the decryption key data includes decryption key signature data and an auxiliary encryption key, and the auxiliary encryption key is used to decrypt the target key to obtain the original encryption key after the decryption key signature data is verified by the operation end.

14. The method according to claim 13, characterized in that The decryption request signature data is generated according to the authentication public key provided by the management platform, and the decryption request signature data is verified to obtain a decryption verification result, including: Using the authentication private key to verify the decryption request signature data to obtain a sub-verification result; In response to the sub-verification result being a passed verification, the authority of the account data is verified, and the expiration of the auxiliary encryption key is verified to obtain the decryption verification result.

15. The method according to claim 14, characterized in that The decryption key signature data is generated according to the operation public key provided by the operation terminal, the operation public key is obtained by the management platform from the operation certificate, the operation certificate is generated by the operation terminal and sent to the management platform, and the operation terminal verifies the decryption key signature data using the operation private key; In response to the decryption verification result being a verification pass, sending the decryption key data to the operation terminal includes: In response to the decryption verification result being that the sub-verification result is passed, the permission verification of the account data is passed, and the term of the auxiliary encryption key is not expired, encrypting the auxiliary encryption key using the operation public key to obtain an encrypted auxiliary encryption key; Combining the decryption key signature data with the encrypted auxiliary encryption key to obtain the decryption key data; The decryption key data is sent to the operation terminal.

16. An electronic device, characterized in that: It includes a memory and a processor coupled to each other, and the processor is used to execute program instructions stored in the memory to implement the data encryption verification method described in any one of claims 1 to 5, or the data decryption verification method described in any one of claims 6 to 10, or the verification method described in any one of claims 11 to 15.

17. A computer-readable storage medium having program instructions stored thereon, characterized in that: When the program instructions are executed by the processor, the data encryption verification method described in any one of claims 1 to 5 is implemented, or the data decryption verification method described in any one of claims 6 to 10 is implemented, or the verification method described in any one of claims 11 to 15 is implemented.

Images