Data processing method and device, equipment and storage medium

Abstract

The embodiment of the invention provides a data processing method and device, equipment and a storage medium, which are used for safely and universally realizing business data processing. Comprising the steps of obtaining business data of a target business; obtaining an encryption key of the target service from a key management library, wherein the encryption key is generated by encrypting a service key by a background server of the target service by using a stored first root key; calling the encryption protection system to decrypt the encryption key by using a stored second root key to obtain a service key, wherein the first root key and the second root key are a group of symmetric keys; encrypting the service data by using the service key to obtain intermediate data; sending the intermediate data to a background server; and receiving an execution result of the target service, wherein the execution result is obtained by executing the target service by the background server according to service data obtained by decrypting the intermediate data by using the service key. The technical scheme provided by the invention can be applied to the fields of information security, big data, cloud technology, block chains and the like.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a data processing method, device, equipment and storage medium. Background Art

[0002] At present, when users use third-party applications in mobile phones, computers and other terminal devices to make payments, or open private files or applications in mobile phones, computers and other terminal devices, they often need to use security authentication technology to verify biometric authentication information such as face and fingerprint to verify the user's identity. Usually, the third-party application client can send the biometric authentication information to the corresponding application server for verification, so that after the application server verifies the legitimacy, it can realize functions such as payment and opening private files or applications.

[0003] At present, in order to improve the security of biometric authentication information, the trusted application (TA) in the secure area (Trusted Execution Environment, TEE) of the terminal device can sign the biometric authentication information obtained by the third-party application, and then verify the information through the application server corresponding to the third-party application. When the third-party application interacts with the trusted application, it usually needs to go through the application framework layer interface in the terminal system, which requires the third-party application to define the interface function of the application framework layer so that the new interface can be redefined to execute the corresponding algorithm to call the hardware abstraction layer and then access the TA in the TEE. However, the above solution requires frequent updates of the application framework layer in the system, that is, it is necessary to adapt the device at the hardware level, making the solution not universal. In another solution, the key of the biometric authentication information is written into code or stored in the storage area of ​​the terminal device, but this storage method makes the security level of the key low, thereby affecting the security of the business data.

[0004] Therefore, there is an urgent need for a universal and secure business data processing method. Summary of the invention

[0005] The embodiments of the present application provide a data processing method, apparatus, device and storage medium for securely and universally implementing business data processing.

[0006] In view of this, on the one hand, the present application provides a data processing method, including: obtaining business data corresponding to a target business; obtaining an encryption key corresponding to the target business from a key management library, the encryption key being generated by the background server of the target business using a stored first root key to encrypt a business key, and the business key being dynamically generated by the background server; calling an encryption protection system to decrypt the encryption key using a stored second root key to obtain the business key, the first root key and the second root key being a set of symmetric keys; using the business key to encrypt the business data to obtain intermediate data; sending the intermediate data to the background server; receiving an execution result of the target business, the execution result being obtained by the background server executing the target business according to the business data, and the business data being obtained by the background server decrypting the intermediate data using the business key.

[0007] Another aspect of the present application provides a data processing device, comprising:

[0008] An acquisition module is used to acquire business data corresponding to the target business;

[0009] The processing module is used to obtain the encryption key corresponding to the target business from the key management library, the encryption key is generated by the background server of the target business using the stored first root key to encrypt the business key, and the business key is dynamically generated by the background server; call the encryption protection system to use the stored second root key to decrypt the encryption key to obtain the business key, the first root key and the second root key are a group of symmetric keys; use the business key to encrypt the business data to obtain intermediate data;

[0010] The transceiver module is used to send the intermediate data to the background server; receive the execution result of the target business, which is obtained by the background server executing the target business according to the business data, and the business data is obtained by the background server decrypting the intermediate data using the business key.

[0011] In one possible design, in another implementation of another aspect of the embodiment of the present application, the processing module is used to send an initialization key request to the key management library, where the initialization key request carries a service identifier of the target service;

[0012] The encryption key is obtained from the key management repository according to the service identifier.

[0013] In one possible design, in another implementation of another aspect of the embodiment of the present application, the processing module is used to perform a traversal search in the key management library according to the service identifier to obtain a search result;

[0014] When the search result determines that the key management library stores the encryption key, calling the encryption key from the key management library;

[0015] When the search result determines that the encryption key does not exist in the key management library, a key request is sent to the backend server, so that the backend server generates the business key in response to the key request, and encrypts the business key using the first root key to obtain the encryption key;

[0016] Receiving the encryption key sent by the backend server, and storing the encryption key in the key management library;

[0017] The encryption key is recalled from the key management repository.

[0018] In one possible design, in another implementation of another aspect of the embodiment of the present application, the encryption key is obtained by encrypting the business key using the first root key using any one of a symmetric encryption algorithm, an asymmetric encryption algorithm, a hash algorithm, and a digital signature algorithm.

[0019] In one possible design, in another implementation of another aspect of the embodiment of the present application, the processing module is used to perform obfuscation processing on the storage code of the encryption key by using OLLVM technology or wxprotector technology to obtain an obfuscated storage code;

[0020] The encryption key is stored in the key management repository using the obfuscated storage code.

[0021] In one possible design, in another implementation of another aspect of the embodiment of the present application, the processing module is used to use OLLVM or wxprotector to obfuscate the calling code that calls the encryption key from the key management library to obtain the obfuscated calling code;

[0022] The encryption key is called using the obfuscated calling code.

[0023] In one possible design, in another implementation of another aspect of the embodiment of the present application, the processing module is used to use the business key to encrypt the business data using any one of a symmetric encryption algorithm, an asymmetric encryption algorithm, a hash algorithm, and a digital signature algorithm to obtain the intermediate data.

[0024] In one possible design, in another implementation of another aspect of the embodiment of the present application, the processing module is used to call the encryption protection system to use the business key to adopt any one of a symmetric encryption algorithm, an asymmetric encryption algorithm, a hash algorithm, and a digital signature algorithm to encrypt the business data to obtain the intermediate data;

[0025] or,

[0026] The processing module is used to call the key management library to use the business key to adopt any one of a symmetric encryption algorithm, an asymmetric encryption algorithm, a hash algorithm, and a digital signature algorithm to encrypt the business data to obtain the intermediate data.

[0027] In a possible design, in another implementation of another aspect of the embodiment of the present application, the acquisition module is used to acquire a palm print image in a palm recognition service and use the palm print image as the service data;

[0028] or,

[0029] The acquisition module is used to acquire a fingerprint image in a fingerprint recognition service and use the fingerprint image as service data;

[0030] or,

[0031] The acquisition module is used to acquire an iris picture in an iris recognition service and use the iris picture as service data;

[0032] or,

[0033] The acquisition module is used to acquire voice data in the voice recognition service and use the voice data as the service data;

[0034] or,

[0035] The acquisition module is used to acquire a face image in a face recognition service and use the face image as the service data.

[0036] In a possible design, in another implementation of another aspect of the embodiment of the present application, the execution result is obtained by the backend server performing a palmprint recognition service according to the palmprint image;

[0037] or,

[0038] The execution result is obtained by the backend server executing the fingerprint recognition service according to the fingerprint image;

[0039] or,

[0040] The execution result is obtained by the backend server executing the iris recognition service according to the iris picture;

[0041] or,

[0042] The execution result is obtained by the backend server executing the speech recognition service according to the speech data;

[0043] or,

[0044] The execution result is obtained by the backend server executing the face recognition service based on the face photo.

[0045] In one possible design, in another implementation of another aspect of the embodiment of the present application, the processing module is used to call the virtual machine protection system to use the second root key to decrypt the encryption key to obtain the business key, and the virtual machine protection system serves as the encryption protection system.

[0046] In one possible design, in another implementation of another aspect of the embodiment of the present application, the processing module is used to call the white box encryption system to use the second root key to decrypt the encryption key to obtain the business key, and the white box encryption system serves as the encryption protection system.

[0047] Another aspect of the present application provides a computer device, including: a memory, a processor, and a bus system;

[0048] Wherein, the memory is used to store programs;

[0049] The processor is used to execute the program in the memory, and the processor is used to execute the above-mentioned methods according to the instructions in the program code;

[0050] The bus system is used to connect the memory and the processor so that the memory and the processor can communicate with each other.

[0051] Another aspect of the present application provides a computer-readable storage medium, in which instructions are stored. When the computer-readable storage medium is run on a computer, the computer is enabled to execute the above-mentioned methods.

[0052] Another aspect of the present application provides a computer program product or a computer program, the computer program product or the computer program includes computer instructions, the computer instructions are stored in a computer-readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the methods provided by the above aspects.

[0053] It can be seen from the above technical solutions that the embodiments of the present application have the following advantages: the business key corresponding to the business data is encrypted and decrypted using the root key for transmission, and the business data is also encrypted and transmitted using the business key, which can ensure the security of the business data during transmission. At the same time, the encryption processing of the business key is run separately in the encryption protection system, making the storage and acquisition of the business key safer. The encryption protection system does not need to exchange information with the background server, so it does not need to be configured for different background servers, so that the entire data processing process can be used in various scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1aThis is a schematic diagram comparing the effects of the VMP solution in the embodiment of the present application from the attacker's perspective with the prior art;

[0055] Figure 1b A system diagram of the compilation process and operation process of the VMP solution in the embodiment of the present application;

[0056] Figure 2a This is a schematic diagram of an application scenario of the data processing method in an embodiment of the present application;

[0057] Figure 2b A schematic diagram of a system architecture of a data processing method in an embodiment of the present application;

[0058] Figure 3 This is a schematic diagram of an embodiment of a data processing method in an embodiment of the present application;

[0059] Figure 4 A flowchart of an application scenario of the data processing method in an embodiment of the present application;

[0060] Figure 5 A schematic diagram of an embodiment of a data processing device in an embodiment of the present application;

[0061] Figure 6 This is another schematic diagram of an embodiment of a data processing device in an embodiment of the present application;

[0062] Figure 7 FIG. 2 is a schematic diagram of another embodiment of a data processing device in an embodiment of the present application. DETAILED DESCRIPTION

[0063] The embodiments of the present application provide a data processing method, apparatus, device and storage medium for securely and universally implementing business data processing.

[0064] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein, for example. In addition, the terms "including" and "corresponding to" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0065] At present, when users use third-party applications in terminal devices such as mobile phones and computers to make payments, or open private files or applications in terminal devices such as mobile phones and computers, they often need to use security authentication technology to verify biometric authentication information such as face and fingerprint to verify the user's identity. Usually, the third-party application client can send the biometric authentication information to the corresponding application server for verification, so as to realize functions such as payment and opening private files or applications after the application server verifies the legality. At present, in order to improve the security of biometric authentication information, the TA in the TEE of the terminal device can sign the biometric authentication information obtained by the third-party application, and then verify the information through the application server corresponding to the third-party application. When the third-party application interacts with the trusted application for data, it usually needs to go through the application framework layer interface in the terminal system, which requires the third-party application to define the interface function of the application framework layer so that the redefinition of the new interface can execute the corresponding algorithm to call the hardware abstraction layer and then access the TA in the TEE. However, the above solution needs to be frequently updated with the application framework layer in the system, that is, it needs to be adapted to the device at the hardware level, making the solution not universal. Another solution is to write the key of the biometric authentication information into a code or store it in a storage area of ​​the terminal device. However, this storage method makes the key security level low, thus affecting the security of the business data. Therefore, a universal and secure business data processing method is urgently needed.

[0066] In order to solve the above technical problems, the present application provides the following technical solutions: obtain the business data corresponding to the target business; obtain the encryption key corresponding to the target business from the key management library, the encryption key is generated by the background server of the target business using the first root key stored to encrypt the business key, and the business key is dynamically generated by the background server; call the encryption protection system to use the second root key stored to decrypt the encryption key to obtain the business key, the first root key and the second root key are a group of symmetric keys; use the business key to encrypt the business data to obtain intermediate data; send the intermediate data to the background server; receive the execution result of the target business, the execution result is obtained by the background server executing the target business according to the business data, and the business data is obtained by the background server using the business key to decrypt the intermediate data. In this way, the business key corresponding to the business data is encrypted and decrypted for transmission using the root key, and the business data is also encrypted and transmitted using the business key, so that the security of the business data during transmission can be guaranteed. At the same time, the encryption processing process of the business key is run separately in the encryption protection system, making the storage and acquisition of the business key safer. The encryption protection system does not need to exchange information with the background server, so it does not need to be configured for different background servers, so that the entire data processing process can be used in various scenarios.

[0067] For ease of understanding, some of the terms used in this application are described below:

[0068] White box: The attacker has full control over the entire operation process and has full visibility into it. The attacker can freely observe the operation of the dynamic password, and the details of the internal algorithm are fully visible and can be changed at will.

[0069] Black box: In contrast to white box, it is assumed that the attacker has no substantial access to the key (the algorithm for executing encryption or decryption) or any internal operations, and can only observe some external information or operations, which include plaintext (input) or ciphertext (output) in the system, and it is assumed that code execution and dynamic encryption cannot be observed.

[0070] Confusion: Confusion means making it difficult for people to understand, disrupting information, making the information exist in a completely incomprehensible form, and making people unable to understand the intermediate process (that is, they can only see the input and output but cannot understand how the result is obtained), but it does not affect the function of the information itself.

[0071] Key obfuscation scheme: The key storage is written in the code, and through the code obfuscation OLLVM technology, control flow flattening, function inlining, variable renaming, constant obfuscation, and code insertion are used to make the program structure more complex and difficult to understand, thereby protecting the key.

[0072] National Cryptography Library: National Cryptography Library refers to a software library used to support cryptographic algorithms and protocols issued by the National Cryptography Administration. National Cryptography Library usually includes the implementation of cryptographic algorithms such as symmetric encryption algorithms, asymmetric encryption algorithms, hash algorithms, digital signature algorithms, as well as corresponding key management and protocol implementations.

[0073] SM4: SM4 is a symmetric encryption algorithm, also known as SMS4, which is a block cipher algorithm proposed by Chinese cryptographers. The SM4 algorithm uses a 128-bit key and a 128-bit block length and can be used for data encryption and authentication.

[0074] White box encryption: White box encryption belongs to symmetric encryption, which refers to a special encryption method that can resist attacks in a white box environment. The core idea is to confuse the symmetric key in the white box logic, making it impossible to guess.

[0075] Low Level Virtual Machine (LLVM): is an open source compiler infrastructure that includes a set of modular compiler tools and libraries that can be used to build compilers, debuggers, static analysis tools, etc. LLVM has become an independent open source project and has been widely used and supported.

[0076] OLLVM: Obfuscator-LLVM is an obfuscation solution based on the LLVM compiler. It can obfuscate C / C++ code, thereby increasing the complexity and incomprehensibility of the code and improving the security of the code.

[0077] TEE: Trusted Execution Environment, TEE is a running environment that coexists with the Rich OS (usually Android, etc.) on the device and provides security services to the Rich OS. It has its own execution space and has a higher security level than the Rich OS.

[0078] Secure Element (SE): It is an independent security hardware. Since it is a completely independent security hardware chip, its security strength is higher than TEE.

[0079] JAVA layer and Native layer: Android JAVA layer refers to JAVA code running based on the virtual machine, while Android Native layer refers to C / C++ code running based on local code.

[0080] Virtual Machine Protector (VMP): It can convert part of the code in the protected file into a program (bytecode) running in the virtual machine (VM). The instruction code in the virtual machine is not public, which increases the difficulty of reverse engineering. From the attacker's perspective, its operating principle can be as follows: Figure 1a As shown in the figure, in the VMP solution, the C++ source code is recompiled through the VMP tool chain to generate the VMP instruction set, and finally the VMP instruction set is run in the VMP virtual machine. Compared with the general assembly instruction set solution, from the attacker's perspective, the VMP instruction set generated by the VMP tool chain has no mapping relationship, and the attacker cannot understand the VMP instruction set; at the same time, the attacker cannot debug the virtual machine environment, and thus cannot obtain the corresponding attack parameters through debugging.

[0081] The operation flow chart of the VMP can be shown as follows: Figure 1bAs shown, the core protection code obtained by C++ compilation is first compiled to generate an intermediate binary file through the VMP compilation toolbox; then part of the code in the intermediate binary file is selected to be compiled again to generate virtual instructions of the core protection code, and a virtual machine environment is created at the same time, and anti-debugging and probe monitoring of the core protection code are performed in the virtual machine environment; then the above-mentioned virtual machine environment (that is, the encryption protection system of the present application) is deployed on the terminal device (the terminal device is used to execute the business code of the target business), and when the terminal device runs the business code, the virtual machine environment in the nativen layer of the terminal device is called to execute the core code virtual instructions related to the business code.

[0082] The data processing method, device, equipment and storage medium provided in the embodiments of the present application can realize business data processing securely and universally. Figure 2a ,like Figure 2aIt is an optional architecture diagram under an application scenario of the data processing method provided in the embodiment of the present application. In order to realize and support a data processing scheme, the terminal device 100 is connected to the server 300 through the network 200, and the server 300 is connected to the database 400. The network 200 can be a wide area network or a local area network, or a combination of the two. The client for the user to implement the data processing scheme is deployed on the terminal device 100, wherein the client can be run on the terminal device 100 in the form of a browser, or can be run on the terminal device 100 in the form of an independent application (application, APP), etc. The specific presentation form of the client is not limited here. The server 300 involved in this application can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (Content Delivery Network, CDN), and basic cloud computing services such as big data and artificial intelligence platforms. The terminal device 100 can be a smart phone, a tablet computer, a laptop, a PDA, a personal computer, a smart TV, a smart watch, a vehicle-mounted device, a wearable device, etc., but is not limited thereto. The terminal device 100 and the server 300 can be directly or indirectly connected through the network 200 by wired or wireless communication, and this application does not limit this. The number of servers 300 and terminal devices 100 is also not limited. The solution provided in this application can be completed independently by the terminal device 100, or by the server 300, or by the terminal device 100 and the server 300 in cooperation, and this application does not make specific limitations. Among them, the database 400, in short, can be regarded as an electronic filing cabinet-a place for storing electronic files, and users can add, query, update, delete, and other operations on the data in the file. The so-called "database" is a collection of data that is stored together in a certain way, can be shared with multiple users, has as little redundancy as possible, and is independent of the application program. A database management system (DBMS) is a computer software system designed for managing databases, generally with basic functions such as storage, interception, security, and backup.Database management systems can be classified according to the database models they support, such as relational, Extensible Markup Language (XML); or according to the types of computers they support, such as server clusters, mobile phones; or according to the query language used, such as Structured Query Language (SQL), XQuery; or according to performance impulse focus, such as maximum scale, maximum operating speed; or other classification methods. Regardless of the classification method used, some DBMSs can cross categories, for example, supporting multiple query languages ​​at the same time. In the present application, the database 400 can be used to store keys and business data. Of course, the storage location of keys and business data is not limited to the database. For example, they can also be stored in the distributed file system of the terminal device 100, blockchain or server 300.

[0083] Based on the above description, Figure 2b The application scenario interaction system shown illustrates the data processing method provided by this application:

[0084] like Figure 2b As shown, the application scenario includes a terminal device and a background server, wherein a palmprint recognition application is deployed on the terminal device, and the background server is used to perform a palmprint recognition process (also known as palm swiping recognition). The JAVA layer of the terminal device performs the process of obtaining a palmprint image and encrypting the palmprint image. The native layer of the terminal device is deployed in a key management library and a VMP virtual machine (i.e., the encryption protection system of the present application). Among them, the key management library can manage the business key corresponding to the palmprint recognition service, the VMP virtual machine is used to perform the encryption and decryption process of the business key, and the VMP virtual machine stores the root key corresponding to the palmprint recognition service. The background server sends the business key derived from the root key stored by the background server to the terminal device through the transmission interface; at the same time, the terminal device sends the palmprint image encrypted according to the business key to the background service. Then the background server uses the business key to decrypt the encrypted palmprint image to obtain the original palmprint image, and finally identifies the original palmprint image to obtain the identification result.

[0085] It can be understood that in the specific implementation of this application, business data and other related data are involved. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0086] Combined with the above introduction, the data processing method in this application will be introduced below. Please refer to Figure 3, an embodiment of the data processing method in the embodiment of the present application includes:

[0087] 301. Obtain business data corresponding to the target business.

[0088] In the present application, the data processing device obtains the service data corresponding to the target service in response to the triggering event of the target service.

[0089] In an exemplary solution, the target business may be an identity recognition scenario. Identity recognition is a verification process to identify whether the real identity of a user is consistent with the identity he claims. With the development of identity recognition technology, identity recognition methods based on biometrics have been widely used. An identity recognition trigger event refers to an event that triggers identity recognition, which may specifically include but is not limited to operations and instructions that trigger identity recognition. For example, in an access control system scenario, when a user needs to pass through the access control, an identity recognition event is triggered; for another example, when a user makes a payment at a payment terminal, an identity recognition event is triggered. In addition, identity recognition can also be applied to anti-addiction system scenarios. For example, in an online game anti-addiction system, it is necessary to limit the online game time of minors. When anti-addiction is triggered, for example, when the cumulative online game time of a game user reaches a preset time threshold, the game user needs to be identified. At this time, an identity recognition event is triggered to determine whether the game user is an adult or the game account owner, thereby limiting the online game time of minors. In a specific implementation, an identity recognition trigger event is an event that triggers identity recognition through biometrics. Biometrics are biometrics of body parts that can be measured by the user, such as various types of biometrics such as hand shape, fingerprint, face shape, iris, retina, palm, etc. When identity recognition is processed through biometrics of body parts that can be measured by the user, it is necessary to collect biometric data for the body parts of the user, and extract biometrics from the collected biometrics, so as to perform identity recognition on the user based on the extracted biometrics. For example, if the identity recognition trigger event is to trigger identity recognition through face, the terminal needs to collect facial data for the user's face, and perform identity recognition on the user based on the collected facial data, such as a facial image; for another example, if the identity recognition trigger event is to trigger identity recognition through palm, the terminal needs to collect palm data for the user's palm, and perform identity recognition on the user based on the collected palm data.

[0090] In this process, the user corresponding to the target service refers to the user who needs to be identified, and specifically can be the user who triggers the identity identification event. For example, when a user passes through the access control system, the user can enter the data collection area of ​​the access control system. In the data collection area, when the access control system detects the presence of a user, it indicates that identity identification is required, and then identity identification is triggered. The access control system collects the biological data of the target user in the data collection area, such as the target user's face data, finger data or palm data and other biological data. The service data can be the biological data corresponding to the target part of the user corresponding to the target service. At this time, the target part refers to the part of the human body corresponding to the biological data that needs to be collected. The target part is related to the biological data or biological features involved in the identity identification. For example, if the identity identification is based on the face, the corresponding target part is the face part of the target user who needs to be identified, and the collected biological data (i.e., service data) is facial data, and the biological features identified by the user are facial features. For example, if the identity recognition is based on the palm, the corresponding target part is the palm of the target user who needs to be identified, and the collected biometric data (ie, business data) is the palm data, and the biometric feature of the user identification is the palm feature.

[0091] It is understandable that the service data may be single biometric data or combined biometric data. At the same time, the service data may be complete biometric data or biometric data with local features hidden or deformed.

[0092] The single biometric data may be a single type of biometric feature. For example, when the target part corresponding to the business data is a face, the single biometric data may be a single type of facial feature in the face part, such as bone features, texture features, geometric features, or representational features, etc. The type of facial feature is determined according to the facial features involved in the face-based identity recognition process.

[0093] The biometric feature combination refers to a combination of at least two types of biometric features at the target part corresponding to the business data. The biometric feature combination is obtained by combining different types of biometric features, specifically by combining at least two types of biometric features. The type of biometric features in the biometric feature combination corresponds to the part type of the target part. For example, when the target part is a face, the biometric features in the biometric feature combination are various types of facial features in the face part, such as bone features, texture features, geometric features, and representational features. The type of facial features is determined according to the facial features involved in the face-based identity recognition process. In a specific application, if the facial features are obtained by different facial feature extraction methods, such as extracting features from facial images by different face recognition models, the biometric feature combination can be obtained by combining facial features extracted by different facial feature extraction methods. For another example, when the target part is a palm, the biometric features in the biometric feature combination are various types of palm features in the palm part, such as palm print features, palm vein features, etc. The biometric combination is obtained by combining different types of biometrics. When combining, the various types of biometrics can be equivalently combined, that is, the biometric combination can be obtained directly based on the various types of biometrics; the various types of biometrics can also be weighted combined, that is, the corresponding combination weights are assigned to the various types of biometrics, so as to weight the various types of biometrics and further ensure the effectiveness of the biometric combination. In the specific implementation, the corresponding combination weights of the various types of biometrics can be determined according to the historical identification results corresponding to the various biometrics, so as to highlight the important biometrics in the biometric combination.

[0094] The biometric data with local feature hiding or deformation refers to the transformation of the shape of the target part of the user corresponding to the target service, thereby partially hiding the global part of the target part, so that the local biometric data of the target part can be hidden, avoiding the leakage of the global biometric features of the target part during the biometric feature collection process of identity recognition, thereby ensuring the security of the global biometric features of the target part. The local hiding of the target part can be flexibly implemented according to actual needs. For example, in addition to directly hiding the target part locally physically, the target part can also be deformed to locally hide the global biometric features of the target part. For example, according to the flexibility of the target part itself, the application scenario of identity recognition, etc., the target part can be deformed to make the target part in a deformed form of local hiding. For example, when the target part is a face, the user's face can be partially blocked, such as blocking a specific part of the user's face with an external blocking object, thereby blocking part of the face area; the user can also control the face to transform, such as making a specific expression, so that the face is in a deformed form of local hiding, hiding the local facial features of the face. For another example, when the target part is the palm, considering that the palm part can be flexibly transformed by the fingers, different gestures or hand shapes can be made by the fingers to cover or deform the palm, so that the palm is in a partially hidden deformed form. Specifically, the palm can make an "OK" gesture with the index finger and thumb, and the biometric features of the index finger and thumb in the palm can be hidden, so that the complete biometric features in the palm can be partially hidden. When the target part is in different partially hidden deformed forms, when collecting biometric features of the target part, different biometric features that are partially hidden can be collected, and identity recognition can be performed through different locally hidden biometric features, which can effectively prevent the global biometric features of the target part from being leaked.

[0095] It should be understood that in the above-mentioned biometric collection process, when the biometric data involved is used in specific products or technologies, user permission or consent is required, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0096] The above descriptions are all examples of using biometrics to achieve identity recognition. In actual applications, in this identity recognition scenario, the business data can also be the identification password or other identification information entered by the user, such as a digital certificate or a dynamic password.

[0097] It is understandable that the target business may also be other application scenarios, such as data encryption transmission scenarios or account encryption scenarios in blockchain scenarios, etc., which are not specifically limited here.

[0098] 302. Obtain an encryption key corresponding to the target service from a key management library. The encryption key is generated by encrypting a service key of the target service's backend server using a stored first root key. The service key is dynamically generated by the backend server.

[0099] After the data processing device responds to the target service, the data processing device can initialize the service key of the target service, that is, call the encryption key corresponding to the target service in the key management library. In this embodiment, the key management library is used to manage the service keys corresponding to each service, and in order to ensure the security of the service key, the service key is usually encrypted before storage. At the same time, in order to ensure the mapping relationship between the service key and the service, the service identifier and the service key are usually mapped and managed. That is, the service identifier serves as an index between the service and the service key.

[0100] In an exemplary solution, the data processing device may use the following process when calling the encryption key in the key management library:

[0101] The data processing device sends an initialization key request to the key management library, and the initialization key request carries the service identifier of the target service; then the key management library is traversed and searched according to the service identifier to obtain a search result; when the search result indicates that the key management library contains the encryption key corresponding to the target service, the encryption key is directly called from the key management library; if the search result indicates that the key management library does not contain the encryption key corresponding to the target service, the data processing device triggers the operation of sending a key request to the background server corresponding to the target service; then the data processing device receives the encryption key sent by the background service server, and stores the encryption key in the key management library; finally, the data processing device calls the encryption key from the key management library.

[0102] In this embodiment, after receiving the key request, the backend server derives the business key of the target business according to the stored first root key, and then uses the first root key to encrypt the business key to obtain the encryption key. It is understandable that the backend server can use any one of a symmetric encryption algorithm, an asymmetric encryption algorithm, a hash algorithm, and a digital signature algorithm to encrypt the business key, which is not specifically limited here.

[0103] In this embodiment, the background server and the data processing device both store fixed root keys, wherein the background server can store the first root key in the key storage area of ​​the background server, and the data processing device can store the second root key that is a symmetric key with the first root key in the encryption protection system. It can be understood that the key storage area in the background server can be TEE or SE, or the encryption protection system involved in this application, which is not specifically limited here.

[0104] Optionally, in order to further ensure the security of the service key of the target service, the data processing device may also use code obfuscation technology, such as OLLVM technology or wxprotector technology, when calling the key management library to store and call the encryption key. Specific details are not limited here.

[0105] 303. Call the encryption protection system to use the stored second root key to decrypt the encryption key to obtain the business key. The first root key and the second root key are a set of symmetric keys.

[0106] After the data processing device obtains the encryption key through the key management library, the data processing device can call the encryption protection system to use the stored second root key and adopt the same encryption algorithm as the background to decrypt the encryption key to obtain the business key corresponding to the target business.

[0107] In this embodiment, the encryption protection system may be a VMP virtual machine system or a white box encryption system, which is not limited here.

[0108] 304. Use the business key to encrypt the business data to obtain intermediate data.

[0109] After acquiring the service key, the data processing device encrypts the service data to obtain intermediate data for channel transmission.

[0110] It is understandable that the data processing device can use any one of a symmetric encryption algorithm, an asymmetric encryption algorithm, a hash algorithm, and a digital signature algorithm to encrypt the business data, and the specifics are not limited here.

[0111] In this embodiment, the data processing device may call the encryption protection system to encrypt the business data; or may encrypt the business data in the local environment of the data processing device.

[0112] In an exemplary embodiment, Figure 2b As shown, the data processing device calls the VMP virtual machine to encrypt the service data or the data processing device encrypts the service data at the JAVA layer.

[0113] 305. Send the intermediate data to the backend server.

[0114] The data processing device sends the intermediate data to the background server via wired or wireless means.

[0115] It is understandable that the data processing device may also encrypt the transmission channel when sending the intermediate data, which is not specifically limited here.

[0116] 306. Receive the execution result of the target service, where the execution result is obtained by the backend server executing the target service according to the service data, and the service data is obtained by the backend server decrypting the intermediate data using the service key.

[0117] The data processing device receives the execution result fed back by the background server and displays the execution result to the user.

[0118] In this embodiment, after receiving the intermediate data, the backend server decrypts the intermediate data according to the stored business key to obtain the business data, and then executes the target business according to the business data to obtain the execution result corresponding to the target business.

[0119] The following is an explanation of the data processing method using a specific application scenario. Figure 4 As shown, the application scenario includes terminal devices, background servers and national secret libraries, wherein the terminal devices deploy VMP, key management library and business logic module. The national secret library is used to maintain various encryption algorithms, the key management library is used to manage the business keys of various businesses, the VMP is used to perform the encryption and decryption process of the business keys, and the business logic module is used to execute the business code of the palmprint recognition business. Based on the above description, the process of the palmprint recognition business is explained below:

[0120] 1. The service logic module initiates an initialization key request to the key management library in response to a triggering event of the palmprint recognition service, wherein the initialization key request carries a service identifier of the palmprint recognition service.

[0121] 2. The key management library determines whether there is an encryption key corresponding to the palmprint recognition service in the key management library according to the service identifier. If not, execute steps 3 to 7; if yes, execute step 8.

[0122] 3. The key management library initiates a key request to the backend server.

[0123] 4. The backend server derives the business key of the palmprint recognition service according to the stored root key and stores the business key; then uses the root key to encrypt the business key to generate an encryption key, and returns the encryption key to the key management library.

[0124] 5. After receiving the encryption key, the key management library stores the encryption key. In this embodiment, when storing the encryption key, the key management library associates the encryption key with the service identifier of the palmprint recognition service.

[0125] 6. The key management library calls the VMP to decrypt the encryption key to obtain the business key. The VMP and the backend server store a set of symmetric root keys respectively, so the key management library can call the VMP to use the stored root key to decrypt the encryption key to obtain the business key.

[0126] 7. In the VMP virtual environment, use the virtual environment to run the code that uses the root key to decrypt the encryption key. The VMP virtual environment prefabricates the decryption algorithm corresponding to the encryption algorithm used by the backend server to encrypt the business key, so that it does not rely on the national secret library, improving the security of the decryption process. After decrypting the business key, the business key is returned to the key management library.

[0127] 8. If the encryption key of the palmprint recognition service exists in the key management library, the key management library executes step 7.

[0128] 9. The business logic module calls the business key from the key management library to encrypt the palm print image.

[0129] 10. The key management library calls the corresponding encryption algorithm from the national secret library and uses the business key to encrypt the palm print image. It can be understood that when the key management library calls the encryption algorithm of the national secret library to encrypt the palm print image, it can directly encrypt or decrypt the business data in the local environment of the terminal device, which can speed up the encryption and decryption of the business data.

[0130] The data processing device in this application is described in detail below. Figure 5 , Figure 5 This is a schematic diagram of an embodiment of a data processing device in an embodiment of the present application. The data processing device 20 includes:

[0131] The acquisition module 201 is used to acquire the business data corresponding to the target business;

[0132] Processing module 202 is used to obtain the encryption key corresponding to the target business from the key management library, the encryption key is generated by the background server of the target business using the stored first root key to encrypt the business key, and the business key is dynamically generated by the background server; call the encryption protection system to use the stored second root key to decrypt the encryption key to obtain the business key, the first root key and the second root key are a group of symmetric keys; use the business key to encrypt the business data to obtain intermediate data;

[0133] The transceiver module 203 is used to send the intermediate data to the background server; receive the execution result of the target business, which is obtained by the background server executing the target business according to the business data, and the business data is obtained by the background server decrypting the intermediate data using the business key.

[0134] In an embodiment of the present application, a data processing device is provided. Using the above device, the business key corresponding to the business data is encrypted and decrypted using the root key for transmission, and the business data is also encrypted and transmitted using the business key, which can ensure the security of the business data during transmission. At the same time, the encryption processing process of the business key is run separately in the encryption protection system, making the storage and acquisition of the business key safer. The encryption protection system does not need to exchange information with the background server, so it does not need to be configured for different background servers, so that the entire data processing process can be used in various scenarios.

[0135] Optionally, in the above Figure 5 On the basis of the corresponding embodiment, in another embodiment of the data processing device 20 provided in the embodiment of the present application,

[0136] The processing module 202 is used to send an initialization key request to the key management library, where the initialization key request carries a service identifier of the target service;

[0137] The encryption key is obtained from the key management repository according to the service identifier.

[0138] In an embodiment of the present application, a data processing device is provided. The device is used to query the key management library for the key corresponding to the target service using the service identifier, so that when the key already exists, the interaction with the service background can be reduced, thereby speeding up the service processing.

[0139] Optionally, in the above Figure 5 On the basis of the corresponding embodiment, in another embodiment of the data processing device 20 provided in the embodiment of the present application, the processing module 202 is used to perform a traversal search in the key management library according to the service identifier to obtain a search result;

[0140] When the search result determines that the key management library stores the encryption key, calling the encryption key from the key management library;

[0141] When the search result determines that the encryption key does not exist in the key management library, a key request is sent to the backend server, so that the backend server generates the business key in response to the key request, and encrypts the business key using the first root key to obtain the encryption key;

[0142] Receiving the encryption key sent by the backend server, and storing the encryption key in the key management library;

[0143] The encryption key is recalled from the key management repository.

[0144] In an embodiment of the present application, a data processing device is provided. With the above device, when it is determined according to the service identifier that the key corresponding to the target service exists in the key management library, the key corresponding to the target service can be directly called, and when the key does not exist, the service background can be requested to generate the key, thereby avoiding interaction with the service background every time, thereby speeding up service processing.

[0145] Optionally, in the above Figure 5 On the basis of the corresponding embodiment, in another embodiment of the data processing device 20 provided in the embodiment of the present application,

[0146] The encryption key is obtained by encrypting the business key using the first root key using any one of a symmetric encryption algorithm, an asymmetric encryption algorithm, a hash algorithm, and a digital signature algorithm.

[0147] In an embodiment of the present application, a data processing device is provided. By using the device, multiple encryption algorithms are provided to implement the process of encrypting a service key according to a root key, which can increase the feasibility of the solution.

[0148] Optionally, in the above Figure 5 On the basis of the corresponding embodiment, in another embodiment of the data processing device 20 provided in the embodiment of the present application,

[0149] The processing module 202 is used to perform obfuscation processing on the storage code of the encryption key by using OLLVM technology or wxprotector technology to obtain an obfuscated storage code;

[0150] The encryption key is stored in the key management repository using the obfuscated storage code.

[0151] In an embodiment of the present application, a data processing device is provided. By using the above device, a plurality of obfuscation techniques are used to obfuscate the storage code of the first key, so that the security of the first key can be improved.

[0152] Optionally, in the above Figure 5 On the basis of the corresponding embodiment, in another embodiment of the data processing device 20 provided in the embodiment of the present application, the processing module 202 is used to use OLLVM or wxprotector to perform obfuscation processing on the calling code for calling the encryption key from the key management library to obtain an obfuscated calling code;

[0153] The encryption key is called using the obfuscated calling code.

[0154] In an embodiment of the present application, a data processing device is provided, which uses a plurality of obfuscation techniques to obfuscate the calling code of the first key, thereby improving the security of the first key.

[0155] Optionally, in the above Figure 5 On the basis of the corresponding embodiment, in another embodiment of the data processing device 20 provided in the embodiment of the present application, the processing module 202 is used to use the business key to adopt any one of a symmetric encryption algorithm, an asymmetric encryption algorithm, a hash algorithm, and a digital signature algorithm to encrypt the business data to obtain the intermediate data.

[0156] In an embodiment of the present application, a data processing device is provided. The device is used to implement encryption processing of the business data using multiple encryption methods, thereby increasing the feasibility of the solution.

[0157] Optionally, in the above Figure 5 On the basis of the corresponding embodiment, in another embodiment of the data processing device 20 provided in the embodiment of the present application,

[0158] The processing module 202 is used to call the encryption protection system to use the business key to adopt any one of a symmetric encryption algorithm, an asymmetric encryption algorithm, a hash algorithm, and a digital signature algorithm to encrypt the business data to obtain the intermediate data;

[0159] or,

[0160] The processing module 202 is used to call the key management library to use the business key to adopt any one of a symmetric encryption algorithm, an asymmetric encryption algorithm, a hash algorithm, and a digital signature algorithm to encrypt the business data to obtain the intermediate data.

[0161] In the embodiment of the present application, a data processing device is provided. With the above device, an encryption protection system can be called to perform encryption processing on business data, which can increase the security of business data. At the same time, business data can also be encrypted using real operation scenarios, which can speed up the encryption speed of business data and thus speed up business processing.

[0162] In a possible design, in another implementation of another aspect of the embodiment of the present application, the acquisition module 201 is used to acquire a palm print image in a palm recognition service and use the palm print image as the service data;

[0163] or,

[0164] The acquisition module 201 is used to acquire a fingerprint image in a fingerprint recognition service and use the fingerprint image as service data;

[0165] or,

[0166] The acquisition module 201 is used to acquire an iris picture in an iris recognition service and use the iris picture as service data;

[0167] or,

[0168] The acquisition module 201 is used to acquire voice data in the voice recognition service and use the voice data as the service data;

[0169] or,

[0170] The acquisition module 201 is used to acquire a face image in a face recognition service and use the face image as the service data.

[0171] In the embodiment of the present application, a data processing device is provided. The device is used to refine various application scenarios, thereby increasing the versatility and feasibility of the solution.

[0172] Optionally, in the above Figure 5 On the basis of the corresponding embodiment, in another embodiment of the data processing device 20 provided in the embodiment of the present application,

[0173] The execution result is obtained by the backend server performing the palmprint recognition service according to the palmprint image;

[0174] or,

[0175] The execution result is obtained by the backend server executing the fingerprint recognition service according to the fingerprint image;

[0176] or,

[0177] The execution result is obtained by the backend server executing the iris recognition service according to the iris picture;

[0178] or,

[0179] The execution result is obtained by the backend server executing the speech recognition service according to the speech data;

[0180] or,

[0181] The execution result is obtained by the backend server executing the face recognition service based on the face photo.

[0182] In the embodiment of the present application, a data processing device is provided. The device is used to refine various application scenarios, thereby increasing the versatility and feasibility of the solution.

[0183] Optionally, in the above Figure 5 On the basis of the corresponding embodiment, in another embodiment of the data processing device 20 provided in the embodiment of the present application,

[0184] The processing module 202 is used to call the virtual machine protection system to use the second root key to decrypt the encryption key to obtain the business key. The virtual machine protection system serves as the encryption protection system.

[0185] In an embodiment of the present application, a data processing device is provided. The above device is used, and a virtual machine protection system is used as the encryption protection system, so that the encryption and decryption process of the key can be operated in a virtual machine environment, so that the attacker cannot know the specific instruction set of the code, thereby ensuring the security of the key and further improving the security of the business data.

[0186] Optionally, in the above Figure 5 On the basis of the corresponding embodiment, in another embodiment of the data processing device 20 provided in the embodiment of the present application,

[0187] The processing module 202 is used to call the white box encryption system to use the second root key to decrypt the encryption key to obtain the business key. The white box encryption system serves as the encryption protection system.

[0188] In an embodiment of the present application, a data processing device is provided. The above device is used, white box encryption is used as the encryption protection system, and the key is obfuscated in the white box logic, so that the attacker cannot obtain the specific operation, thereby improving the security of the key and further improving the security of the business data.

[0189] The data processing device provided in this application can be used in a server, see Figure 6 , Figure 6: is a schematic diagram of a server structure provided in an embodiment of the present application. The server 300 may have relatively large differences due to different configurations or performances, and may include one or more central processing units (CPU) 322 (for example, one or more processors) and memory 332, and one or more storage media 330 (for example, one or more mass storage devices) storing application programs 342 or data 344. Among them, the memory 332 and the storage medium 330 can be short-term storage or permanent storage. The program stored in the storage medium 330 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations on the server. Furthermore, the central processing unit 322 can be configured to communicate with the storage medium 330 to execute a series of instruction operations in the storage medium 330 on the server 300.

[0190] The server 300 may also include one or more power supplies 326, one or more wired or wireless network interfaces 350, one or more input and output interfaces 358, and / or one or more operating systems 341, such as Windows Server 2000. TM , Mac OS X TM , Unix TM ,Linux TM , FreeBSD TM etc.

[0191] The steps performed by the server in the above embodiment can be based on the Figure 6 The server structure shown.

[0192] The data processing device provided in this application can be used in terminal equipment. Figure 7 For the sake of convenience, only the parts related to the embodiments of the present application are shown. For specific technical details not disclosed, please refer to the method part of the embodiments of the present application. In the embodiments of the present application, the terminal device is a smart phone as an example for explanation:

[0193] Figure 7 The block diagram shows a partial structure of a smart phone related to the terminal device provided in the embodiment of the present application. Figure 7 The smart phone includes: a radio frequency (RF) circuit 410, a memory 420, an input unit 430, a display unit 440, a sensor 450, an audio circuit 460, a wireless fidelity (WiFi) module 470, a processor 480, and a power supply 490. Those skilled in the art will appreciate that Figure 7The structure of the smartphone shown in the figure does not constitute a limitation of the smartphone, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0194] Combine the following Figure 7 A detailed introduction to the various components of a smartphone:

[0195] The RF circuit 410 can be used for receiving and sending signals during the process of sending and receiving information or making calls. In particular, after receiving the downlink information of the base station, it is sent to the processor 480 for processing; in addition, the designed uplink data is sent to the base station. Generally, the RF circuit 410 includes but is not limited to an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier (LNA), a duplexer, etc. In addition, the RF circuit 410 can also communicate with the network and other devices through wireless communication. The above-mentioned wireless communication can use any communication standard or protocol, including but not limited to the global system of mobile communication (GSM), general packet radio service (GPRS), code division multiple access (CDMA), wideband code division multiple access (WCDMA), long term evolution (LTE), email, short messaging service (SMS), etc.

[0196] The memory 420 can be used to store software programs and modules. The processor 480 executes various functional applications and data processing of the smartphone by running the software programs and modules stored in the memory 420. The memory 420 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area may store data created according to the use of the smartphone (such as audio data, a phone book, etc.), etc. In addition, the memory 420 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0197] The input unit 430 can be used to receive input digital or character information, and to generate key signal input related to the user settings and function control of the smart phone. Specifically, the input unit 430 may include a touch panel 431 and other input devices 432. The touch panel 431, also known as a touch screen, can collect the user's touch operation on or near it (such as the user's operation on the touch panel 431 or near the touch panel 431 using any suitable object or accessory such as a finger, stylus, etc.), and drive the corresponding connection device according to a pre-set program. Optionally, the touch panel 431 may include two parts: a touch detection device and a touch controller. Among them, the touch detection device detects the user's touch orientation, detects the signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts it into contact coordinates, and then sends it to the processor 480, and can receive and execute commands sent by the processor 480. In addition, the touch panel 431 can be implemented in various types such as resistive, capacitive, infrared, and surface acoustic waves. In addition to the touch panel 431, the input unit 430 may also include other input devices 432. Specifically, other input devices 432 may include but are not limited to one or more of a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, a joystick, etc.

[0198] The display unit 440 can be used to display information input by the user or information provided to the user and various menus of the smartphone. The display unit 440 may include a display panel 441. Optionally, the display panel 441 may be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), or the like. Further, the touch panel 431 may cover the display panel 441. When the touch panel 431 detects a touch operation on or near it, it is transmitted to the processor 480 to determine the type of touch event. Subsequently, the processor 480 provides a corresponding visual output on the display panel 441 according to the type of touch event. Although in Figure 7 In the embodiment, the touch panel 431 and the display panel 441 are used as two independent components to implement the input and output functions of the smartphone, but in some embodiments, the touch panel 431 and the display panel 441 can be integrated to implement the input and output functions of the smartphone.

[0199] The smartphone may also include at least one sensor 450, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor may include an ambient light sensor and a proximity sensor, wherein the ambient light sensor may adjust the brightness of the display panel 441 according to the brightness of the ambient light, and the proximity sensor may turn off the display panel 441 and / or the backlight when the smartphone is moved to the ear. As a type of motion sensor, the accelerometer sensor can detect the magnitude of acceleration in all directions (generally three axes), and can detect the magnitude and direction of gravity when stationary. It can be used for applications that identify the posture of the smartphone (such as horizontal and vertical screen switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer, tapping), etc.; as for other sensors that can be configured in smartphones, such as gyroscopes, barometers, hygrometers, thermometers, infrared sensors, etc., they will not be repeated here.

[0200] The audio circuit 460, the speaker 461, and the microphone 462 can provide an audio interface between the user and the smartphone. The audio circuit 460 can transmit the received audio data to the speaker 461 after converting the received audio data into an electrical signal, which is converted into a sound signal for output; on the other hand, the microphone 462 converts the collected sound signal into an electrical signal, which is received by the audio circuit 460 and converted into audio data, and then the audio data is output to the processor 480 for processing, and then sent to another smartphone through the RF circuit 410, or the audio data is output to the memory 420 for further processing.

[0201] WiFi is a short-range wireless transmission technology. Smartphones can help users send and receive emails, browse web pages, and access streaming media through WiFi module 470, which provides users with wireless broadband Internet access. Figure 7 A WiFi module 470 is shown, but it is understandable that it is not an essential component of the smartphone and can be omitted as needed without changing the essence of the invention.

[0202] Processor 480 is the control center of the smartphone, which uses various interfaces and lines to connect various parts of the entire smartphone, and executes various functions of the smartphone and processes data by running or executing software programs and / or modules stored in memory 420, and calling data stored in memory 420, thereby monitoring the smartphone as a whole. Optionally, processor 480 may include one or more processing units; optionally, processor 480 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into processor 480.

[0203] The smart phone also includes a power source 490 (such as a battery) for supplying power to various components. Optionally, the power source can be logically connected to the processor 480 through a power management system, thereby managing functions such as charging, discharging, and power consumption management through the power management system.

[0204] Although not shown, the smartphone may also include a camera, a Bluetooth module, etc., which will not be described in detail here.

[0205] The steps performed by the terminal device in the above embodiment can be based on the Figure 7 The terminal device structure shown.

[0206] A computer-readable storage medium is also provided in an embodiment of the present application. The computer-readable storage medium stores a computer program, which, when executed on a computer, enables the computer to execute the methods described in the aforementioned embodiments.

[0207] The present application also provides a computer program product including a program, which, when executed on a computer, enables the computer to execute the methods described in the aforementioned embodiments.

[0208] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0209] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0210] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0211] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0212] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

[0213] As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A data processing method, characterized in that: include: Obtain business data corresponding to the target business; Obtaining an encryption key corresponding to the target business from a key management library, wherein the encryption key is generated by encrypting a business key by a backend server of the target business using a stored first root key, and the business key is dynamically generated by the backend server; Calling the encryption protection system to use the stored second root key to decrypt the encryption key to obtain the business key, wherein the first root key and the second root key are a set of symmetric keys; Encrypting the service data using the service key to obtain intermediate data; Sending the intermediate data to the backend server; An execution result of the target service is received, where the execution result is obtained when the backend server executes the target service according to the service data, and the service data is obtained when the backend server decrypts the intermediate data using the service key.

2. The method according to claim 1, characterized in that The obtaining of the encryption key corresponding to the target service from the key management library comprises: Sending an initialization key request to the key management library, wherein the initialization key request carries a service identifier of the target service; The encryption key is obtained from the key management repository according to the service identifier.

3. The method according to claim 2, characterized in that The acquiring the encryption key from the key management library according to the service identifier comprises: Performing a traversal search in the key management library according to the service identifier to obtain a search result; When the search result determines that the key management library stores the encryption key, calling the encryption key from the key management library; When the search result determines that the encryption key does not exist in the key management library, sending a key request to the backend server, so that the backend server generates the business key in response to the key request, and encrypts the business key with the first root key to obtain the encryption key; Receiving the encryption key sent by the backend server, and storing the encryption key in the key management library; The encryption key is retrieved from the key management repository.

4. The method according to claim 3, characterized in that The encryption key is obtained by encrypting the business key using the first root key using any one of a symmetric encryption algorithm, an asymmetric encryption algorithm, a hash algorithm, and a digital signature algorithm.

5. The method according to claim 3, characterized in that: The storing the encryption key in the key management repository comprises: Using OLLVM technology or wxprotector technology to obfuscate the storage code of the encryption key to obtain an obfuscated storage code; The encryption key is stored in the key management repository using the obfuscated storage code.

6. The method according to claim 3, characterized in that The calling the encryption key from the key management library comprises: Using OLLVM or wxprotector to obfuscate the calling code for calling the encryption key from the key management library to obtain an obfuscated calling code; The encryption key is called using the obfuscated calling code.

7. The method according to any one of claims 1 to 6, characterized in that Encrypting the service data using the service key to obtain intermediate data includes: The intermediate data is obtained by encrypting the business data using the business key using any one of a symmetric encryption algorithm, an asymmetric encryption algorithm, a hash algorithm, and a digital signature algorithm.

8. The method according to claim 7, characterized in that The step of using the business key to encrypt the business data using any one of a symmetric encryption algorithm, an asymmetric encryption algorithm, a hash algorithm, and a digital signature algorithm to obtain the intermediate data includes: Calling the encryption protection system to encrypt the business data using the business key using any one of a symmetric encryption algorithm, an asymmetric encryption algorithm, a hash algorithm, and a digital signature algorithm to obtain the intermediate data; or, The key management library is called to use the business key to adopt any one of a symmetric encryption algorithm, an asymmetric encryption algorithm, a hash algorithm, and a digital signature algorithm to encrypt the business data to obtain the intermediate data.

9. The method according to any one of claims 1 to 6 and 8, characterized in that: The business data corresponding to the target business is obtained including: Acquire a palmprint image in a palmprint recognition service, and use the palmprint image as the service data; or, Obtaining a fingerprint image in a fingerprint recognition service, and using the fingerprint image as the service data; or, Acquire an iris picture in an iris recognition service, and use the iris picture as the service data; or, Acquire voice data in a voice recognition service, and use the voice data as the service data; or, Acquire a face image in a face recognition service, and use the face image as the service data.

10. The method according to claim 9, characterized in that The execution result is obtained by the backend server executing the palmprint recognition service according to the palmprint picture; or, The execution result is obtained by the backend server executing the fingerprint recognition service according to the fingerprint image; or, The execution result is obtained by the backend server executing the iris recognition service according to the iris picture; or, The execution result is obtained by the backend server executing the speech recognition service according to the speech data; or, The execution result is obtained by the backend server executing the face recognition service according to the face photo.

11. The method according to any one of claims 1 to 6, 8 or 10, characterized in that Calling the encryption protection system to use the second root key to decrypt the encryption key to obtain the business key includes: The virtual machine protection system is called to use the second root key to decrypt the encryption key to obtain the business key, and the virtual machine protection system serves as the encryption protection system.

12. The method according to any one of claims 1 to 6, 8 or 10, characterized in that Calling the encryption protection system to use the second root key to decrypt the encryption key to obtain the business key includes: The white box encryption system is called to decrypt the encryption key using the second root key to obtain the business key, and the white box encryption system serves as the encryption protection system.

13. A data processing device, characterized in that: include: An acquisition module is used to acquire business data corresponding to the target business; A processing module, used for obtaining an encryption key corresponding to the target business from a key management library, wherein the encryption key is generated by encrypting a business key by a background server of the target business using a stored first root key, and the business key is dynamically generated by the background server; Calling the encryption protection system to use the stored second root key to decrypt the encryption key to obtain the business key, wherein the first root key and the second root key are a set of symmetric keys; using the business key to encrypt the business data to obtain intermediate data; A transceiver module, used for sending the intermediate data to the backend server; An execution result of the target service is received, where the execution result is obtained when the backend server executes the target service according to the service data, and the service data is obtained when the backend server decrypts the intermediate data using the service key.

14. A computer device, characterized in that: include: Memory, processor, and bus system; Wherein, the memory is used to store programs; The processor is used to execute the program in the memory, and the processor is used to execute the method according to any one of claims 1 to 12 according to the instructions in the program code; The bus system is used to connect the memory and the processor so that the memory and the processor can communicate with each other.

15. A computer-readable storage medium comprising instructions, which, when executed on a computer, causes the computer to perform the method according to any one of claims 1 to 12.

Images